Just-In-Time Access

Just-in-Time (JIT) access is the practice of granting elevated privileges only for the duration of a specific task, then automatically revoking those privileges when the task completes. JIT is a cornerstone of modern PAM because it eliminates standing administrative rights — the primary attack vector for privilege escalation.

Instead of “Who has admin rights?” (the RBAC question), JIT asks “Who needs admin rights right now, for what specific task, and for how long?”

The Problem with Standing Privileges

Standing privileges are administrative rights that persist indefinitely — a user who was granted domain admin access three years ago for a server migration project still has that access today.

The Math of JIT Risk Reduction

• Without JIT: 500 users × each having standing admin access = 500 potential attack targets at any moment
• With JIT: 500 users, but only 5 have elevated access at any given moment = 90% reduction in admin attack surface

JIT Access Architecture

┌─────────┐    ┌──────────────┐    ┌────────────────┐
│  User   │───→│  PAM Portal  │───→│  Approval      │
│         │    │  (Request)   │    │  Workflow      │
└─────────┘    └──────────────┘    └───────┬────────┘
                                           │ Approved
                                           ▼
┌─────────┐    ┌──────────────┐    ┌────────────────┐
│  Target │←───│  PAM Proxy   │←───│  Elevation     │
│  System │    │  (Session)   │    │  Engine        │
└─────────┘    └──────────────┘    └────────────────┘
                                           │
                                           ▼
                                    ┌────────────────┐
                                    │  De-Elevation  │
                                    │  (Auto-expiry) │
                                    └────────────────┘

JIT Access Flow

JIT Elevation Methods

Just-Enough Administration (JEA)

JEA is a Microsoft approach to JIT that restricts what administrators can do rather than granting full admin rights. Instead of “admin or not admin,” JEA defines specific commands and parameters that each admin role can execute.

Standard JEA roles:
- DNS Administrator: Can only manage DNS records
- AD User Administrator: Can only create/modify users
- Exchange Administrator: Can only manage mailboxes
- Security Operator: Can only view security logs

Benefits: Granular control, no standing admin rights, constrained execution environment. Limitations: Requires up-front role definition, only available for PowerShell-accessible systems.

Approval Workflows

Workflow Models

Workflow Configuration Best Practices

JIT Integration with ITSM

JIT is most effective when integrated with IT Service Management (ITSM) tools:

JIT Implementation Challenges

Key Takeaways

• JIT access eliminates standing administrative rights by granting privileges only for the duration of a specific task — reducing the admin attack surface by 90% or more
• The JIT flow consists of: request → policy evaluation → approval → elevation → task execution → de-elevation, with automatic expiry as the key control
• JIT elevation methods include temporary group membership, time-limited IAM role assumption, ephemeral sudo access, and just-enough administration (JEA)
• Approval workflows range from self-service (no approval) to dual-approval with emergency bypass — configure thresholds based on risk level
• JIT is most effective when integrated with ITSM tools (ticket validation, auto-creation, change window validation)
• Implementation challenges include legacy application compatibility, admin culture change, and workflow friction — start with non-production, refine, then extend to production