Production administrators should activate Azure privileges only during an approved maintenance window. Which control best reduces standing access?

1. Eligible role assignments with PIM activation requirements
2. A shared account used by all administrators
3. Permanent subscription Owner for every operator
4. A resource lock as the role-activation system