JIT gets thrown around a lot in PAM conversations, and it's one of those terms that sounds more complicated than it really is. If JIT is confusing to you, here are three things you should know about Just-in-Time access.
Just-in-Time (JIT) access means an account only has its elevated rights for the time that it needs them. A user requests access, gets it for the task at hand, and the privilege is removed automatically when they're done. The rest of the time, there's nothing elevated for an attacker to grab.
Elevated rights exposed 24/7 - a permanent target
Minutes or hours long - only while someone works
Traditional privileged accounts sit there with elevated rights 24/7, whether anyone's using them or not, which creates a permanent target. With JIT, the window where those rights exist shrinks from "always on" down to the few minutes or few hours an approved person is actively working.
Start where it matters most. Put JIT on your highest-risk accounts first (domain admins, global admins, cloud root), get comfortable with the request-and-approve workflow, then expand. Incremental improvements work here just like they do everywhere else in PAM.
Domain admins, global admins, cloud root
Get comfortable with request & approve
Roll JIT out wider once it's proven
If you want help rolling JIT out without disrupting your admins, please reach out; it's one of the highest-impact moves in PAM.