Skip to content

Managing Just-In-Time Duration Policies

When using SailPoint's Just-In-Time service, you can implement Just-In-Time duration policies to define under what conditions global default duration settings are replaced with configured default durations.

Creating a Just-In-Time Duration Policy

Just-In-Time duration policies enable policy-driven automation at the time of activation. When a user requests Just-In-Time activation, the system evaluates policies using identity context and entitlement metadata to apply the configured default durations.

Note

If multiple policies are matched, the minimum value of each duration setting from all matching policies will be applied.

Prerequisite:

  • Know your company's policies and have access to your internal documentation.

To create a Just-In-Time duration policy:

  1. Go to Admin > Policy Center > Administration > Just-In-Time > Duration, then select Create Policy.

  2. On the General Details page, enter the following information about your policy:

    Basic Information

    • Name - Name of the policy.
    • Description - Describe the policy.

    Ownership

    • Owner Type - Select between individual or governance group.
    • Policy Owner - Select the individual or governance group responsible for this policy.

  3. Select Next.

  4. On the Matching Criteria page, configure the criteria for when match handling should be applied, by adding groups and criteria and defining the attributes and their matching conditions.

  5. Select Next.

  6. On the Match Handling page, define the default maximum duration for activations and extensions.

    Note

    Applied policies override the global default duration settings.

    • Maximum Activation Duration - The maximum duration an activation can be initially activated.
    • Default Activation Duration - The duration an activation will be set to when a user selects Activate on the Launchpad.
    • Maximum Extension Duration - The maximum duration an activation can be extended by when a user extends an entitlement on the Launchpad.
    • Default Extension Duration - The duration an activation will be extended by when a user extends an entitlement on the Launchpad by the default duration.

  7. Select Next.

  8. Select Finish.

The new policy appears on the Just-In-Time Duration page. Enable the policy by selecting Actions > Enable.

Managing Just-In-Time Activation Policies

The Just-In-Time Duration page includes a list of all policies by name and includes owner, status, and actions. Find policies by searching by name. Select the Status or Owner dropdown to filter based upon your selection.

Admins have the following options available in the Actions column for each policy:

  • View Details – View a summary of the policy, including owner, match criteria, match handling, and status details.
  • Enable or Disable Policy – Enable or disable the policy.
  • Edit – Edit the policy's general details, match criteria, and match handling. Only disabled policies can be edited.
  • Duplicate – Create a new copy of the policy.
  • Delete – Delete the policy. Only disabled policies can be deleted.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.