> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/pam/knowledge-base/how-to-articles/create-temporary-accounts-with-jit-provisioning.md).

# Create temporary accounts with JIT provisioning

Set the JIT account mode in Devolutions PAM to create temporary Active Directory accounts at checkout or enable existing accounts only while checked out.

Just-in-time (JIT) provisioning keeps privileged accounts usable only for the duration of a task or session. The ***JIT account mode*** of a PAM account determines what happens to the account at checkout and check-in.

<table><thead><tr><th width="250">MODE</th><th>DESCRIPTION</th></tr></thead><tbody><tr><td><strong>None</strong></td><td>The account stays as-is before and after the session.</td></tr><tr><td><strong>Create the account on checkout</strong></td><td>A temporary account is created in Active Directory at checkout and automatically deleted at check-in. Available for <em><strong>Domain user</strong></em> PAM accounts only.</td></tr><tr><td><strong>Enable account on checkout</strong></td><td>An existing account is enabled at checkout and disabled at check-in. Available for <em><strong>Domain user</strong></em> and <em><strong>Entra ID User</strong></em> PAM accounts.</td></tr></tbody></table>

This guide explains how to configure both modes.

## Create the account on checkout

### Configure JIT account creation

{% tabs %}
{% tab title="Devolutions Server" %}

1. Go to ***Administration*** – ***Privileged access management (PAM)*** – ***Providers***.
2. Click the name of your ***Domain user*** provider, or click its ***Edit*** button.
3. Select ***JIT privilege elevation*** and locate the ***Advanced*** section.
4. Enter the path in the correct format for your Active Directory (e.g., `OU=JITAccounts,DC=example,DC=com`) under ***JIT account creation location***.
5. Click ***Update***.
   {% endtab %}

{% tab title="Devolutions Cloud" %}

1. Go to ***Administration*** – ***Privileged access management (PAM)*** – ***Providers***.
2. Click the name of your ***Domain user*** provider, or click its ***Edit*** button.
3. Select the ***JIT privilege elevation*** tab.
4. Enter the path in the correct format for your Active Directory (e.g., `OU=JITAccounts,DC=example,DC=com`) under ***JIT account creation location***.
5. Click ***Update***.
   {% endtab %}

{% tab title="Remote Desktop Manager" %}

1. Go to ***Administration*** – ***Privileged access management (PAM)***.
2. Select the ***Providers*** tab.
3. Select your ***Domain user*** provider and click ***Edit***.
4. Select ***JIT privilege elevation*** and locate the ***Advanced*** section.
5. Enter the path in the correct format for your Active Directory (e.g., `OU=JITAccounts,DC=example,DC=com`) under ***JIT account creation location***.
6. Click ***Save***.
   {% endtab %}
   {% endtabs %}

### Add a new domain user PAM account

{% tabs %}
{% tab title="Devolutions Server" %}

1. Go to your PAM vault and click ***Add*** (**+**).
2. Select ***PAM*** – ***Domain user***, then click ***Continue***.
3. Fill in ***Name***.
4. Select your ***Provider***.
5. Fill in ***Username***.
6. Under ***JIT account mode***, select ***Create the account on checkout***.
7. Click ***Add***.
   {% endtab %}

{% tab title="Devolutions Cloud" %}

1. Go to your PAM vault and click ***Add*** (**+**).
2. Select ***Accounts*** – ***Domain user***, then click ***Continue***.
3. Fill in ***Name***.
4. Select your ***Provider***.
5. Fill in ***Username***.
6. Under ***JIT account mode***, select ***Create the account on checkout***.
7. Click ***Add***.
   {% endtab %}

{% tab title="Remote Desktop Manager" %}

1. In your PAM vault, right-click a folder in the navigation pane and select ***Add entry***.
2. Select ***Privileged access management (PAM)*** – ***Domain user***, then click ***Select***.
3. Fill in ***Name***.
4. Select your ***Provider***.
5. In the ***General*** tab, fill in ***Username***.
6. Under ***JIT account mode***, select ***Create the account on checkout***.
7. Click ***Save***.
   {% endtab %}
   {% endtabs %}

{% hint style="info" %}
***Create the account on checkout*** is not available for a PAM account that is already linked to an existing directory account.
{% endhint %}

### Understand the JIT process

When you check out the account, the system automatically creates it in Active Directory. It remains active for the duration of the checkout period, and upon check-in, the account is immediately deleted from Active Directory.

## Enable account on checkout

This mode keeps an existing account in the directory between checkouts instead of creating and deleting it.

### Set the JIT account mode

Add a new ***Domain user*** or ***Entra ID User*** PAM account as described above, or edit an existing one:

{% tabs %}
{% tab title="Devolutions Server" %}

1. Right-click the PAM account and select ***Properties***.
2. Go to ***General***.
3. Under ***JIT account mode***, select ***Enable account on checkout***.
4. Click ***Update***.
   {% endtab %}

{% tab title="Devolutions Cloud" %}

1. Open the PAM account and click ***Edit***.
2. Go to ***General***.
3. Under ***JIT account mode***, select ***Enable account on checkout***.
4. Click ***Update***.
   {% endtab %}

{% tab title="Remote Desktop Manager" %}

1. Right-click the PAM account and select ***Properties***.
2. Go to ***General***, then select the ***General*** tab.
3. Under ***JIT account mode***, select ***Enable account on checkout***.
4. Click ***Save***.
   {% endtab %}
   {% endtabs %}

{% hint style="warning" %}
If you later switch an account from ***Enable account on checkout*** to another mode, an account that is currently disabled remains disabled.
{% endhint %}

### Understand the enable and disable process

At checkout, the account is enabled in Active Directory or Entra ID. If JIT privilege elevation groups are granted with the checkout, they are added once the account is enabled. If granting the groups fails, the account is disabled again.

At check-in, the account is disabled and the JIT privilege elevation groups are revoked. The account is always disabled at check-in, even if it was enabled before the checkout.

### Heartbeat behavior

For an account in ***Enable account on checkout*** mode, the expected state outside a checkout is disabled:

* If the account is disabled, the heartbeat treats it as the expected state.
* If the account is enabled while it is not checked out, the heartbeat fails with ***The account is still enabled***.

For a disabled ***Domain user*** account, the heartbeat can only verify the stored password when the provider connects with LDAPS, and fails if the password no longer matches. Otherwise, it only confirms that the account exists in the directory.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/pam/knowledge-base/how-to-articles/create-temporary-accounts-with-jit-provisioning.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.