Create temporary accounts with JIT provisioning

Just-in-time (JIT) provisioning keeps privileged accounts usable only for the duration of a task or session. The JIT account mode of a PAM account determines what happens to the account at checkout and check-in.

MODE	DESCRIPTION
None	The account stays as-is before and after the session.
Create the account on checkout	A temporary account is created in Active Directory at checkout and automatically deleted at check-in. Available for Domain user PAM accounts only.
Enable account on checkout	An existing account is enabled at checkout and disabled at check-in. Available for Domain user and Entra ID User PAM accounts.

This guide explains how to configure both modes.

Create the account on checkout

Configure JIT account creation

Devolutions Server

1. Go to Administration – Privileged access management (PAM) – Providers.
2. Click the name of your Domain user provider, or click its Edit button.
3. Select JIT privilege elevation and locate the Advanced section.
4. Enter the path in the correct format for your Active Directory (e.g., OU=JITAccounts,DC=example,DC=com) under JIT account creation location.
5. Click Update.

Devolutions Cloud

1. Go to Administration – Privileged access management (PAM) – Providers.
2. Click the name of your Domain user provider, or click its Edit button.
3. Select the JIT privilege elevation tab.
4. Enter the path in the correct format for your Active Directory (e.g., OU=JITAccounts,DC=example,DC=com) under JIT account creation location.
5. Click Update.

Remote Desktop Manager

1. Go to Administration – Privileged access management (PAM).
2. Select the Providers tab.
3. Select your Domain user provider and click Edit.
4. Select JIT privilege elevation and locate the Advanced section.
5. Enter the path in the correct format for your Active Directory (e.g., OU=JITAccounts,DC=example,DC=com) under JIT account creation location.
6. Click Save.

Add a new domain user PAM account

Devolutions Server

1. Go to your PAM vault and click Add (+).
2. Select PAM – Domain user, then click Continue.
3. Fill in Name.
4. Select your Provider.
5. Fill in Username.
6. Under JIT account mode, select Create the account on checkout.
7. Click Add.

Devolutions Cloud

1. Go to your PAM vault and click Add (+).
2. Select Accounts – Domain user, then click Continue.
3. Fill in Name.
4. Select your Provider.
5. Fill in Username.
6. Under JIT account mode, select Create the account on checkout.
7. Click Add.

Remote Desktop Manager

1. In your PAM vault, right-click a folder in the navigation pane and select Add entry.
2. Select Privileged access management (PAM) – Domain user, then click Select.
3. Fill in Name.
4. Select your Provider.
5. In the General tab, fill in Username.
6. Under JIT account mode, select Create the account on checkout.
7. Click Save.

Create the account on checkout is not available for a PAM account that is already linked to an existing directory account.

Understand the JIT process

When you check out the account, the system automatically creates it in Active Directory. It remains active for the duration of the checkout period, and upon check-in, the account is immediately deleted from Active Directory.

Enable account on checkout

This mode keeps an existing account in the directory between checkouts instead of creating and deleting it.

Set the JIT account mode

Add a new Domain user or Entra ID User PAM account as described above, or edit an existing one:

Devolutions Server

1. Right-click the PAM account and select Properties.
2. Go to General.
3. Under JIT account mode, select Enable account on checkout.
4. Click Update.

Devolutions Cloud

1. Open the PAM account and click Edit.
2. Go to General.
3. Under JIT account mode, select Enable account on checkout.
4. Click Update.

Remote Desktop Manager

1. Right-click the PAM account and select Properties.
2. Go to General, then select the General tab.
3. Under JIT account mode, select Enable account on checkout.
4. Click Save.

If you later switch an account from Enable account on checkout to another mode, an account that is currently disabled remains disabled.

Understand the enable and disable process

At checkout, the account is enabled in Active Directory or Entra ID. If JIT privilege elevation groups are granted with the checkout, they are added once the account is enabled. If granting the groups fails, the account is disabled again.

At check-in, the account is disabled and the JIT privilege elevation groups are revoked. The account is always disabled at check-in, even if it was enabled before the checkout.

Heartbeat behavior

For an account in Enable account on checkout mode, the expected state outside a checkout is disabled:

• If the account is disabled, the heartbeat treats it as the expected state.
• If the account is enabled while it is not checked out, the heartbeat fails with The account is still enabled.

For a disabled Domain user account, the heartbeat can only verify the stored password when the provider connects with LDAPS, and fails if the password no longer matches. Otherwise, it only confirms that the account exists in the directory.