Skip to content

Configuring Just-In-Time Access

Privilege on Demand Just-In-Time access allows access to be authorized ahead of time, but provisioned only when activated by the user. The access is then removed when the activation period ends, the user deactivates it, or it is revoked. Access is only provided for the defined duration, and permissions for the user are only active on their account when needed.

Just-In-Time activation policies and duration policies enable policy-driven automation at the time of activation and targeted controls on activation duration and extension defaults. When a user requests a Just-In-Time activation, the system evaluates policies using identity context and entitlement metadata to allow or deny the request, and to apply the appropriate friction steps, and default durations.

Configurable notifications define who is notified during the Just-In-Time access lifecycle.

ServiceNow integration enables Just-In-Time access to connect to a ServiceNow instance to validate ticket references provided by users.

Just-In-Time access is configured based upon entitlement assignment types. For more information on configuring Privilege on Demand and Just-In-Time access items, refer to Just-In-Time Access Items.

Managing Entitlement Assignments

Admins can configure or remove Just-In-Time entitlements to enable Just-In-Time provisioning for specific entitlements or to revert them back to standing access.

To configure an entitlement as Just-In-Time:

  1. Go to Admin > System Settings > Just-In-Time.

  2. Select the Entitlements Assignments tab.

  3. Select the Enable Just-In-Time for future assignments toggle.

  4. Select Add Entitlements.

  5. Select the desired entitlements.

    You can search for a specific entitlement based on characters contained in the entitlement name. You can also use the Sort icon to sort entitlements by their name, source, owner, whether it can be requested, and risk.

    Note

    Only entitlements for direct-connect sources can be configured for Just-In-Time access.

  6. Select Add Selected Entitlements to add the entitlements to the list.

  7. Select Save.

Important

  • Listed entitlements will be granted as Just-In-Time access for new assignments processed through the Request Center.
  • Existing assignments for the added entitlement will remain with standing access. Existing standing access assignments can be modified on an individual entitlement's Identity tab.

To revert an entitlement to standing access:

  1. Go to Admin > System Settings > Just-In-Time.

  2. Select the Entitlements Assignments tab.

  3. Locate the entitlements you want to remove.

  4. Remove the entitlements in one of the following ways:

    • Multiple Entitlements - Select multiple checkboxes for multiple entitlements, and then select Remove Selected.
    • Individual Entitlement - Select Remove for an individual entitlement.

  5. Select Save.

The selected entitlements are removed from the list and will be assigned as standing access for new assignments processed through the Request Center.

Note

Existing assignments for the removed entitlement will remain with Just-In-Time access. Existing Just-In-Time access assignments can be modified on an individual entitlement's Identity tab.

Configuring Notifications

Admins can configure notifications to choose who is notified during the Just-In-Time access lifecycle.

Just-In-Time Activation Ready - Recipients are notified when the provisioning process has completed after selecting Activate and any frictions have been completed.

Just-In-Time Activation Extended - Recipients are notified when an activation is extended.

Just-In-Time Activation Failed - Recipients are notified when an activation fails.

Just-In-Time Activation Ending Soon - Recipients are notified when an activation period is due to end in 15 minutes.

To configure Just-In-Time notifications:

  1. Go to Admin > System Settings > Just-In-Time.

  2. Select the Notifications tab.

  3. Select the recipient in the section for the lifecycle status you want them to be notified about.

    • For Just-In-Time Activation Ready, User requesting activation recipient is mandatory and cannot be deselected.
    • For Just-In-Time Activation Ending Soon, User requesting activation is selected by default.

  4. Select Save.

The selected recipients are notified when the lifecycle status occurs.

Configuring Global Settings

Admins can configure global settings to define default activation durations and set boundaries for how long users can access their Just-In-Time entitlements.

Maximum Activation Duration - The maximum duration an activation can be initially activated for. This duration can be extended.

Default Activation Duration - The duration an activation will be set to when a user selects Activate on the Launchpad.

Maximum Extension Duration - The maximum duration an activation can be extended by when a user extends an entitlement on the Launchpad.

Default Extension Duration - The duration an activation will be extended by when a user extends an entitlement on the Launchpad by the default duration.

Configuring the Maximum Activation Duration

To configure the maximum activation duration:

  1. Go to Admin > System Settings > Just-In-Time.

  2. Select the Activation tab.

  3. Select the Maximum Activation Duration dropdown and select the desired duration.

  4. Select Save.

Future activations will be limited to the selected duration.

Note

Existing activations are unaffected and will maintain their original maximum activation duration.

