# Just-In-Time Privilege Elevation

**Last Updated On**: 21 Jul 2026  
**7 minutes read**

Grant temporary, scoped privilege elevation only when needed — eliminating standing admin rights while keeping operations running smoothly.

## Just-In-Time Access Explained

Two elevation models — admin-configured and user-requested — both time-bound and fully auditable.

### What JIT access does for privilege management

Just-in-Time (JIT) access in Endpoint Central MSP gives administrators a way to provide users with temporary, scoped privileges only when required for specific tasks — eliminating the need for standing administrative rights. JIT access supports two models:

- **Admin-configured policies** — proactively grant access based on predefined criteria for known use cases.
- **Request-based elevation** — users initiate privilege elevation on demand with a justification and a defined time duration.

In both cases, access is tightly controlled, time-bound, and can be scoped to specific applications using criteria such as vendor, file hash, folder path, and more.

![Just-In-Time Access View](https://www.manageengine.com/products/desktop-central/help/images/ac-jit-access.png)

### Why JIT access strengthens security posture

Permanent administrative rights expand the attack surface and increase the risk of both insider threats and unauthorized access. JIT access eliminates this exposure — privileges are granted only when needed, only to the right users, and only for as long as necessary.

The request-based model adds a further layer of accountability: users must provide a justification before access is approved, creating a clear and auditable trail of privilege usage. Together, these capabilities help enforce the principle of least privilege and significantly reduce the likelihood of data breaches.

## Configuring Just-In-Time Access

Create an admin-configured JIT policy with a defined scope and duration.

### Creating a JIT elevation policy

1. Navigate to **Just in Time Access** under **Policies**.
2. Click **Create**, then select **Application Elevation**.
3. Enter a **Name** and **Description** for the policy.
4. Enter the **Computer Name** and select the **User Name** (or choose **All users** to apply to everyone on the device).
5. Select a duration type: **Fixed** (a set duration) or **Window** (a specific time frame during which access is active).

![JIT Access Policy Creation](https://www.manageengine.com/products/desktop-central/help/images/epm-jit-1.png)

6. In **Access Settings**, choose the elevation scope: **All Allowed Application(s)** (any allowlisted app) or **Specific Applications** (only selected apps, defined by Vendor, Products, Verified Executable, File Hash, CLSID, or Folder Path).

![JIT Access Rule Types for Specific Apps](https://www.manageengine.com/products/desktop-central/help/images/epm-jit-access.png)

7. Click **Deploy Immediately**.

**Tip:** Use Specific Applications to scope the JIT policy as narrowly as possible — granting access to only the applications the user needs for the task at hand.

## User-Initiated Elevation Requests

Users can request temporary elevation on demand, without waiting for an admin to pre-configure a JIT policy.

### Submitting and reviewing elevation requests

In addition to admin-configured JIT policies, Endpoint Central MSP supports a request-based model where users initiate elevation on their own. When a user attempts to run an application requiring elevated privileges, they see a prompt to submit a JIT elevation request — specifying a time duration and a justification.

![JIT elevation request prompt shown to the user when attempting to run a privileged application](https://www.manageengine.com/products/desktop-central/help/images/epm-jit-request-prompt.png)

*Elevation request prompt — users specify a duration and reason before submitting.*

**Note:** To enable user-initiated requests, configure the option in the Privileged Application List. Refer to the policy creation page:  
[Refer to the policy creation page](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-policy-creation.html#create)

All pending requests appear in the **Just-In-Time Access** tab for administrator review. Approved access is automatically revoked when the requested time duration expires. Administrators can also manually revoke active access at any time from the console.

![Just-In-Time Elevation Requests view](https://www.manageengine.com/products/desktop-central/help/images/jit-request-view.png)

### Autonomous Approval

For trusted users or low-risk applications, administrators can enable **Autonomous Approval**. When configured, eligible elevation requests are automatically approved without requiring manual admin action — reducing overhead while maintaining governance and auditability. Enable this under **Settings → Autonomous Approval**.

![Just-In-Time Elevation Request Auto-Approval](https://www.manageengine.com/products/desktop-central/help/images/jit-auto-approval.png)

**Tip:** Autonomous Approval works best when paired with a narrow application scope — configure it only for well-understood, low-risk use cases.

### JIT Events Report

Events generated under each JIT policy are accessible by clicking the policy and opening the **Audit** tab. Use this report to verify that elevation occurred as expected and to investigate any anomalous activity.

![JIT Events Report](https://www.manageengine.com/products/desktop-central/help/images/epm-jit-2.png)

## Related

- [Endpoint Privilege Management overview](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-overview.html)
- [Create EPM policy](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-policy-creation.html)
- [EPM policy deployment](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-policy-deployment.html)
- [Remove admin rights](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/remove-admin-rights.html)