# Just-In-Time Application Access

Last Updated On: 27 Jul 2026  
5 minutes read

Grant time-bound, task-specific application access without permanently expanding your allowlist.

## Prerequisites

Just-in-Time Access is supported on Windows and macOS devices.

## Overview

## What is Just-in-Time Access?

JIT access grants temporary, limited privileges for specific tasks — and automatically revokes them when the window closes.

### Time-bound access on demand

**Just-in-Time (JIT) access** allows administrators to grant temporary, limited privileges to specific devices for specific tasks. Rather than permanently expanding the allowlist or granting continuous administrative rights, access is provided only when needed — and only for the duration required.

JIT policies can target specific applications using a wide range of rule criteria, keeping the scope of each grant as narrow as possible.

![Just-in-Time Access view showing active JIT policies and their status.](https://www.manageengine.com/products/desktop-central/help/images/ac-jit-access.png)

*The Just-in-Time Access view — manage active policies and review their scope.*

### Why JIT access matters

Continuous administrative rights are a persistent security liability. JIT access eliminates that exposure by ensuring endpoints have only the access they need for the duration they need it.

- Minimizes the window of exposure for elevated privileges.
- Reduces the risk of insider threats and lateral movement.
- Supports a least-privilege security posture without blocking legitimate work.
- Every grant is time-limited and auditable.

## Setup

## Creating JIT access policy

JIT policies specify the target device, the duration, and exactly which applications the user can access.

### Policy creation steps

Watch how to create and deploy a JIT access policy:  
https://www.youtube-nocookie.com/embed/uOV0YWrhlgc

1. Navigate to **Just in Time Access** under Deploy Policy.
2. Click **Create** to start a new JIT policy and select **Application Allowlisting**.
3. Enter a name and description for the policy.
4. Specify the **Computer Name** of the device that should receive access.
5. Set the duration type: **Fixed** (a set length of time) or **Window** (a defined time frame within which access is active).
6. In **Access Settings**, choose the scope of access: **All Applications** (any unmanaged app), **Include Blocklisted Applications** (adds blocked apps to scope), or **Specific Applications** (only the applications you explicitly define).
7. If using **Specific Applications**, define the target applications using rule types such as Vendor, Product, Verified Executable, File Hash, Store Apps, or Folder Path.
8. Click **Deploy Immediately**.

![JIT Access Policy Creation form showing name, computer target, and duration settings.](https://www.manageengine.com/products/desktop-central/help/images/ac-jit-access-creation.png)

*JIT Access Policy Creation — define scope, duration type, and target device.*

**Note**

The **Specific Applications** option (scoping JIT access to named apps) is currently supported on Windows only.

![JIT Access rule types for Specific Applications including Vendor, Product, File Hash, and Folder Path.](https://www.manageengine.com/application-control/images/jit-2.png)

*Rule types available when scoping a JIT policy to specific applications.*

## Review

## Reviewing JIT activity

Every access event under a JIT policy is logged and available for audit.

### JIT Events Report

To review events for a specific JIT policy, click the policy name and open the **Audit** tab. The report shows all application access activity that occurred under that policy during its active window.

![JIT Events Report showing a table of application access events per policy.](https://www.manageengine.com/products/desktop-central/help/images/jit-access-3.png)

*JIT Events Report — a per-policy audit log of all activity during the access window.*

## Related

- [Application Control Overview](https://www.manageengine.com/desktop-management-msp/help/application-control/ac-overview.html)
- [Application Control FAQ](https://www.manageengine.com/desktop-management-msp/help/application-control/ac-faq.html)