Configuring the Default Activation Duration

To configure the default activation duration:

  1. Go to Admin > System Settings > Just-In-Time.

  2. Select the Activation tab.

  3. Select the Default Duration dropdown and select the desired duration.

  4. Select Save.

Future activations using the Activate button will be set to the selected duration.

Note

Existing activations are unaffected and will maintain their original duration or extended duration.

Configuring the Maximum Extension Duration

To configure the maximum extension duration:

  1. Go to Admin > System Settings > Just-In-Time.

  2. Select the Activation tab.

  3. Select the Maximum Extension Duration dropdown and select the desired duration.

  4. Select Save.

Future activation extensions will be limited to the selected duration.

Note

Existing extended activations are unaffected and will maintain their original extended duration.

Configuring the Default Extension Duration

To configure the default extension duration:

  1. Go to Admin > System Settings > Just-In-Time.

  2. Select the Activation tab.

  3. Select the Default Extension Duration dropdown and select the desired duration.

  4. Select Save.

Future default activation extensions will be extended by the selected duration.

Note

Existing extended activations are unaffected and will maintain their original extended duration.

Configuring ServiceNow Integration

Admins can configure ServiceNow integration to enable Just-In-Time access to connect to a ServiceNow instance to validate ticket references provided by users. The connection uses a parameter stored in Parameter Storage.

Create the authentication parameter before configuring the integration. For more information, refer to Managing Parameter Storage.

To configure the ServiceNow integration:

  1. Go to Admin > System Settings > Just-In-Time.

  2. Select the ServiceNow Integration tab.

  3. In the Integrations Details section, complete the following:

    • In Integration Type field, select ServiceNow.

    • In the URL field, enter the ServiceNow instance URL.

  4. In the Parameter section, complete the following:

    • Select the Authentication Type dropdown and select the desired authentication type.

    • Select the Parameter Name dropdown and select the parameter stored in Parameter Storage.

  5. (Optional) Select Test Connection to verify the connection to ServiceNow.

  6. Select the Enable Integration toggle to enable the integration.

  7. Select Save.

The ServiceNow integration is enabled for Just-In-Time access.

Monitoring Just-In-Time Access

The Just-In-Time Access monitoring page provides admins visibility into in-progress and previous Just-In-Time activations and policy decisions. Use it to review activations from the last 13 months, inspect policy evaluation events, and export results for compliance reporting.

The monitoring page enables admins to:

  • Review activation events and policy allow or deny decisions.

  • See whether privileged access is in use during a suspected security incident.

  • Review when a privileged entitlement was activated or deactivated for a user.

  • Inspect policy evaluation details of an activation to view details including the number of policies that matched, the frictions applied, and the outcome of each.

Viewing Activations

Historical activations are listed. Activation details listed include:

  • User Name – The user name of the user requesting activation.

  • Entitlement – The entitlement that was requested to be activated.

  • Source – The source the entitlement grants access to.

  • Status – The state of the current activation.

  • Activation Initiation – The date and time the user activated the entitlement.

  • Provisioning Start – The date and time account provisioning started.

  • Provisioning Complete – The date and time account provision completed.

  • Deprovisioning Start – The date and time account deprovisioning started.

  • Deprovisioning Complete – The date and time account deprovision completed.

  • Provisioning Duration – The total duration the entitlement was activate.

  • Policy Friction Outcome – The result of the policy friction, including whether successful, failed, skipped, or cancelled by the user.

You can search activations and apply filters to narrow the results.

Note

To view Just-In-Time activation events older than 13 months use Search.

To view activations:

  1. Go to Admin > Dashboard > Just-In-Time Access.

  2. (Optional) Apply filters to narrow the results.

Viewing Policy Evaluation Details

You can view policy evaluation details of an activation.

  • Summary Details – The number of policy matches, outcomes of all policy frictions, and duration of the activation.

  • Activation Details – The username and account that activated the entitlement, the name of the activated entitlement, activation duration, and activation initiation and end timestamps.

  • Activation Policy Match Details – The policies that governed the activation, and the applied handling. For more information on Activation Policies, refer to Managing Just-In-Time Activation Policies.

  • Duration Policy Match Details - The policies that governed the durations. For more information on Duration Policies, refer to Managing Just-In-Time Duration Policies.

  • Provisioning Details – The timestamps for the start and completion of provisioning, and start and completion of deprovisioning.

To view policy evaluation details for an activation:

  1. Go to Admin > Dashboard > Just-In-Time Access.

  2. Select Actions > View Activation Details on the activation you want to inspect.

Details of the selected activation are displayed.

Exporting Activations

You can export listed results to a CSV file for compliance reporting.

To export activations:

  1. Go to Admin > Dashboard > Just-In-Time Access.

  2. (Optional) Apply filters to narrow the results as desired.

  3. Select Export.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.