I suspect Microsoft uses JIT policies for accounts that would be subject to password rotation - you have a separate account that has access to sensitive data, b

I suspect Microsoft uses JIT policies for accounts that would be subject to password rotation - you have a separate account that has access to sensitive data, but it's normally locked. When you need to do something, you initiate an access request that requires either a smart card or hardware security key. Depending on the type of access required, another person may have to ok the request. Once approved, the account is unlocked for a set period of time with a new password.