A developer team needs to access an Azure OpenAI model deployment for development and testing. The security team wants to grant time-limited access that automatically expires after 8 hours without requiring manual revocation. Which approach achieves this?
Select an answer to reveal the explanation.
Short Explanation
You want access that expires on its own, so use Microsoft Entra PIM to grant eligible activation of the 'Cognitive Services OpenAI User' role with an 8-hour maximum activation duration. That way the access ends automatically, and you don't have to chase manual revocation.
Full Explanation
The correct approach is using Microsoft Entra Privileged Identity Management to provide eligible role assignments for the 'Cognitive Services OpenAI User' role with a maximum activation duration of 8 hours. Eligible assignments let a developer activate the role when needed, and the activation automatically expires after the configured maximum, so access ends without manual revocation. The API key approach with a custom expiry setting of 8 hours is wrong because Azure OpenAI API keys don't support custom expiry; they must be manually revoked or regenerated. The conditional access sign-in frequency approach is wrong because sign-in frequency can force re-authentication later, but it doesn't revoke already-issued access tokens, so a developer could still have valid tokens. The shared access signature token approach with an 8-hour expiry is wrong because Azure OpenAI doesn't use shared access signature tokens for authentication; it uses API keys or Microsoft Entra ID tokens.