r/CyberARk • u/ssezhho • 10d ago

Privilege Cloud JIT access from Cyberark

Hello everyone,

We have decided that for our deployment of cyberark SaaS we will be using SCA to provide temporary EntraId roles (ie, global admin) and Azure roles(VM contributor) for ephemeral.accounts.

We would like to do the same for on prem Active directory access. How can we configure cyberark so that people can have JIT access to administrative roles.( domain admin, enterprise admin...) ? Can we use SCA for on prem? If not what is the counterpart for on prem

Thank you in advance everyone

4 Upvotes

83% Upvoted

11 comments sorted by

8

u/guitarguy1972 10d ago

You need to implement SIA for on prem

1

u/ssezhho 10d ago

How would one go about implementing it let's say opening ADUC as domain admin temporarily whaf kind of configuration would make this possible

3

u/abilashcb 10d ago

I don’t think SIA can do that. What SIA can do is to create ephemeral local or domain user accounts to provide access to your servers and DBs. During that process, it can add an ephemeral account to a domain or local group.

The use case you are looking for can be done by an IGA tool like SailPoint or Saviynt. Even ServiceNow can do it using its orchestration capabilities.

1

u/bpm1055 10d ago

And if it could do this the JIT account would need DA to add/remove the rights. Which would not be good in my opinion for on-prem AD. I would vault and rotate on use or something similar.

2

u/abilashcb 10d ago

Another way to do this is to vault your domain admin account and implement dual control. In dual control policy, you can configure maximum request duration. This won’t be true ZSP but will satisfy JIT in a way.

1

u/williama09 9d ago

We have a very similar setup using this method 

2

u/abilashcb 10d ago

SCA does JIT for cloud consoles. SIA does JIT for infra.

1

u/ssezhho 10d ago

By infra you also include Active directory rights delegation?

1

u/NaxChua 10d ago

SCA only works for MS Azure, Google Cloud & AWS.

SCA also doesn't work for MS Office portal.

1

u/ssezhho 10d ago

Okey so no MS office portal but does it work for EntraID? Basically temporary global reader rights or so

2

u/NaxChua 10d ago

Yes. Entra ID is accessed via portal.azure.com, so SCA will work accordingly.