Administrators should hold eligible rather than continuously active roles and activate them after approval for a short maintenance window. Which capability fits?

1. A quarterly license reassignment
2. Privileged Identity Management with activation controls
3. An application secret embedded in a wiki
4. Permanent Global Administrator for every operator