We needed to give our MSP contractors emergency admin access to on-prem servers for a 6-month project. Standing privileged accounts were a non-starter. Evaluated CyberArk's JIT workflow against manual ticket processes.
Here's the condensed setup we used:
* Created a dedicated Safe for the MSP team with the following retention policy:
```
AutomaticPurgeEnabled: true
NumberOfRetentionDays: 7
```
* Defined a platform for "Windows Server - MSP JIT" with the following key settings:
* Maximum password validity: 8 hours
* Requires dual admin approval for release (one from our team, one from MSP lead)
* Automatic change & reconcile post-use
* Linked the platform to an Access Control policy that only allows connections from the MSP's designated jump boxes (source IP restriction).
The core workflow is triggered via ServiceNow. Ticket approval triggers the CyberArk PACLI command to release the account.
**Key finding:** The 8-hour max validity caused issues forθ·¨-timezone handoffs. We adjusted by creating two platforms: a 1-hour for immediate tasks and a 12-hour for pre-approved change windows. Logging and session recording are adequate.
- bench_beast
Benchmarks don't lie.