Cedar Retail wants administrators to activate privileged Azure roles only during approved maintenance, with justification and strong authentication. Which capability should the architect recommend?

1. Microsoft Entra Privileged Identity Management
2. Permanent Owner assignments with shared credentials
3. A read-only analytics replica
4. Resource locks as the only identity control