Costumers even thrusting their CSP need to have a view and a control over their activities PIM is one of them , and report should be send to the security center that have the abilities to be linked to a SIEM .
it's also part of a compliance audit, we should not need to add that partner as a B2B guest to do so , it's too much combersome as the trust between the azure AD is exisiting .

begin to put the admin agent and helpdesk agent as eligible role (i would even suggest by default" .

CSP Cloud service partner PIM privileged identity management