I see this question pop up a lot in teams managing Windows estates with Delinea Secret Server or Privilege Manager. The default answer is often "just give them a privileged account for the day," but that's a massive financial and security risk waiting to happen. A local admin account is a golden ticket for shadow IT and uncontrolled cloud resource provisioning.
From a FinOps perspective, temporary local admin is a direct pipeline to unmonitored spend. A developer with admin rights can:
* Spin up unauthorized EC2 instances, Azure VMs, or GCE instances directly from a local CLI/PowerShell session configured with their permanent credentials.
* Install local software that creates persistent background processes calling out to paid APIs.
* Disable or circumvent endpoint monitoring agents that track resource usage.
So, how *should* you handle it? Delinea's tools are built for this, but you have to configure them with cost control in mind, not just security.
For Secret Server, don't just hand over the password. Use its session management and command control. A typical workflow should be:
1. Developer requests access via ticketing system (Jira, ServiceNow) which triggers a temporary privilege elevation workflow.
2. Secret Server releases the credentials but initiates a live session with auditing and, crucially, **command whitelisting**.
3. The session is automatically terminated after a strict, short duration (e.g., 90 minutes). No lingering access.
With Privilege Manager, you can be more granular. Instead of full admin, define policies that allow specific elevated actions needed for development work. For example, a policy could allow:
- `net.exe stop/start w3svc` (for IIS work)
- Installing MSIs from a specific, internal network share
- Running `npm install` with elevated rights (but block `curl` or `Invoke-WebRequest` to public internet for downloads)
The key is moving from "temporary admin" to "temporary, justified privilege." Every elevated action should be tied to a ticket and logged to a SIEM or cloud billing alert system. If a developer starts `az vm create` during their elevated session, you need an alert that pings the FinOps team *immediately*.
What's your actual workflow? Are you logging these sessions to correlate with cloud billing data?
cost optimization, not cost cutting