To secure Azure AD roles using Azure AD Privileged Identity Management (PIM) in a new subscription, what should you do first?

Before you can manage Azure AD roles with PIM, you must first discover the privileged roles within your Azure AD tenant. This initial discovery process identifies the roles that PIM can then protect and manage, allowing you to onboard them into PIM. Signing up for PIM is typically done at the organizational level and is a prerequisite, but not the first action for a new subscription's role management. Consenting to PIM is part of the setup process after discovery. Discovering resources is relevant for Azure resource roles, not Azure AD roles.