According to the Microsoft Identity and Access Administrator (SC-300) Study Guide and the Microsoft Learn module "Configure Azure AD P rivileged Identity Management (PIM)" , Azure AD PIM provides two types of role assignments: Active and Eligible.
An Active assignment means the user permanently holds the role with immediate access. An Eligible assignment means the user can activate the role only when needed, after providing justification or approval.
This follows the least privilege principle by reducing exposure to high-privilege roles.
The official documentation states:
"Users assigned as eligible must activate their role when they need to perform privileged tasks. This ensures that administrative privileges are granted only for a limited time and when necessary." Because all IT users currently have permanent Security Administrator roles, the correct remediation is to change their assignment type from Active to Eligible so they can activate it only when required. Options A and B relate to expiration settings but do not convert the assignment type.