UseCase14_JIT_Elevation - sandersdHES/PAMEmergingTech GitHub Wiki

This use case demonstrates how to use Just-In-Time (JIT) privilege elevation in PAM360 to grant users temporary administrative rights on a Windows or Domain resource. This helps minimize persistent admin privileges and reduces the attack surface.

In traditional environments, users often retain permanent admin access to systems, which increases the risk of privilege misuse or compromise. JIT access solves this by:

Providing elevated access only when needed

Automatically revoking access after a defined time window

Keeping full auditability and approval workflows

This aligns with Zero Trust and least-privilege access best practices.

[https://www.youtube.com/watch?v=4GP7mXXdxyA](Video: Configuring JIT in PAM360) [https://www.manageengine.com/privileged-access-management/just-in-time-privilege-elevation.html](Official Guide)

• Administrator access to PAM360

• A configured Windows Server or Domain resource in PAM360

• An existing Access Control Policy (if using approval workflow)

• A user account to elevate during the session

1. Navigate to the Resources tab

2. Locate your Windows or Domain-joined machine

3. Click the Action icon (⋮) next to the resource

4. Select Configure > Access Control

1. In the Access Control window, go to the Privilege Elevation tab

2. Check the box “Elevate account by adding it to local/security groups”

This tells PAM360 to temporarily add the account to a Windows security group during an approved access session.

A list of local or domain security groups will appear. Select one or more groups such as:

• Administrators

• Remote Desktop Users

• Any custom high-privilege group

These groups define what elevated rights the user will gain during their session.

Select an administrator account that PAM360 will use to:

• Add the requesting user to the selected group(s)

• Remove them automatically after the session ends

The account must have permission to manage group membership on the resource.

This step ensures automation of the elevation process.

1. A user requests access to a shared resource (e.g., a Windows server)

2. If Access Control is enabled, the request goes to the admin for approval

3. Once approved, PAM360:

• Adds the user to the designated privileged group

• Starts a timed session

• Revokes access (removes from group) once the session ends or is checked in

This use case illustrates how PAM360 enables Just-In-Time (JIT) privilege elevation:

• Provides temporary admin access only when needed
• Automatically revokes access after a defined period
• Reduces the attack surface by minimizing persistent privileges
• Maintains full auditability and approval workflows
• Aligns with Zero Trust and least-privilege access best practices