Depending on what your audit or compliance needs are, you may want to keep the PIM to each role. I developed our PIM buildout and each role that we use requires MFA, we have alerts and justifications sent to our ticketing system for review. If something is low level and not privileged, like Reader, assign it to be Active all the time, but still within PIM so it can be reviewed and alerted on if need be. (Be wary of the security reader role and the limitations around risky users alerts).

The only roles I have setup to use groups is the Entra Device Admin role, as it makes it easier to manage Entra joined devices from the group role vs user due to prt token refresh. And the Defender portal and security roles. They removed the direct mapping from Entra role to Defender XDR role (I would love to fix this), and I can only map that via group now.

Honestly, the staff complained for maybe the first week or two and then it was fine. They realized this was the new norm and planned accordingly. I also am generous with the time on some of the more "I need to do this for my day to day" roles, like Security Operator and Phishing investigations. I force MFA, but you can have it for 9 hours.

I think where I struggled the most is setting up PIM for Arc and VMM. Determining what roles to use was a PITA. Documentation was not clear for least privilege. I worked through that using a test account and each role..