Using Azure AD PIM to protect administrative privileges