A developer team needs to access an Azure OpenAI model deployment for development and testing. The security team wants to grant time-limited access that automatically expires after 8 hours without requiring manual revocation. Which approach achieves this?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Microsoft Entra Privileged Identity Management supports eligible role assignments where users can activate a role for a limited time period (configurable up to a maximum). Setting the maximum activation duration to 8 hours for the 'Cognitive Services OpenAI User' role means access automatically expires after 8 hours and must be re-activated.
Full explanation below image
Full Explanation
B is correct because Microsoft Entra Privileged Identity Management supports eligible role assignments where users can activate a role for a limited time period (configurable up to a maximum). Setting the maximum activation duration to 8 hours for the 'Cognitive Services OpenAI User' role means access automatically expires after 8 hours and must be re-activated. A is incorrect because Azure OpenAI API keys do not support custom expiry settings; they must be manually revoked or regenerated. C is incorrect because Conditional Access sign-in frequency controls require re-authentication but do not revoke already-issued access tokens; the developer could still have valid tokens. D is incorrect because Azure OpenAI does not use SAS tokens for authentication; it uses API keys or Entra ID tokens.