Just in time access to Exchange online shared mailboxes

We have a shared mailbox created and we are trying assign delegate permissions to users. However, due to compliance needs, none of the users should have permanent access to shared mailbox and it all must be just in time with an audit trail.

I have investigated the use of PIM(Privileged Identity Management) but PIM can only be applied to Entra security groups but not to Mail enabled Distribution groups.

On the other hand, it appears Exchange does not allow delegated permissions to mailboxes using Entra security groups and it must be Mail enabled Distribution groups.

Before rolling out something custom, I wonder if there is a way to achieve this without rolling out custom solutions.

The custom approach I have in mind is to create both PIM enabled Entra security group and a Mail enabled distribution group and once a user activates PIM on the Entra security group, then use a logic app to delta sync the users to Mail enabled security group