Four platform engineers need Contributor on the production subscription, but only while they are executing an approved change, roughly two evenings a month. Security requires that the access lapse on its own, that each use be justified and MFA-challenged at the moment it is taken, and that there be an audit trail of who elevated and why.
The tenant is licensed for Microsoft Entra ID Governance. What should you configure?