JIT RBAC — Just-in-Time Role Elevation for Azure

HOW IT WORKS

An admin requests access — role, scope, duration, and a justification — from a Teams command or internal page. An approval card is posted to your Teams channel (the approve and deny links are cryptographically signed so they cannot be forged). On approval, JIT RBAC creates the Azure role assignment at the requested scope. A sweeper runs every five minutes and removes the assignment the moment its time is up. Every request and decision is recorded for audit.

WHO IT IS FOR

Platform and security teams, and any organization with more than a handful of admins that wants time-boxed elevation without buying Entra P2 tenant-wide.

SCOPE

JIT RBAC covers Azure resource roles (subscription, resource group, and resource scopes) cleanly. It does not manage Entra directory roles such as Global Administrator — those require PIM and P2. It is sold precisely as Azure-resource JIT, which is where day-to-day elevation happens.

WHY IT IS SAFE

No vendor backend. It runs on a consumption Function in your subscription with a managed identity you control, and posts only to the Teams webhook you configure.

SETUP

Deploy from the marketplace, paste a Teams webhook, and grant the managed identity User Access Administrator at the scopes it should manage.