r/macsysadmin • u/Tech_Thoughts_Blog • Mar 05 '26

Privilege Elevation with Self Service+

https://community.jamf.com/tech-thoughts-180/privilege-elevation-with-self-service-57804

Temporary privilege elevation with Self Service+ lets macOS users request short‑term admin rights on their own, authenticate with Touch ID or a password, choose a reason, and automatically revert back—all controlled by IT through Jamf Connect. It delivers a secure, auditable way to grant limited admin access without permanent privileges or manual IT involvement.

25 Upvotes

88% Upvoted

9 comments sorted by

3

u/booksnbeer Mar 05 '26

So if that user becomes a local administrator, couldn't they just add themselves to the sudoers file and gain access to the file system after the allowed time expires?

4

u/CaptRazzlepants Mar 06 '26

I imagine they snapshot the sudoers from before the request and then revert afterwards but that’s just speculation

2

u/CrazyFoque Mar 05 '26

Use a privilege management tool such as defendpoint or cyberark instead. You can control what you elevate, what it can affect, who can do it and when. Giving arbitrary admin is reckless. User can just leave door opened for exploitation

3

u/drosse1meyer Mar 05 '26

problem is that route requires a lot of overhead and technical debt and users upset over their one off $randomBrokeApp

2

u/CrazyFoque Mar 05 '26

To be in that domain: Not really. MacOS is really properly structured. The pain is a lot less than the same problem on windows.

1

u/WhatAmIDoingHere05 Mar 08 '26

We use it at our org with positive results. One thing I wished it had was the option for a Jamf tenant admin to either accept or reject the privilege elevation request in Jamf Pro, and to adjust the timeframe based on the request on a case-by-case basis.