Just-in-time access to roles
Keep your privileged Active Directory groups empty until the moment someone needs them. With Lithnet Access Manager, you can turn any group into a just-in-time role. You decide who can request each role and for how long they can hold it. Your admins request the role when the work calls for it, and Access Manager automatically adds them to the group, and removes them when their time is up. A stolen account no longer automatically comes with the rights those groups carry.
Professional edition from USD 750 a year, including 100 devices, with unlimited rolesIncluded in the free Community edition for up to 100 devices, with three custom roles
Every permanent member of a privileged group is a way in for an attacker
A lot of privileges in Active Directory come from group membership. One group might give its members control of an application, and another might make them admins across a set of servers. When your admins sit in those groups permanently, anyone who takes over one of their accounts gets those rights too.
With Access Manager, your admins join a group only when they have work to do, and only for as long as your rules allow.
Learn more about Lithnet Access ManagerHow it works
- 1You choose a role in the Access Manager web app and say how long you need it.
- 2Access Manager adds you to the Active Directory group behind that role.
- 3When your time is up, Access Manager removes you from the group.
You decide who can hold each role, and for how long
Your authorization rules say who can request each role and the longest they can hold it. You can require a reason with every request, so your audit trail tells you why someone needed the access as well as who had it. And if you allow it, an admin whose work runs long can extend their access before it runs out.
See who held each role, and why
Access Manager records every role request, whether it grants the request or denies it. Each event shows who asked for the role, from which IP address, the reason they gave and when their access ends. Access Manager can send these events to your SIEM, to email, or straight to your Slack or Teams channel.
Access to a role was granted
- Requested access
- Just-in-time role
- Name
- Alex Chen
- User name
- FABRIKAM\alex.chen
- Role
- Payroll app production
- Matched rule
- Payroll release team
- Access expiry
- Today at 2:30 pm
- Reason
- Releasing the payroll update
Frequently asked questions
Which groups can be roles?
Any Active Directory group can be a role. For example, you can make a role out of a group that gives admin rights to an application or to a set of servers. Each role has a name and a description that your admins see when they request it.
How long does access to a role last?
You determine the maximum amount of time a role can be used as part of its authorization rule. A user who is entitled to claim that role can choose how long they need access to the role for, up to the maximum time you specified.
Can people extend their access?
Yes, if you allow it for that role. An admin who still has access can request the role again before it runs out. Access Manager then extends their access, up to the role's maximum time.
Can my admins also get admin rights on a computer for a set time?
Yes. With just-in-time admin access to computers, your admins request admin rights on a computer in the same web app. Access Manager removes those rights when the time is up.
Get started today
Paid editions start at USD 750 a year and include support from Lithnet. Just-in-time access to roles is included in the free Community edition, for up to 100 devices.
The free trial unlocks every feature for 30 days on a free installation.