After a company migrated all services to the cloud, the security auditor discovers many users have administrator roles on different services. The company needs a solution that:

Protects the services on the cloud.

Limits access to administrative roles.

Creates a policy to approve requests for administrative roles on critical services within a limited time.

Forces password rotation for administrative roles.

Audits usage of administrative roles.

Which of the following is the best way to meet the company's requirements?