Protocol practice· Privileged Access Management Members
Just-in-time admin: admin rights that exist only while they’re used
Objective: Six people at Harbor hold the Exchange Administrator role permanently, every hour of every day. Make it something they switch on when they need it, for a few hours, with proof it’s them and a reason on record, without locking anyone out.
5 steps12 concepts 12 min
Where just-in-time admin fitsNot sure? Which protocol?
What may this app do? · 6 labs
- OAuth
- Token exchange
- Workload federation
- JWT validation
- Just-in-time adminYou are here
- Conditional Access
What you’ll do
- 1From standing access to eligible. In Privileged Identity Management, a role can be assigned two ways.
- 2How long an activation lasts, and what it records. When someone activates the role, it stays on until it expires.
- 3Make activation ask who it is, every time. A stolen session is the threat.
- 4Someone else says yes, and nobody gets locked out. For Exchange Administrator you want a second person to approve each activation.
- 5Maya activates, then changes device. Maya activates Exchange Administrator on her managed laptop, passes every check, and gets approval.