Skip to content

Managing Just-In-Time Activation Policies

When using SailPoint's Just-In-Time service, you can implement Just-In-Time activation policies to define under what conditions additional friction steps must be completed by the user to activate an access item.

Creating a Just-In-Time Activation Policy

Just-In-Time activation policies enable policy-driven automation at the time of activation. When a user requests Just-In-Time activation, the system evaluates policies using identity context and entitlement metadata to allow or deny the request and apply the appropriate friction steps.

Note

If multiple policies are matched, the combined friction steps from all matching policies will be applied and require user completion.

Prerequisite:

  • Know your company's policies and have access to your internal documentation.

To create a Just-In-Time activation policy:

  1. Go to Admin > Policy Center > Administration > Just-In-Time > Activation, then select Create Policy.

  2. On the General Details page, enter the following information about your policy:

    Basic Information

    • Name - Name of the policy.
    • Description - Describe the policy.

    Ownership

    • Owner Type - Select between individual or governance group.
    • Policy Owner - Select the individual or governance group responsible for this policy.

  3. Select Next.

  4. On the Matching Criteria page, configure the criteria for when match handling should be applied by adding groups and criteria and defining the attributes and their matching conditions.

  5. Select Next.

  6. On the Match Handling page, define the additional friction steps that must be completed by the user to activate the access object, and whether defined identities can choose to provide the additional information or skip the steps.

    Friction

    • Ask for a reason – The user must provide a business justification for requiring the activation. A minimum of 5 words must be entered.
    • Ask for a ticket reference – The user must enter a ticket reference. If Just-In-Time ServiceNow integration is configured, the user input must be a valid ServiceNow reference in order to proceed.

    Friction Bypass

    • No identities – All identities must complete the additional friction steps defined on the Friction page.
    • All identities – All identities can choose to skip the additional friction steps defined on the Friction page.
    • Specific identities – Only the selected identities can choose to skip the additional steps defined on the Friction page.

    Notes

    • This does not apply to requiring reauthentication.
    • If multiple policies are matched, the most restrictive bypass setting is applied.

    Require Reauthentication

    • Require Reauthentication to Activate – The user will be directed to the SSO reauthentication service and required to reauthenticate.

    Notes

    • If this option is enabled and an identity matches this policy who is not SSO enabled, this friction step will not apply.
    • This step cannot be skipped.

  7. Select Next.

  8. Select Finish.

The new policy appears on the Just-In-Time Activation page. Enable the policy by selecting Actions > Enable.

Managing Just-In-Time Activation Policies

The Just-In-Time Activation page includes a list of all policies by name and includes owner, status, bypass, and actions. Find policies by searching by name. Select the Status, Bypass, or Owner dropdown to filter based upon your selection.

Admins have the following options available in the Actions column for each policy:

  • View Details – View a summary of the policy, including owner, match criteria, match handling, friction bypass, and status details.
  • Enable or Disable Policy – Enable or disable the policy.
  • Edit – Edit the policy's general details, match criteria, and match handling. Only disabled policies can be edited.
  • Duplicate – Create a new copy of the policy.
  • Delete – Delete the policy. Only disabled policies can be deleted.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.