Identity and data governance: privileged access, reviews, entitlement, lifecycle.
Groups are how just-in-time access scales past a handful of roles, and they carry constraints sharp enough to reshape a design: a hard cap of 500, a documented slow path through Exchange and SharePoint, and a door that only opens one way.
Take a tenant from standing Global Administrator and Security Administrator assignments to a working just-in-time estate, with deliberate activation windows, a named approver population, and an audit trail that proves it.
Every meaningful PIM decision lives on one settings page, the defaults are not published anywhere, and the three-way choice at the top is the difference between a real control and a decorative one.
An administrator account is only as dangerous as what it can do at the moment it is stolen. Why standing privilege is the risk, what eligibility actually changes, and what P2 buys before the Governance SKU takes over.
