Just-in-Time Admin Access for Technicians

What just-in-time admin access is

JIT admin access replaces an account that is always an admin with one that becomes an admin for a defined task and a defined time. Outside that window, there is nothing privileged on the account to steal.

Every JIT grant has five parts:

A request from a named technician, for a named client and system.
A reason, ideally the PSA ticket number rather than free text.
An approval, automatic for routine work that matches a rule, and a second person for sensitive systems.
A time limit, after which the rights are removed or the account is disabled without anyone having to remember.
A record of who asked, who approved, what was granted, where and for how long.

Two terms sit next to it. Least privilege limits what an account can do. Zero standing privilege is the outcome when every privileged path, including service accounts and break-glass accounts, runs through JIT. JIT is how you get there.

Why technician access is an MSP's biggest standing privilege

A technician account with standing admin rights in every client environment turns one stolen password into access to every client. That is the risk JIT removes.

The 2022 joint government advisory to MSPs, from CISA, the NSA, the FBI and cyber agencies in the UK, Australia and Canada, tells MSPs to apply least privilege "to both internal and customer environments, avoiding default administrative privileges". Its general least-privilege guidance is to "consider the use of time-based privileges to further restrict their use", and it says customer contracts should specify that MSPs "will not reuse admin credentials across multiple customers".

The path attackers use is well documented. In June 2025, CISA reported ransomware actors exploiting unpatched SimpleHelp remote monitoring and management software to compromise customers of a utility billing software provider. The entry point there was a vulnerability, not a password. The lesson for access design is the same: whatever standing access sits behind a provider's tools is what the attacker inherits at every customer.

Mandiant's hardening guidance for UNC3944, the group also tracked as Scattered Spider, is direct about the fix (May 2025): "Follow the principle of just-in-time (JIT) access for checking-out credentials stored in PAM systems."

What the standards say

NIST's zero trust architecture: access to each resource is granted per session, with "the least privileges needed to complete the task."
CIS Controls, dedicated administrator accounts (5.4): restrict administrator privileges to dedicated administrator accounts, separate from the account used for email and browsing.
MITRE ATT&CK, privileged account management: deploy JIT tools such as Privileged Identity Management so elevated permissions are temporary.
The 2022 joint advisory to MSPs: time-based privileges, and no default admin rights in customer environments.

What Microsoft's native tools already do

Microsoft covers parts of JIT well. The gaps are in on-premises Active Directory, local admin on endpoints, and joining it all into one request and approval flow. Here is each tool, from its own documentation.

Entra Privileged Identity Management (PIM)

PIM makes an Entra role "eligible" instead of "active". An eligible user has to activate the role before using it, and activation can require approval, MFA and a justification. Microsoft's documentation says the activation maximum duration "can be from 1 to 24 hours", and that for approvals "we recommend that you select at least two approvers". PIM needs Microsoft Entra ID P2 or Entra ID Governance licensing.

Where it stops: Entra, Azure and Microsoft 365 roles. It doesn't touch on-premises AD groups, local administrator rights on Windows machines, or credentials for systems outside Microsoft's cloud.

Granular delegated admin privileges with PIM for Groups, for your technicians in client tenants

MSPs reach client Microsoft 365 tenants through granular delegated admin privileges (GDAP). Microsoft's GDAP FAQ says partners can implement PIM "on a GDAP security group in the partner's tenant" to give a few users high-privilege roles just in time, "with automatic removal of access". That is real JIT for delegated Entra roles across client tenants, and it is worth setting up before anything else on this page.

Where it stops: it covers the Entra roles delegated through GDAP. It doesn't cover the client's on-premises domain, their servers, local admin on their endpoints, or line-of-business systems. GDAP relationships also expire: the FAQ says "the maximum duration of a GDAP relationship is two years." Auto extend can renew a relationship six months at a time, except one that includes the Global Administrator role.

Active Directory temporary group membership

Since Windows Server 2016, AD can add a user to a group with a time to live. You enable the Privileged Access Management optional feature, then add members with an expiry:

Enable-ADOptionalFeature 'Privileged Access Management Feature' -Scope ForestOrConfigurationSet -Target <forest>
Add-ADGroupMember -Identity 'Domain Admins' -Members <user> -MemberTimeToLive (New-TimeSpan -Minutes 60)

It is better than it looks. Microsoft's Directory Services team explains that the domain controller limits the Kerberos ticket to the shortest remaining membership, so rights really do end on time. Two cautions from the same source: it needs the Windows Server 2016 forest functional level, and "once you enable the Privileged Access Management feature in your forest, you can't turn it off."

Where it stops: it is a mechanism, not a workflow. There is no request, approval or ticket link, it is configured per forest, and at an MSP that means per client.

Windows LAPS, and scripts for local admin

Windows LAPS can rotate the managed local administrator password after it has been used. Microsoft says the feature "is intended to bound the amount of time that the clear-text password is usable", with a configurable grace period. That shortens the window on one local account per device. It isn't a per-technician grant: whoever reads the password is the admin until the grace period ends.

In a Microsoft Q&A thread asking for JIT local admin on premises, the answers were LAPS or a script: one reply says there is no out-of-the-box option and suggests Enable-LocalUser and Disable-LocalUser on a scheduled task. That works on one machine and gives you no approval or audit trail.

