A municipal call center wants Global Administrator rights available when needed without leaving them standing forever. Which concept fits?

A municipal call center that wants Global Administrator rights available when needed without leaving them standing forever should use Privileged Identity Management (PIM) for just-in-time privileged role activation. PIM makes admins eligible for roles, requires activation (often with MFA, justification, and time limits), and reduces standing privilege that attackers or mistakes can abuse across call-center and city tenant operations.

A Conditional Access policy requiring multifactor authentication for administrators can require MFA at sign-in, but it does not make the role itself time-bound or eligible-only, so the privilege still stands between activations. Recurring Access Reviews for Global Administrator holders can periodically recertify who keeps the role, but they do not make the role eligible or time-bound, so the privilege still stands between reviews. An Identity Protection risk policy blocking risky Global Administrator sign-ins can block sign-ins from risky locations, but it does not make the role eligible or time-bound, so the privilege still stands unless a risk is detected.

Exam caveat: PIM is the AB-900 concept for just-in-time privileged role activation versus permanent standing Global Administrator. Conditional Access requiring MFA, Access Reviews, and Identity Protection risk policies are classic wrong answers on privileged access items.

Operational check: Convert standing Global Administrator assignments to eligible PIM roles for call-center escalation staff, require MFA and justification on activation, set short activation durations, monitor PIM audit history, and retain a tightly controlled break-glass account procedure that is not a Conditional Access MFA policy, an Access Review, or an Identity Protection risk policy standing in for PIM.