Skip to content

JIT Portal

Setup, onboard cloud providers, and request or manage temporary credentials from the JIT Portal.

Authentication & Login

Users with a SailPoint Entro user on the SailPoint Entro Platform can use the same login method to access JIT and request credentials. Then SailPoint Entro JIT portal uses the same roles which are configured in SailPoint Entro Portal → Settings → User Management.

Logging in

  1. Access the JIR Portal via jit.<eval/app/tenant>.entro.security

  2. If it's your first login, you will be guided through a one-time setup.

Initial Setup

SailPoint Entro API key configuration

Upon your initial login, you must set up the SailPoint Entro API connection. This configuration is required only once for each tenant.

Why This Is Needed

The SailPoint Entro API allows the portal to identify employees, enabling it to populate the Owner field in JIT requests.

Setup Steps

  1. Enter the SailPoint Entro API URL (default: https://api.entro.security)
  2. Provide your SailPoint Entro API key
  3. Click Save

You can update the API key later via Settings → Organization.

Cloud Provider Setup

Before creating requests, connect at least one provider via Settings → Cloud Providers.

GitHub setup

Step 1: Create a GitHub App

  1. GitHub org → Settings → Developer settings → GitHub Apps.
  2. Click New GitHub App.
  3. Set an app name. Example: EntroSec JIT.
  4. Set a homepage URL.
  5. Uncheck Webhook → Active.
  6. Under Permissions, select the repo permissions you want to allow.
  7. Click Create GitHub App.
  8. Copy the App ID.

Step 2: Generate a Private Key

  1. In the app settings, scroll to Private keys.
  2. Click Generate a private key.
  3. A .pem file downloads.

You will paste the PEM contents into the portal.

Step 3: Install the App on Your Organization

  1. In the app sidebar, click Install App.
  2. Click Install next to your organization.
  3. Choose All repositories or select specific ones.
  4. Copy the Installation ID from the URL.

Format:

github.com/organizations/YOUR_ORG/settings/installations/INSTALLATION_ID

Step 4: Enter Credentials in the Portal

  1. Settings → Cloud Providers → Add GitHub.

  2. Enter:

    • Label

    • App ID

    • Installation ID

    • Private key (PEM contents)

  3. Click Test Connection and Create.

JIT request lifecycle

The request process

  1. A user creates a request in the portal or MCP.

  2. Automation policies are evaluated.

    • Auto-decline first.

    • Auto-approve second.

    • Otherwise pending manual review.

  3. Admin reviews pending requests.

  4. On approval, credentials are created and stored in the vault.
  5. Credentials are used until expiry.

  6. On expiry, credentials become invalid.

    Note

    STS role sessions expire automatically. IAM Users and App Registrations should be revoked or deleted.

Available actions on requests

  • Approve: create credentials and store in the vault (admin only).

  • Reject: decline a pending request (admin only).

  • Rotate: generate new credentials.

    • Old versions stay in the vault.

    • Not available for GitHub.

  • Revoke: invalidate credentials before expiry.

    • Not available for GitHub.

  • Delete NHI: delete the cloud identity and credentials.

Credential display

Credentials are displayed one time only at approval time.

  • Azure: client ID, client secret.

  • AWS IAM User: access key ID, secret access key.

  • AWS IAM Role: access key ID, secret access key, session token.

  • GitHub: installation token is stored as a repo secret.

After closing the modal:

  • Azure and AWS credentials are retrievable from the vault only.

  • GitHub tokens cannot be retrieved.

Automation policies

Configure policies in Settings → Automation.

Policy types

Auto-decline (evaluated first)

  • Instantly blocks dangerous conditions.

  • Should include a clear decline message.

Auto-approve (evaluated second)

  • Auto-provisions credentials for safe request patterns.

  • Can enforce max expiry. Example: max 7 days.

Configurable conditions

Azure

  • Allowed / blocked Graph API permissions.

  • Allowed / blocked RBAC roles.

AWS

  • Allowed / blocked IAM permissions.

  • Allowed / blocked managed policies.

GitHub

  • Allowed / blocked permissions.

    • Note: metadata:read is ignored for policy matching.

  • Allowed / blocked repos and orgs.

All providers

  • Cloud config scope.

  • Priority (1–1000).

  • Employee scope (optional).

Wildcard matching is supported with *.

Evaluation order

  1. Auto-decline policies (highest priority first)
  2. Auto-approve policies (highest priority first)
  3. No match → manual review

Dashboard

The dashboard is the main view for JIT requests.

Filtering and search

  • Status filters: pending, approved, rejected, revoked.

  • Provider filters: AWS, Azure, GitHub.

  • Special filters: expiring soon, my requests.

  • Search: token name or description.

What each request shows

  • Token name and description.

  • Provider and NHI type.

  • Status.

  • Owner name and email.

  • Expiry.

  • Vault destination.

  • Available actions.

Tabs

  • All NHIs: all requests in the tenant.

  • My Requests: requests owned by the current user.

Troubleshooting

Request Is Pending

An admin may need to approve the request. Automation policies may not match your request.

Request Rejected

An auto-decline policy may have blocked permissions. Try narrower permissions or shorter expiry.

Credentials Are Missing

Credentials are shown once at approval time, after that, retrieve from the configured vault. GitHub tokens cannot be retrieved