Just-in-Time Access: How JIT Cuts Standing Admin Privilege

Short answer: Just-in-time access is a privileged access model that grants elevated permissions only when a user needs them for a specific task, for a limited time, and then removes them automatically. Instead of admins holding permanent rights, they request elevation, pass checks such as MFA, justification or approval, and lose the rights when the window expires.

How just-in-time access works

Just-in-time access replaces a permanent admin assignment with an eligibility to become an admin. The user holds a normal account day to day and activates privilege only for the task in front of them. Microsoft Entra PIM describes the difference directly: an eligible assignment gives exactly the same access as a permanent one, and "the only difference is that some people don't need that access all the time" (Microsoft Learn).

A typical just-in-time access flow has five steps:

1. Eligibility: an administrator makes a user eligible for a role, group or resource, with a scope and optional start and end dates.
2. Request: the user asks to activate, picks a duration up to the configured maximum, and gives a reason.
3. Checks: the system enforces MFA, a business justification, and approval from named approvers where the role requires it.
4. Use: the rights are live for the approved window only.
5. Expiry and audit: the rights are removed automatically, and the request, approval and activation stay in the audit history.

Why standing privilege is the problem

Standing privilege means an account holds admin rights around the clock, whether or not anyone is using them. Every one of those accounts is a target 24 hours a day. Microsoft's privileged access guidance states that attackers in control of privileged accounts "can undermine all other security assurances" and ties the rise of human-operated ransomware to privileged access abuse (Microsoft privileged access strategy).

Just-in-time access shrinks that exposure in time rather than in scope. A phished helpdesk account that is only eligible for Global Administrator is worth far less than one that already holds it, because the attacker still has to pass the activation checks. It also lines up with the zero trust model in NIST SP 800-207, which treats authentication and authorization as discrete checks performed before each session rather than trust granted once.

Microsoft is careful to add that a PIM or PAM tool alone "is not sufficient." Just-in-time access reduces the window; it does not protect a compromised admin workstation.

Types of just-in-time access

Just-in-time access shows up in three main forms, and most PAM products cover one or two rather than all three.

Network JIT works differently from identity JIT. Defender for Cloud writes "deny all inbound traffic" rules for the selected ports in network security groups and Azure Firewall, then opens the port for the requesting IP address for the approved period (Microsoft Learn). That feature ships with Defender for Servers Plan 2.

Just-in-time access vs JIT provisioning vs zero standing privilege

Three terms get mixed up in vendor copy and in audit findings. They solve different problems.

Okta defines just-in-time provisioning as a way "to automatically create a user profile when a user first authenticates," through inbound SAML, desktop SSO or AD delegated authentication (Okta help). JIT provisioning grants no extra privilege, so turning it on does nothing for an auditor asking about standing admin rights.

Common misconceptions about just-in-time access

• "Eligible means less access." It does not. Microsoft states there is no difference in access between permanent and eligible assignments once activated. Scope still has to be right-sized separately.
• "Expiry ends the session." Not always. Defender for Cloud documents that established connections are not interrupted when the approved period ends.
• "JIT covers break-glass accounts." It should not. AWS recommends setting up separate emergency access to the console for business continuity, and PIM itself prevents removal of the last active Global Administrator.
• "The license only covers admins." In Entra PIM, eligible users, approvers and access reviewers all need Entra ID P2 or ID Governance licenses. Microsoft's own example of 42 PIM-managed admins, five approvers and six manager reviewers comes to 53 licenses.

Watch out: Microsoft documents that when an Entra ID P2 or ID Governance license expires, eligible assignments are removed and time-bound active assignments become active permanent (Microsoft Learn). Track that renewal date like a certificate expiry.

Just-in-time access in practice

A 150-person company on Microsoft 365 E5. Entra ID P2 comes with Microsoft 365 E5, so PIM is already licensed. Converting the five people who hold Global Administrator to eligible assignments with MFA and approval on activation is the lowest-cost first step, with two cloud-only break-glass accounts left outside PIM.

A team running Azure VMs with RDP exposed for vendors. Defender for Cloud just-in-time VM access keeps the management ports closed by default and opens them per request to a specific source IP. One documented limit: VMs behind Azure Firewall Manager policies are not supported, and Azure Firewall must use classic rules.

A multi-account AWS environment. IAM Identity Center handles permission sets, but AWS lists Apono, CyberArk Secure Cloud Access, Okta Access Requests and Tenable as validated partners for the request, approve and expire workflow. Budget for a third-party tool here.

What to look for in a just-in-time access tool

When you move from concept to product, check these requirements against the systems you actually administer:

• Coverage: which targets it can elevate on: directory roles, cloud accounts, servers, databases, SaaS admin consoles.
• Activation controls: MFA on activation, approval chains, justification, maximum duration per role.
• Expiry behavior: whether active sessions are terminated or only new ones blocked.
• Audit export: request and approval history your auditor or SIEM can consume.
• Access reviews: periodic recertification of who is still eligible.
• Licensing model: who counts as a billable seat, including approvers and reviewers.
• Break-glass design: how emergency access works when the JIT system itself is down.

The privileged access management category hub lists the vendors covered on this site, and the shortlist builder turns these requirements into a checklist you can score vendors against.

Bottom line

If your auditor flagged standing admin rights and you run Microsoft 365 E5 or Entra ID P2, turn on PIM eligibility for your highest-privilege roles first, keep two break-glass accounts outside it, and put the license renewal on the calendar. If your admin work spans servers, databases and several clouds, a native tool will not cover it, and a PAM product with broader just-in-time coverage is the next step. Compare options in the privileged access management category hub.