Hi everyone! 👋 I’ve been digging into BeyondTrust for the last few months at my company, trying to move us away from broad, standing privileges. I’m still pretty new to the privileged access management world, so please bear with me—this is my attempt to document what worked after a lot of trial and error.
Our goal was to create a policy for database access where developers could get temporary, elevated permissions for specific deployments, without having permanent admin rights. The "just-in-time" part felt daunting at first, but breaking it down step-by-step made it manageable.
Here’s the process I followed in the BeyondTrust platform:
First, I defined the scope very narrowly. Instead of a policy for "all production databases," I created a policy tied to a specific resource group and role (like "DB_Deployer"). I used the request workflow builder to set the approval to be automatic, but only if the requester was in the correct Azure AD security group and only during our standard deployment windows (9 AM - 5 PM, weekdays).
Then, I configured the session settings to be the real magic. I set the access to start immediately upon approval, but with a maximum session duration of 2 hours. I also enabled session recording and made sure the credentials were rotated immediately after the session ended. The biggest "aha" moment was linking the policy to a specific change ticket number in our ITSM tool—requiring that in the justification field added a great audit trail.
I’m sure this is just scratching the surface, and I’d love to hear from others. Has anyone set up something similar? How do you handle the balance between security and not slowing the team down too much? Any pitfalls I should watch out for as we roll this out more broadly?
revops in progress
revops in progress