starred/CIPP

Fork 0

mirror of https://github.com/KelvinTegelaar/CIPP.git synced 2026-04-26 08:46:06 +03:00

[GH-ISSUE #5024] [Feature Request]: Easier auditing for JiT Admin usage #2384

New issue

Closed

opened 2026-03-02 13:51:52 +03:00 by kerem · 2 comments

kerem commented

2026-03-02 13:51:52 +03:00

Owner

Originally created by @mruiterhype on GitHub (Nov 28, 2025).
Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/5024

Please confirm:

I have searched existing feature requests (open and closed) and found no duplicates.
**me or my organization is currently an active sponsor of the product at the $99,- level.

Problem Statement

Since we moved away from global admin accounts and started using GDAP for client management, our support technicians rely on JiT (Just-in-Time) admin roles to fill the gaps GDAP leaves. The challenge is auditing these JiT admin assignments.
Right now, we use the logbook to filter and report which JiT admins were created, why (the “Reason” field), for whom, and for how long. This process is time-consuming because our ISO Security Officer has to set up the same filters every time to review last month’s JiT admins.
Alternatively, we can check JiT deletion tasks in the scheduler, but that doesn’t show the reason or timeframe. Plus, a user could delete the task after creation, and we’d never know unless we also check the logbook.

In short: auditing JiT admin usage is manual, repetitive, and prone to gaps.

Suggested Implementation

Add a JiT Admin Report under the Reports section in Identity Management.
Or, add a filter on the JiT Admin page to list JiT admins created in the past 30 days, including:
- Reason
- Timeframe
- Who created it
Bonus: Provide a Get-JitAdmins function so MSPs can automate sending these reports to their security teams.

Benefits for MSPs

Reduces manual work: No more repetitive filtering in the logbook or cross-checking multiple places.
Improves security: Makes it easier to track temporary elevated permissions and ensure compliance.
Adds clarity: A dedicated report or filter would give MSPs a clear overview of JiT admin activity.
Supports automation: If exposed via a function like Get-JitAdmins, MSPs could schedule reports and send them automatically to security officers.

Sponsoring via https://github.com/hypecipp

Value or Importance

This feature is highly valuable for MSPs focused on security and compliance. JiT admin roles are powerful, and auditing their use is critical for ISO and internal security reviews.
Right now, the process is inefficient and error-prone. A dedicated JiT admin report or filter would save significant time, reduce risk, and make audits much smoother. Even if implemented as a simple filter it would add notable value.

PowerShell Commands (Optional)

No response

Originally created by @mruiterhype on GitHub (Nov 28, 2025). Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/5024 ### Please confirm: - [x] **I have searched existing feature requests** (open and closed) and found no duplicates. - [x] **me or my organization is currently an active sponsor of the product at the $99,- level. ### Problem Statement Since we moved away from global admin accounts and started using GDAP for client management, our support technicians rely on JiT (Just-in-Time) admin roles to fill the gaps GDAP leaves. The challenge is auditing these JiT admin assignments. Right now, we use the logbook to filter and report which JiT admins were created, why (the “Reason” field), for whom, and for how long. This process is time-consuming because our ISO Security Officer has to set up the same filters every time to review last month’s JiT admins. Alternatively, we can check JiT deletion tasks in the scheduler, but that doesn’t show the reason or timeframe. Plus, a user could delete the task after creation, and we’d never know unless we also check the logbook. In short: auditing JiT admin usage is manual, repetitive, and prone to gaps. **Suggested Implementation** - Add a JiT Admin Report under the Reports section in Identity Management. - Or, add a filter on the JiT Admin page to list JiT admins created in the past 30 days, including: - Reason - Timeframe - Who created it - Bonus: Provide a Get-JitAdmins function so MSPs can automate sending these reports to their security teams. ### Benefits for MSPs - Reduces manual work: No more repetitive filtering in the logbook or cross-checking multiple places. - Improves security: Makes it easier to track temporary elevated permissions and ensure compliance. - Adds clarity: A dedicated report or filter would give MSPs a clear overview of JiT admin activity. - Supports automation: If exposed via a function like Get-JitAdmins, MSPs could schedule reports and send them automatically to security officers. Sponsoring via https://github.com/hypecipp ### Value or Importance This feature is highly valuable for MSPs focused on security and compliance. JiT admin roles are powerful, and auditing their use is critical for ISO and internal security reviews. Right now, the process is inefficient and error-prone. A dedicated JiT admin report or filter would save significant time, reduce risk, and make audits much smoother. Even if implemented as a simple filter it would add notable value. ### PowerShell Commands (Optional) _No response_

kerem

2026-03-02 13:51:52 +03:00

closed this issue
added the
enhancement

no-priority

no-activity

not-assigned
labels

kerem commented

2026-03-02 13:51:53 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Dec 8, 2025):

This issue is stale because it has been open 10 days with no activity. We will close this issue soon. If you want this feature implemented you can contribute it. See: https://docs.cipp.app/dev-documentation/contributing-to-the-code . Please notify the team if you are working on this yourself.

@github-actions[bot] commented on GitHub (Dec 8, 2025): This issue is stale because it has been open 10 days with no activity. We will close this issue soon. If you want this feature implemented you can contribute it. See: https://docs.cipp.app/dev-documentation/contributing-to-the-code . Please notify the team if you are working on this yourself.

kerem commented

2026-03-02 13:51:53 +03:00

Author

Owner

@KelvinTegelaar commented on GitHub (Dec 13, 2025):

added in dev

@KelvinTegelaar commented on GitHub (Dec 13, 2025): added in dev

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/CIPP#2384

No description provided.

Rows
Columns