For access denied page, show least privilege role needed to encourage PIM
When I get an access denied page in Azure AD portal, it would be VERY useful to add the least privileged role [needed to see this resource] as part of the error message page. This will help me know specifically which PIM role to activate (or to add this user to for future access) ...otherwise, it's often just ~easier~ to simply reach too high (e.g. activate GA because it's easier than hunting down or using trial-and-error to know which role I actually need)
This is a GREAT resource and I use it often, but just surfacing the info immediately would be useful to reduce any friction...