Configuring JIT Access for Microsoft Entra ID

Microsoft Entra ID JIT access creates a temporary cloud user in the target tenant, adds it to the configured group, and deletes the user when the selected duration expires. To configure:

1.            Configure a privileged application or service principal for the target tenant.

2.            Grant the directory permissions required to create and delete users and manage the target group's membership, and complete administrator consent where required.

3.            Enable privileged operations in the Entra ID Vault configuration and define the Super Username and required secret, or select a vault-managed super account.

4.            Open the connector's Just In Time properties, enable group assignment, and define the Target Group by its supported name or object ID.

5.            Verify that the connector's JIT creation and revocation operations are enabled.

To generate and verify the account:

1.            Create or edit a Static account with Account Subtype set to Ephemeral Base and select the Entra JIT configuration.

2.            Open the Base account action menu and select Generate Ephemeral Account.

3.            Select the required Duration, enter a Comment, and generate the account.

4.            Verify that the generated account is listed as Dynamic with a unique name and the Entra JIT configuration.

5.            Verify the target group membership, then confirm that the user is removed and deleted after expiration.