Just-in-Time Access (JIT) is a privileged access practice that grants elevated permissions only for the short window a user actually needs them, then automatically revokes those permissions when the task is finished or a timer expires. Standing access is replaced with access on request.
The idea directly serves least privilege. Instead of an administrator carrying permanent domain admin rights that an attacker could seize at any time, the account holds no elevated privilege by default. When work requires it, the user requests elevation, an approval or policy check runs, and access is issued for, say, two hours before it disappears. This shrinks the attack surface, because a stolen credential is worthless outside its brief activation window. A detail people overlook is logging: every JIT grant should be recorded with who requested it, why, and for how long, so the audit trail stays intact. Done well, JIT reduces the population of always-on privileged accounts, which are among the most valuable targets in any environment.
Why does Just-in-Time Access matter for the CISSP exam?
Just-in-Time Access falls under Domain 5 (Identity and Access Management), weighted at 13%. Connect it to least privilege, privileged access management, and the account lifecycle. Review Domain 5 Identity and Access Management to see how these controls fit together.