Just-in-Time Access and Conditional Access Policies

Standing privilege means a user has always-on elevated access, 24/7, whether they need it or not. This is the traditional model for administrator accounts — the admin can access production systems at any moment, even at 3 AM on a Sunday when no legitimate work is happening. Standing privilege dramatically increases the risk surface: compromised admin credentials immediately give attackers elevated access with no additional steps required.

Just-in-Time (JIT) access replaces standing privilege with temporary, on-demand elevation. When an administrator needs privileged access, they request it with a business justification. The request is approved (automatically or by a manager), the privilege is granted for a defined time window (e.g., 1 hour), and then it automatically expires. During the window, all activity is monitored. After expiry, the administrator has no privileged access until they make a new request.

Azure Privileged Identity Management (PIM) is Microsoft's cloud implementation of JIT access. Users are made eligible for privileged roles (e.g., Global Administrator) but do not hold the role continuously. When needed, they activate the role from the Azure portal, provide a justification, may need MFA and approval, and receive the role for a configured duration (maximum 8 hours for most roles). PIM generates audit logs of every activation for compliance reporting.

Conditional Access is an if-then policy engine that evaluates contextual signals before granting access. Instead of a binary allow/deny based on credentials alone, conditional access considers: Who is signing in (user identity and group membership), What they are accessing (application or data), Where they are (IP address, location), When (time of day), How (device compliance status, browser vs native app), and Risk (sign-in risk score from the identity provider).

Conditional access policies evaluate multiple signals simultaneously. Key signals include: Device compliance (is the device managed by MDM and meets baseline security requirements?), Location (is the IP in a trusted named location or a foreign country?), Sign-in risk (has the identity provider's AI flagged this login as anomalous — unusual location, leaked credentials, impossible travel?), and User risk (does this account have indications of compromise from dark web intelligence?).

When a conditional access policy matches, the grant control determines what the user must do. Options include: Block access entirely, Require MFA, Require compliant device, Require approved client app (only managed apps allowed), Require password change (if credentials are at risk), or combinations of these controls. Grant controls allow organizations to step up security requirements based on the risk level of the access being requested.

Beyond grant controls, conditional access can apply session controls that restrict what users can do after they authenticate. Examples include: enforcing sign-in frequency (require re-authentication every hour), restricting download of sensitive files from unmanaged devices, applying Microsoft Defender for Cloud Apps policies for real-time session monitoring, and limiting copy/paste operations on sensitive applications accessed from untrusted locations.

Named locations in conditional access define trusted IP ranges or geographic regions. Access from a named trusted location (e.g., corporate office IP ranges) may be granted with lower friction (no MFA required). Access from outside named locations — especially high-risk countries — triggers additional authentication requirements. Combining named locations with impossible travel detection (a user appears in two distant locations within minutes) blocks credential compromise scenarios.

Risk-based conditional access uses machine learning signals from the identity provider to evaluate sign-in risk in real time. Microsoft Entra ID (formerly Azure AD) assigns a sign-in risk score (Low/Medium/High) based on factors like leaked credentials in dark web databases, anomalous sign-in patterns, and malware-linked IP addresses. A high-risk sign-in can automatically require password reset plus MFA, protecting accounts even before an IT team reviews the alert.

Conditional access policies and JIT access create a risk: if the identity provider itself goes down, administrators may be locked out of the systems they need to restore it. Break glass accounts (emergency access accounts) are highly privileged accounts excluded from conditional access policies, stored with credentials in a physical safe, and used only in true emergencies. Their usage should immediately trigger alerts and post-incident review because any use outside a declared emergency is a red flag.

JIT access and conditional access policies work together as complementary controls. Conditional access controls whether a user can authenticate and what controls they must pass. JIT access controls what privileged role they receive after authentication and for how long. Together, they implement the zero trust principle of never trust, always verify: every access request is evaluated in context, privilege is temporary, and all actions are logged.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: just-in-time access replaces standing privilege with temporary on-demand elevation that auto-expires, conditional access policies evaluate contextual signals (device, location, risk) before granting access, and break glass accounts provide emergency access excluded from normal policies but must be tightly controlled and monitored. Next up we explore the shared responsibility model across IaaS, PaaS, and SaaS.