starred/CIPP

Fork 0

mirror of https://github.com/KelvinTegelaar/CIPP.git synced 2026-04-25 16:26:09 +03:00

[GH-ISSUE #4957] [Feature Request]: JIT Admin - support multiple actions at expiration #2338

New issue

Closed

opened 2026-03-02 13:51:31 +03:00 by kerem · 4 comments

kerem commented

2026-03-02 13:51:31 +03:00

Owner

Originally created by @zenturash on GitHub (Nov 17, 2025).
Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/4957

Please confirm:

I have searched existing feature requests (open and closed) and found no duplicates.
**me or my organization is currently an active sponsor of the product at the $99,- level.

Problem Statement

within "JIT Admin" it would be nice if it would support multiple expiration actions.

Usecase: Fx if you have a JIT admin that persists aka is reused sometimes you would like be able to choose the option to both remove roles and disable the user.

Reasoning: This would reduce the role creep over time and minimize the attack surface.

Benefits for MSPs

This would reduce the role creep over time and minimize the attack surface.
Fx if you have a JIT account that also have RBAC permision to azure subs or resources that persists where you only use TAP to sigin and it's disabled after use, if you added entra roles via JIT there is currently no option to both remove the roles assigned and disable the account leading admin role creepy.

Value or Importance

nice-to-have: but to follow least privilege principle it would be nice and giving a more fully featured PAM/JIT solution via CIPP

PowerShell Commands (Optional)

No response

Originally created by @zenturash on GitHub (Nov 17, 2025). Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/4957 ### Please confirm: - [x] **I have searched existing feature requests** (open and closed) and found no duplicates. - [x] **me or my organization is currently an active sponsor of the product at the $99,- level. ### Problem Statement within "JIT Admin" it would be nice if it would support multiple expiration actions. Usecase: Fx if you have a JIT admin that persists aka is reused sometimes you would like be able to choose the option to both remove roles and disable the user. Reasoning: This would reduce the role creep over time and minimize the attack surface. ### Benefits for MSPs This would reduce the role creep over time and minimize the attack surface. Fx if you have a JIT account that also have RBAC permision to azure subs or resources that persists where you only use TAP to sigin and it's disabled after use, if you added entra roles via JIT there is currently no option to both remove the roles assigned and disable the account leading admin role creepy. ### Value or Importance nice-to-have: but to follow least privilege principle it would be nice and giving a more fully featured PAM/JIT solution via CIPP ### PowerShell Commands (Optional) _No response_

kerem

2026-03-02 13:51:31 +03:00

closed this issue
added the
enhancement

no-priority

no-activity

not-assigned
labels

kerem commented

2026-03-02 13:51:32 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Nov 27, 2025):

This issue is stale because it has been open 10 days with no activity. We will close this issue soon. If you want this feature implemented you can contribute it. See: https://docs.cipp.app/dev-documentation/contributing-to-the-code . Please notify the team if you are working on this yourself.

@github-actions[bot] commented on GitHub (Nov 27, 2025): This issue is stale because it has been open 10 days with no activity. We will close this issue soon. If you want this feature implemented you can contribute it. See: https://docs.cipp.app/dev-documentation/contributing-to-the-code . Please notify the team if you are working on this yourself.

kerem commented

2026-03-02 13:51:32 +03:00

Author

Owner

@zenturash commented on GitHub (Nov 27, 2025):

this feature would be lovely to have not only for the org i work at.

@zenturash commented on GitHub (Nov 27, 2025): this feature would be lovely to have not only for the org i work at.

kerem commented

2026-03-02 13:51:32 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Dec 7, 2025):

@github-actions[bot] commented on GitHub (Dec 7, 2025): This issue is stale because it has been open 10 days with no activity. We will close this issue soon. If you want this feature implemented you can contribute it. See: https://docs.cipp.app/dev-documentation/contributing-to-the-code . Please notify the team if you are working on this yourself.

kerem commented

2026-03-02 13:51:32 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Dec 13, 2025):

This issue was closed because it has been stalled for 14 days with no activity.

@github-actions[bot] commented on GitHub (Dec 13, 2025): This issue was closed because it has been stalled for 14 days with no activity.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/CIPP#2338

No description provided.

Rows
Columns