A company needs to grant a group of users time-limited, approval-based access to the Owner role on a subscription only when required. Which Microsoft Entra capability should the architect recommend?