You can do time based restrictions if you spin up Entra ID Domain
Services, which is basically Active Directory as a cloud service. This
lets you configure the typical Active Directory restrictions for your
cloud only accounts. However, I'm not sure ...