What changes at an MSP

An internal IT team runs JIT in one directory for people it knows. An MSP runs it for a team of technicians across dozens of client environments, each with its own directory, its own risk and its own contact who wants to know who touched what. Four things follow.

The ticket is the justification. Tie every grant to a PSA ticket for that client. It gives the approver context, and it answers the client's question later without a separate log hunt.
Approval rules are decided per client, in advance. Routine work on workstations can be pre-approved by rule. Domain controllers, backup systems, finance systems and any client in a regulated industry get a second approver. Write it into the client runbook, not into the technician's judgement at 2 a.m.
Time boxes should fit the task. A patch window needs hours. A password reset needs minutes. A default of "the rest of the shift" is standing privilege with extra steps.
Offboarding a technician becomes one action. If the technician holds no standing rights anywhere, leaving the company means disabling their request rights, not hunting for their admin accounts in every client tenant.

Where teams stall

Most MSPs start JIT and stop partway. The usual stall points:

JIT in the MSP's own tenant, standing admin everywhere else. The client domains and endpoints are where the standing rights still sit.
A "just in case" admin account kept alongside JIT. One standing account undoes the rest. Replace it with a vaulted, monitored break-glass account.
Approvals that take longer than the work. Technicians route around slow approvals. Pre-approve routine tasks by rule and keep human approval for the sensitive ones.
JIT without the phases before it. If discovery (phase 1) and remediation (phase 2) weren't finished, old standing admin accounts still exist next to the new JIT ones.

Where this sits in the PAM journey

JIT is phase 6 of eight. It depends on the phases before it and feeds the one after.

Phase 5, enforce MFA and secure access: a JIT request is only as strong as the sign-in that makes it. Require phishing-resistant MFA on the accounts that can request admin rights. The MFA fatigue and MFA reset playbook covers the attacks on that step.
Phase 6, just-in-time access and zero standing privilege: this page.
Phase 7, audit, monitor and alert: every grant becomes a log entry, and any privileged change made outside a grant should raise an alert, because that is what an intruder looks like. The PAM journey hub covers it.

How CyberQP handles it

In Panthera, each technician gets dedicated JIT accounts that are disabled by default and enabled for a task, on local machines, Active Directory, Entra ID and Google Workspace. A JIT policy sets which technicians can use the accounts, which clients they cover and the account duration, from one hour to 30 days. An activation can require a secondary approval and can be linked to a ConnectWise Manage ticket (Autotask and HaloPSA are coming to Panthera), and privileged account use is logged. The question a client, auditor or insurer will ask is which of your technicians holds admin rights in their environment right now. With JIT accounts disabled by default, the answer should be none.

What done looks like

No technician holds standing Domain Admin, Global Administrator or local admin rights in any client environment.
Delegated Entra roles in client tenants run through GDAP with PIM for Groups, not permanent assignments.
Every grant has a ticket, an approval rule or approver, and an expiry.
Sensitive systems in each client need a second approver, recorded in the client runbook.
The only standing privileged accounts are vaulted, monitored break-glass accounts.
You can tell any client, in one query, who had admin rights in their environment last month and why.

Frequently asked questions

What is just-in-time admin access?

A way of granting admin rights only when a task needs them. The technician requests access, it is approved by rule or by a person, it expires automatically and it is logged. Outside that window the account has no admin rights.

Is Entra PIM enough for an MSP?

For Entra and Microsoft 365 roles, largely yes, and with GDAP you can run PIM for Groups in your own partner tenant for access to client tenants. It doesn't cover client on-premises Active Directory, local admin on endpoints or systems outside Microsoft's cloud, which is where a lot of MSP standing privilege lives.

How long should a JIT window be?

As long as the task, and no longer. Entra PIM caps activations at 24 hours. Most technician tasks need minutes to a few hours. If technicians routinely request the maximum, the time boxes are set by habit, not by the work.

Does JIT slow technicians down?

It adds a request step. Pre-approving routine work by rule keeps that step short for most tickets, and human approval stays for the systems where a second pair of eyes is worth the wait.

What is the difference between JIT access and zero standing privilege?

JIT is the mechanism: rights granted for a task and removed after. Zero standing privilege is the outcome, reached when every privileged path, including service and break-glass accounts, runs through that mechanism or a vault.

Sources: CISA and partner agencies, AA22-131A, protecting against cyber threats to MSPs and their customers (11 May 2022); CISA AA25-163A, SimpleHelp RMM (12 Jun 2025); FBI and CISA AA23-320A, Scattered Spider (16 Nov 2023); Mandiant, Defending Against UNC3944 (6 May 2025); NIST SP 800-207, Zero Trust Architecture (August 2020); CIS Controls Assessment Specification, Control 5; MITRE ATT&CK M1026, Privileged Account Management; Microsoft Learn, What is Privileged Identity Management; Microsoft Learn, PIM role settings; Microsoft Learn, ID Governance licensing; Microsoft Learn, GDAP FAQ; Microsoft Directory Services team, temporary group memberships (2016); Microsoft Learn, Add-ADGroupMember; Microsoft Learn, Windows LAPS concepts; Microsoft Q&A, just-in-time local admin rights. Checked 19 October 2026.