---
title: Identity Governance Just-in-time access
description: Just-in-time (JIT) access in Identity Governance lets you control how long users keep access to accounts, roles, and entitlements, instead of granting access indefinitely. It closes gaps in the current model by giving end users, approvers, and administrators a consistent way to see when access starts and ends, request changes through governed workflows, and avoid both unexpected loss of access and unnecessary over-provisioning.
component: pingoneaic
page_id: pingoneaic:release-notes:rapid-channel/DOCS-11384/iga-just-in-time-access
canonical_url: https://docs.pingidentity.com/pingoneaic/release-notes/rapid-channel/DOCS-11384/iga-just-in-time-access.html
llms_txt: https://docs.pingidentity.com/pingoneaic/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
section_ids:
  what_this_feature_enables: What this feature enables
  administrator_overview: Administrator overview
  new_request_type_and_workflow: New request type and workflow
  view_jit_access_start_and_end_dates_for_a_users_grants: View JIT access start and end dates for a user's grants
  extend_end_dates: Extend end dates
  end_user_overview: End-user overview
  view_my_jit_access_start_and_end_dates: View my JIT access start and end dates
  specify_a_start_and_end_date_for_a_request: Specify a start and end date for a request
  extend_end_date_for_access: Extend end date for access
---

# Identity Governance Just-in-time access

Just-in-time (JIT) access in Identity Governance lets you control how long users keep access to accounts, roles, and entitlements, instead of granting access indefinitely. It closes gaps in the current model by giving end users, approvers, and administrators a consistent way to see when access starts and ends, request changes through governed workflows, and avoid both unexpected loss of access and unnecessary over-provisioning.

## What this feature enables

With this feature:

* You see access start and end dates for your active grants in the Advanced Identity Cloud end-user UI My Access page, so you always know how long your access will last.

* You can request an extension when you still need the same access by choosing a new end date and submitting it for approval through a dedicated extension workflow.

* Administrators can change start or end dates through governed requests on the UI and using the API. Identity Governance keeps the underlying grants in sync.

* You can configure notifications so users receive reminders as access nears its end date. The reminders follow the same workflow-driven model as other governed changes.

  |   |                                                                                                                                                       |
  | - | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
  |   | JIT access doesn't cover scenarios where approvers modify start and end dates for Add access requests or change end dates for Extend access requests. |

## Administrator overview

JIT access in Identity Governance uses time-bound requests with clear start and end dates for every grant. Administrators can adjust these dates in the UI for extending, shortening, or resuming suspended access and Identity Governance automatically updates the underlying grants. They can also configure reminder timing and templates, and rely on built-in workflows and scheduled jobs to send daily expiration reminders and handle these time-based changes without custom development.

### New request type and workflow

JIT access introduces a new request type, Request to Extend end date for basic grants \[application, entitlement, roles], and a new workflow, Basic Grant End date Extension.

To access the request type:

1. Sign on to the Advanced Identity Cloud admin console.

2. In the Advanced Identity Cloud admin console, go to Governance > Requests.

3. Click Request Types.

4. Scroll to the end of the list to find the new request type, and click it to see its details.

To access the workflow:

1. In the Advanced Identity Cloud admin console, go to Governance > Workflows.

2. Scroll to the end of the list to find the new workflow, Basic Grant End date Extension, and click it to see its details, duplicate it, or export it.

   ![The basic grant end date extension workflow details page.](../../_images/DOCS-11384/jit-access-basic-grant-end-date-extension-workflow.png)

### View JIT access start and end dates for a user's grants

Use this procedure to confirm the active period for a user's JIT access.

1. Sign on to the Advanced Identity Cloud admin console with administrator privileges.

2. In the Advanced Identity Cloud admin console, go to Governance > Requests.

3. Search for a request you want to review.

4. Click the ellipsis ([icon: more_horiz, set=material, size=inline]) for the request and select View details.

5. In the request details, review the Start date and End date fields to see when access begins and when it expires.

   ![The request details page showing the start and end date fields.](../../_images/DOCS-11384/jit-access-admin-requests-details.png)

### Extend end dates

Use this procedure when you need to extend the end date for a user's existing JIT access, for example, if the user still needs the same access but the end date is approaching.

1. Sign on to the Advanced Identity Cloud admin console.

2. In the Advanced Identity Cloud admin console, go to Governance > Requests.

3. Select Suspended on the Status filter to find suspended requests that are waiting for an end date change.

4. Click the ellipsis ([icon: more_horiz, set=material, size=inline]) for the request and select Change Resume Date.

   ![The change resume date option for a suspended request.](../../_images/DOCS-11384/jit-access-change-resume-date.png)

## End-user overview

With JIT access, you request access only for the time you need it. When you submit a request, you see when your access starts and ends, so you always know how long it lasts. From the My Access page, you can review the start and end dates on your grants and request an extension if you still need the same access. As your end date approaches, Identity Governance sends reminder notifications based on your organization's settings, and after someone approves your extension request (if required), Identity Governance updates your grant so that you keep access only as long as you need it.

### View my JIT access start and end dates

Use this procedure to confirm how long your current access lasts:

1. In the Advanced Identity Cloud end-user UI, click My Access.

2. Depending on what you need to review, select one of the following:

   * My Accounts.

   * My Roles.

   * My Entitlements.

3. Review the details and find the Start date and End date fields to see when your access begins and when it expires.

### Specify a start and end date for a request

1. In the Advanced Identity Cloud end-user UI, click My Requests, and then [icon: add, set=material, size=inline] New Request.

2. In the New Request modal, select add access for yourself or someone else. If you select Other Users, select the user from the list. You can select a maximum of 10 users in a single request.

3. Click Next.

4. On the Access Catalog page, select the access you need: Applications, Entitlements, or Roles.

5. For this example, select Entitlements and select the entitlements you need.

6. Review the entitlement, and then click Add to Request.

7. In the right pane, enter the following:

   * Justification: A reason for needing the access.

   * Priority: Select the priority of your request: Low, Medium, or High.

   * Access Start date: When you need the access to begin.

   * Access End date: When you need the access to end.

   * Apply Expiration Date (optional): Click to have the system automatically remove the access on the end date.

     |   |                                                                                                                                   |
     | - | --------------------------------------------------------------------------------------------------------------------------------- |
     |   | If you don't select this option, the governance or role administrator must manually remove the access when you no longer need it. |

8. Click Complete Request. Your request appears on the My Requests page.

   ![The new request page showing the start and end date fields.](../../_images/DOCS-11384/jit-access-enduser-start-end-dates.png)

### Extend end date for access

1. In the Advanced Identity Cloud end-user UI, click My Accounts, My Roles, or My Entitlements.

2. Select the access you want to extend by clicking the ellipsis ([icon: more_horiz, set=material, size=inline]).

3. Select Extend End Date.

4. In the Request Extension modal, enter the following:

   * Date: Enter the new end date extension.

   * Time: Enter the time for the new end date extension.

   * Justification: Enter a reason for the extension.

   * Priority: Change the priority of your request if needed: Low, Medium, or High.

5. Click Submit Request. Your request appears on the My Requests page, where the owner must approve the extension request to update the end date.

   ![The extend end date option for an end user's access.](../../_images/DOCS-11384/jit-access-request-extension-modal.png)