Notifications
Clear all
Topic starter
02/09/2026 1:29 pm
TL;DR: Replacing static, over-permissioned access with temporary elevation for cloud workloads, Azure Just-In-Time access can reduce persistent attack surface and improve auditability, according to Ploy. The real issue is not the feature itself but the governance gap it exposes: access creep, weak review discipline, and assumptions that privilege can stay broad until someone notices.
NHIMG editorial — based on content published by Ploy: Azure Just-In-Time Access: Revolutionizing Security in the Cloud Era
By the numbers:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
Questions worth separating out
Q: How should security teams implement JIT access in multi-cloud environments?
A: Security teams should build JIT into the access workflow itself, not bolt it on after approval.
Q: When does JIT access create more risk than it reduces?
A: JIT creates more risk than it reduces when teams assume expiration alone is enough and skip assurance around the requester.
Q: What breaks when cloud privilege is not time-bound?
A: Standing access keeps the identity available for abuse long after the original task ends.
Practitioner guidance
- Map standing privilege to JIT candidates Identify cloud admin roles, break-glass accounts, and other elevated identities that do not need permanent access.
- Bind temporary access to explicit task scope Require every JIT request to name the resource, reason, approval path, and expiry window.
- Feed JIT events into security monitoring Send request, approval, start, and revocation events into SIEM and access review workflows so temporary privilege can be audited alongside other privileged activity.
What's in the full article
Ploy's full insights piece covers the operational detail this post intentionally leaves for the source:
- Step-by-step Azure portal configuration for JIT policies, approvals, and access windows
- Examples of how JIT access can be applied in healthcare and financial services environments
- Operational guidance for pairing JIT with monitoring, audit logging, and SIEM integration
- A discussion of usability trade-offs and workflow friction when temporary access is rolled out at scale
👉 Read Ploy's insights on Azure Just-In-Time access and cloud privilege control →
Azure JIT access and the governance gap in static privilege models?
Explore further
02/09/2026 1:30 pm
JIT access is really a governance response to privilege persistence, not a standalone cloud feature. The article is strongest where it shows that static access models let permissions drift away from business need. That is the same failure pattern NHIMG sees in NHI programmes when access outlives task scope. The practitioner implication is that temporary access should be governed as a lifecycle state, not as a convenience layer.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to The 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, which is why static privilege models are losing relevance.
A question worth separating out:
Q: How do JIT access and PAM differ in practice?
A: PAM governs elevated access as a control discipline, while JIT is one way to deliver that discipline by issuing privilege only when needed. The difference matters because PAM can include standing privileged paths, but JIT removes persistence from the model. Teams should use PAM to define governance and JIT to reduce exposure.
👉 Read our full editorial: Azure JIT access exposes the limits of static privilege models
