An organization uses Microsoft Entra ID to manage access to their Azure AI Foundry environments (development, staging, production). The security team needs to ensure that changes to production AI model deployments require approval from two members of the AI Security Review team. Which Microsoft Entra feature provides this approval workflow for Azure resource modifications?

A is correct because Microsoft Entra Privileged Identity Management (PIM) for Azure resource roles supports configuring approval requirements for role activation. By setting up the production AI Foundry Contributor (or equivalent) role as eligible with a PIM policy requiring approval from two specified AI Security Review team members, anyone needing to make changes to production AI model deployments must request and receive approval from two reviewers before the role is activated. B is incorrect because Azure Resource Manager deployment stacks manage related resource deployments as a unit but do not provide an identity-based approval workflow for role-level access to make changes. C is incorrect because Access Reviews periodically validate existing role assignments but do not enforce approval for individual production changes. D is incorrect because Azure Policy with required tags is a resource governance control but does not enforce an identity-based approval workflow; tags can be added by anyone with appropriate permissions.