Just in Time Admin Access Provisioning in ServiceNow?

[paulkvanover]

Is anyone familiar with this concept and can explain how it is implemented? I have heard of this being used by some companies, but I am not sure I grasp the concept. I assume you assign Admin roles on the fly, only when a Developer needs it to accomplish a task? Just wondering if others have heard this concept and what it is. Thank you!

[Allen Andreas]

Hi Paul,

That's the basic gist of it. It essentially means they don't normally have that access and you can allow it for a short period of time. Normally, developers and such don't need admin permission in Prod. It may only be needed to potentially investigate something to understand the situation and then the access is no longer needed and then they proceed to Dev to replicate and then work on a fix, for example. Another example is a change request needs certain action and so permission would be given then, just for that scenario, and then retracted.

So commonly called just-in-time or "just enough".

Please mark reply as Helpful/Correct, if applicable. Thanks!

[paulkvanover]

Thank you Allen.  Another question if you don't mind. Do you mean someone manually assigns the Admin role as needed, and then removes it as needed?

[Allen Andreas · Accepted solution]

Hi,

That's a process you can define on your side.

It could be manually done or it could be through a catalog item and approved and then done automatically that way.

Depending on how often this is really needed, that would wager if you need to automate it or not.

Please mark reply as Helpful/Correct, if applicable. Thanks!

[paulkvanover]

Thank you Allen!