
Explanation/Reference:
Explanation:
Automatic access expiration: Privileged Identity Management (PIM)
To protect privileged accounts from malicious cyber-attacks, you can use Azure Active Directory Privileged Identity Management (PIM) to lower the exposure time of privileges and increase your visibility into their use through reports and alerts.
You can now use PIM with Azure Role-Based Access Control (RBAC) to manage, control, and monitor access to Azure resources. PIM can manage the membership of built-in and custom roles to help you:
Enable on-demand, "just in time" access to Azure resources

Expire resource access automatically for assigned users and groups

Assign temporary access to Azure resources for quick tasks or on-call schedules

Get alerts when new users or groups are assigned resource access, and when they activate eligible

assignments
Time-based access restrictions: Conditional Access
Conditional access is a capability of Azure Active Directory that enables you to enforce controls on the access to apps in your environment based on specific conditions from a central location.
Conditional Access App Control enables user app access and sessions to be monitored and controlled in real time based on access and session policies.
Access to Azure Management endpoints: Conditional Access
References:
https://docs.microsoft.com/en-us/azure/role-based-access-control/pim-azure-resource
https://docs.microsoft.com/en-us/cloud-app-security/proxy-intro-aad
https://docs.microsoft.com/en-us/azure/role-based-access-control/conditional-access-azure-management