> For the complete documentation index, see [llms.txt](https://newdocs.keeper.io/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newdocs.keeper.io/en/keeperpam/privileged-access-manager/just-in-time-access-jit.md).

# Just-In-Time Access (JIT)

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FB5kDk5IAVTfFolQv0SHB%2FJust-in-time%20access.jpg?alt=media&#x26;token=a90e3139-f25c-496d-b9de-8f8fa64bd644" alt=""><figcaption></figcaption></figure>

## Just-In-Time access and zero standing privilege

**Just-In-Time access** grants elevated access only for the time it is needed.

**Zero standing privilege** removes persistent privileged access from users and systems.

KeeperPAM combines approvals, time-bound access, temporary identities, privilege elevation, and automatic deprovisioning across infrastructure and endpoints.

### Why use JIT

Standing privilege increases risk.

If a privileged account is compromised, an attacker can use it immediately.

JIT reduces that risk by making access:

* **Temporary** — Access expires automatically.
* **Approved** — Requests follow a defined workflow.
* **Scoped** — Users get only the access they need.
* **Auditable** — Every request, approval, launch, and cleanup event is recorded.

### How JIT works in KeeperPAM

1. Share a resource (PAM Machine, PAM Database, PAM Cloud) with eligible users.
2. Optionally configure [Workflow](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/workflow.md) for requiring approvals, MFA, schedules, and checkout rules.
3. Choose how privilege is granted for the resource (direct role elevation, IdP group change, etc).
4. Launch the session or application during the approved window.
5. Remove access, delete temporary accounts, or rotate credentials when the window ends.

### JIT access models

KeeperPAM supports 4 different JIT models.

Choose the model based on how access is granted and where privilege is applied.

* **Keeper Privileged Cloud** — Elevate the user through the identity provider. Use this when access is governed by AWS IAM, Azure Entra ID, GCP identity, Okta, Active Directory, or another federated identity layer. This model works across cloud accounts and with PAM Machine or PAM Database records that authenticate through the identity provider.
* **Direct Ephemeral Accounts and Privilege Elevation** — Change privilege directly on the target resource for privileged sessions. Use this when KeeperPAM must create a temporary account on the machine, directory, or database, or temporarily add an account to a local group, directory group, or database role.
* **Time-Limited Access with Automated Credential Rotation** — Grant temporary access to an existing credential for a defined time window. Use this when a user needs expiring access to a shared account and the credential must be rotated automatically when access ends.
* **Elevated Access on Endpoints** — Elevate actions locally on the endpoint through the Keeper Agent with Endpoint Privilege Manager. Use this when users need approved, time-bound elevation for specific applications, processes, or tasks on their own device.

### Pages in this section

Use the pages below together.

Each one covers a different part of the JIT model.

* [Workflow](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/workflow.md) — Control who can request access, who approves it, whether MFA is required, when access is allowed, and whether only one user can hold the resource at a time.
* [Keeper Privileged Cloud](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/keeper-privileged-cloud.md) — Use the identity provider to grant temporary elevation across cloud platforms, federated applications, and PAM Machine or PAM Database resources that authenticate through that identity provider.
* [Direct Ephemeral Accounts and Privilege Elevation](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/ephemeral-accounts-and-privilege-elevation.md) — Create temporary accounts on the target resource, or temporarily add an account to a group or role directly on the machine, directory, or database.
* [Time-Limited Access with Automated Credential Rotation](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/time-limited-access-with-automated-credential-rotation.md) — Grant expiring access to shared credentials and rotate them automatically when access ends.
* [Elevated Access on Endpoints](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/elevated-access-on-endpoints.md) — Apply JIT elevation to user devices and endpoint processes with Keeper Privilege Manager.

### Choose the right JIT model

Start with the model that matches your access pattern.

* Need approvals, schedules, MFA, or check-out rules? Start with [Workflow](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/workflow.md).
* Need elevation through AWS IAM, Azure Entra ID, GCP identity, Okta, Active Directory, or another federated identity provider? Use [Keeper Privileged Cloud](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/keeper-privileged-cloud.md).
* Need session-only accounts or temporary role membership directly on the target machine, directory, or database? Use [Direct Ephemeral Accounts and Privilege Elevation](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/ephemeral-accounts-and-privilege-elevation.md).
* Need temporary access to an existing shared credential? Use [Time-Limited Access with Automated Credential Rotation](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/time-limited-access-with-automated-credential-rotation.md).
* Need process-level elevation on endpoints? Use [Elevated Access on Endpoints](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/elevated-access-on-endpoints.md).

### Recommended rollout

1. Start with [Workflow](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/workflow.md) to define approvals, access windows, and MFA.
2. Choose the privilege model for each resource:
   * Use [Keeper Privileged Cloud](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/keeper-privileged-cloud.md) when elevation should happen through the identity provider.
   * Use [Direct Ephemeral Accounts and Privilege Elevation](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/ephemeral-accounts-and-privilege-elevation.md) when privilege should be created or changed directly on the target resource.
3. Add [Time-Limited Access with Automated Credential Rotation](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/time-limited-access-with-automated-credential-rotation.md) where shared credentials still exist.
4. Extend the same model to user devices with [Elevated Access on Endpoints](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/elevated-access-on-endpoints.md).

### Related capabilities

JIT access often works with other KeeperPAM features:

* [Connections](/en/keeperpam/privileged-access-manager/connections.md) for launching remote sessions from the Vault.
* Remote Browser Isolation for launching web sessions to any cloud resource
* Tunnels for
* [Password Rotation](/en/keeperpam/privileged-access-manager/password-rotation.md) for scheduled or on-demand credential changes.

### JIT integrations for secrets checkout and workflow approvals

Keeper also supports JIT access through direct integrations with communications tools and ITSM platforms.

Use these integrations when users need to request secrets checkout, record access, folder access, one-time shares, or approval-based access from the tools they already use.

* [JIT Integrations](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/jit-integrations.md) — Overview of workflow-driven JIT integrations for secrets and credentials.
* [ServiceNow Workflow](/en/keeperpam/secrets-manager/integrations/jira-workflow.md) — Request and approve access through service workflows and catalog-based processes.
* [Jira Workflow](/en/keeperpam/secrets-manager/integrations/servicenow-workflow.md) — Manage request-based access and approval workflows directly from Jira issues.
* [Slack App](/en/keeperpam/secrets-manager/integrations/slack-app.md) — Handle secrets checkout and approval workflows from Slack.
* [Teams App](/en/keeperpam/secrets-manager/integrations/teams-app.md) — Handle secrets checkout and approval workflows from Microsoft Teams.

### Implementation best practices

1. Start with high-value systems first.
2. Keep approval rules simple at the start.
3. Use temporary identities where possible.
4. Rotate any shared credential after the access window ends.
5. Review audit events and adjust policy over time.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://newdocs.keeper.io/en/keeperpam/privileged-access-manager/just-in-time-access-jit.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.