An organization wants to require a secondary approval before any user can delete an Azure Machine Learning workspace or remove a private endpoint from an Azure OpenAI resource—even if that user has Owner or Contributor permissions. Which Microsoft Entra ID feature enables this approval gate for specific sensitive Azure management operations?

B is correct because Microsoft Entra ID Protected Actions is a feature that allows administrators to designate specific Azure AD permissions (including management plane operations) as 'protected.' When a user attempts to perform a protected action (such as deleting an Azure ML workspace), they must satisfy a Conditional Access authentication context—typically stepping up to phishing-resistant MFA or getting manager approval through an authentication flow—before the action is permitted. This adds a mandatory approval gate beyond what RBAC alone provides. A is wrong because Azure Resource Locks prevent deletion by anyone until the lock is manually removed by a user with appropriate permissions, but removing the lock itself does not require additional approval—any user with the required lock management permission can remove it. C is wrong because Azure Policy DeployIfNotExists targets resource deployment configuration, not management plane delete operations. D is wrong because Entra ID PIM role expiration limits how long a role is active but does not add an approval gate for specific operations while the role is active.