# Privilege on Demand

Privilege on Demand provides Just-In-Time access, allowing access to be authorized ahead of time, but provisioned only when activated by the user. The access is then removed when the activation period ends, the user deactivates it, or it is revoked.

Access is only provided for the defined duration, and permissions for the user are only active on their account when needed.

[Just-In-Time access policies](#configuring-just-in-time-access-policies) enable policy-driven automation at the time of activation, and configurable [notifications](#configuring-just-in-time-access-notifications) define who is notified during the Just-In-Time access lifecycle.

Just-In-Time Access helps you:

- Enhance security by removing standing privileges.
- Maintain user productivity without adding burden to your DevOps team by allowing users to provision access on their own.

Just-In-Time access is configured based upon entitlement assignment types. When an entitlement is configured as Just-In-Time, users receive the entitlement as [available for activation](#activating-a-just-in-time-access-entitlement) instead of continuous standing access. For more information on configuring Just-In-Time and standing entitlement access, refer to [Setting an Entitlement’s Assignment Type for an Identity](../access/entitlements.md#setting-an-entitlements-assignment-type-for-an-identity).

## Just-In-Time Access Items

Entitlements configured as Just-In-Time can be assigned to a user by an admin or requested from the [Request Center](../requests/index.md#understanding-access-requests) by a user. To allow users to request an entitlement, you will need to configure the [access requests for the entitlement](../requests/config_entitlements.md#marking-entitlements-as-requestable).

After the entitlement has been assigned to the user, the user activates the entitlement from the [Launchpad](#activating-a-just-in-time-access-entitlement). For more information on configuring entitlements for Just-In-Time, refer to [Managing Entitlement Assignments](../access/jit_access_provisioning.md#managing-entitlement-assignments).

When a role or access profile with Just-In-Time entitlements is assigned, the standing entitlements are provisioned, but the Just-In-Time entitlements need to be activated before the access can be provisioned. Just-In-Time Entitlements assigned by a role or access profile do not currently support toggling to or from standing access.

Refer to [Roles and Privilege on Demand](../access/roles.md#roles-and-privilege-on-demand) and [Access Profiles and Privilege on Demand](../access/access-profiles.md#access-profiles-and-privilege-on-demand) for more information.

## Configuring Just-In-Time Access Policies

Just-In-Time [activation policies](../policy_center/jit_activation.md) and [duration policies](../policy_center/jit_duration.md) enable policy-driven automation at the time of activation. When a user requests [Just-In-Time activation](https://documentation.sailpoint.com/saas/user-help/launchpad.html#managing-just-in-time-entitlement-access), the system evaluates policies using identity context and entitlement metadata to allow or deny the request, apply appropriate friction steps, and set the default activation duration and extension duration.

## Configuring Just-In-Time Access Notifications

Configure notifications to choose who is notified during the Just-In-Time access lifecycle, including activation ready, activation extended, activation failed, and activation ending soon. Refer to [Configuring Just-In-Time Notifications](../access/jit_access_provisioning.md#configuring-notifications) for more information.

## Configuring Global Just-In-Time Access Settings

Admins can configure global settings to define default activation durations and set boundaries for how long users can access their Just-In-Time entitlements. For more information on configuring Just-In-Time global settings, refer to [Configuring Global Settings](../access/jit_access_provisioning.md#configuring-global-settings).

## Viewing Just-In-Time Access Activations

Admins can view active activations on the Just-In-Time Monitor page. For more information on viewing activations, refer to [Viewing Activations](../access/jit_access_provisioning.md#viewing-activations).

## Activating a Just-In-Time Access Entitlement

When a Just-In-Time entitlement is assigned to a user, the associated entitlement displays on the user's **Launchpad > Just-In-Time Access** page. To provision access, the user must activate the entitlement from the [Launchpad](https://documentation.sailpoint.com/saas/user-help/launchpad.html#managing-just-in-time-entitlement-access) for a defined duration. Users can view the status of activated entitlements and deactivate or extend active activations.

A [notification email](../common/emails/et_jit_15_reminder.md) is sent to the user when their Just-In-Time access is due to expire in 15 minutes.

Access is automatically deprovisioned when the Just-In-Time activation expires.

Privilege on Demand

Privilege on Demand provides Just-In-Time access, allowing access to be authorized ahead of time, but provisioned only when activated by the user. The access is then removed when the activation period ends, the user deactivates it, or it is revoked.

Access is only provided for the defined duration, and permissions for the user are only active on their account when needed.

Just-In-Time access policies enable policy-driven automation at the time of activation, and configurable notifications define who is notified during the Just-In-Time access lifecycle.

Just-In-Time Access helps you:

Enhance security by removing standing privileges.
Maintain user productivity without adding burden to your DevOps team by allowing users to provision access on their own.

Just-In-Time access is configured based upon entitlement assignment types. When an entitlement is configured as Just-In-Time, users receive the entitlement as available for activation instead of continuous standing access. For more information on configuring Just-In-Time and standing entitlement access, refer to Setting an Entitlement’s Assignment Type for an Identity.

Just-In-Time Access Items

Entitlements configured as Just-In-Time can be assigned to a user by an admin or requested from the Request Center by a user. To allow users to request an entitlement, you will need to configure the access requests for the entitlement.

After the entitlement has been assigned to the user, the user activates the entitlement from the Launchpad. For more information on configuring entitlements for Just-In-Time, refer to Managing Entitlement Assignments.

When a role or access profile with Just-In-Time entitlements is assigned, the standing entitlements are provisioned, but the Just-In-Time entitlements need to be activated before the access can be provisioned. Just-In-Time Entitlements assigned by a role or access profile do not currently support toggling to or from standing access.

Refer to Roles and Privilege on Demand and Access Profiles and Privilege on Demand for more information.

Configuring Just-In-Time Access Policies

Just-In-Time activation policies and duration policies enable policy-driven automation at the time of activation. When a user requests Just-In-Time activation, the system evaluates policies using identity context and entitlement metadata to allow or deny the request, apply appropriate friction steps, and set the default activation duration and extension duration.

Configuring Just-In-Time Access Notifications

Configure notifications to choose who is notified during the Just-In-Time access lifecycle, including activation ready, activation extended, activation failed, and activation ending soon. Refer to Configuring Just-In-Time Notifications for more information.

Configuring Global Just-In-Time Access Settings

Admins can configure global settings to define default activation durations and set boundaries for how long users can access their Just-In-Time entitlements. For more information on configuring Just-In-Time global settings, refer to Configuring Global Settings.

Viewing Just-In-Time Access Activations

Admins can view active activations on the Just-In-Time Monitor page. For more information on viewing activations, refer to Viewing Activations.

Activating a Just-In-Time Access Entitlement

When a Just-In-Time entitlement is assigned to a user, the associated entitlement displays on the user's Launchpad > Just-In-Time Access page. To provision access, the user must activate the entitlement from the Launchpad for a defined duration. Users can view the status of activated entitlements and deactivate or extend active activations.

A notification email is sent to the user when their Just-In-Time access is due to expire in 15 minutes.

Access is automatically deprovisioned when the Just-In-Time activation expires.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.