What is just-in-time access?
Just-in-time (JIT) access is a way of granting privileges only at the moment they are needed, for a limited time, and then removing them automatically. Instead of holding standing membership in Domain Admins or a cloud Global Administrator role every day, an administrator holds no elevated rights at all until they request them for a specific task. When the time window ends, the system takes the access away whether or not anyone remembers to. The goal is often described as zero standing privilege: no account carries admin power it isn't using right now.
How just-in-time access works
- Eligibility: an administrator is made eligible for a role but is not active in it.
- Request: when work requires it, they request activation for a set duration, such as two hours, and give a justification such as a change ticket number.
- Verification and approval: the system usually requires MFA again, and sensitive roles need an approver.
- Time-limited grant: the role is active only for the approved window.
- Automatic removal and logging: the role expires on schedule, and every request, approval and expiry is recorded.
Tools that work this way include Microsoft Entra Privileged Identity Management (PIM), which separates eligible role assignments from active ones, and privileged access management (PAM) products that check a credential out of a vault for one session and rotate the password when it is returned. The same idea applies to network access: some cloud platforms open a management port such as RDP 3389 or SSH 22 to one approved source address for a few hours on request, then close it again.
Example: a JIT activation log
14:02:10 request user=rchen-adm role=SQL-Server-Admin duration=1h ticket=CHG0058812 mfa=passed
14:03:45 approved approver=lmorales
15:03:45 expired user=rchen-adm role=SQL-Server-Admin
The log ties the elevation to a person, a reason, an approver and a time window. If the rchen-adm password is phished at 2 a.m., the attacker finds an account with no admin rights, and activating a role would need another MFA check and an approver the attacker doesn't control.
Benefits and trade-offs
- Smaller attack window: stolen admin credentials are worth far less when the account has no standing privilege.
- Less privilege creep: temporary grants can't quietly become permanent.
- Better accountability: every elevation has a justification and an audit trail.
- Trade-offs: requests add friction, so approval rules must be quick enough for real work, and emergency access accounts are still needed for times when the JIT system itself is unavailable.
Just-in-time access vs. related controls
- Least privilege is the principle; JIT is one way to enforce it over time.
- Time-based access control follows a fixed schedule set in advance, such as logon hours of 07:00 to 19:00 or an account expiration date, whether or not anyone asks. JIT grants access on demand for one task.
- Role-based access control decides which permissions a job function gets. JIT decides when an eligible person actually holds them.
- PAM is the broader platform for vaulting, brokering and recording privileged access, and JIT elevation is one of its features.
Just-in-time access on the CompTIA Security+ exam
On SY0-801, just-in-time access is one of the access control models in objective 4.5, and it comes up again in objective 3.2 as part of least-privilege design for administrator accounts. Scenario wording such as "no standing admin rights," "request elevation for a task," "approved for two hours, then removed automatically" or "reduce the risk of compromised privileged accounts" points to JIT. The usual distractor is time-based access control, which applies a schedule rather than responding to a request. Others are role-based access control and permanently adding the administrator to a privileged group. Just-in-time access also appears in A+ Core 2 (220-1202) objective 2.1.