Temporary Admin Access
Grants employees temporary local admin on their company device with configurable approval, then revokes it automatically when the access window ends.
- Verifies the requested device is owned by and assigned to the requester
- Checks whether the employee already holds local admin, and resolves the ticket immediately if so
- Checks IdP group membership (Okta, Entra, Google Workspace, JumpCloud) to determine whether auto-approval applies
- Routes to a configurable approval workflow when auto-approval does not apply and approval is required
- Grants local admin via the connected MDM (JumpCloud or Intune) once approved or auto-approved
- Waits for the configured access window, then automatically revokes local admin
- Posts user-facing and internal audit notes at each stage, and alerts IT if revocation fails
What Temporary Admin Access does
The Temporary Admin Access agent handles the full lifecycle of a time-limited local administrator grant on a company-owned laptop or desktop. When an employee requests access through the Harmony AI agent, the workflow confirms the device belongs to them, checks their current admin status, evaluates any auto-approve group rules via the connected identity provider, and - where required - routes the request to designated approvers with a three-day response window. Once approved or auto-approved, it grants local admin through JumpCloud or Intune, notifies the employee, waits for the configured access window to expire, then revokes the privilege automatically. If revocation fails, the ticket is reopened and IT is alerted with explicit guidance on whether manual intervention is needed - ensuring no grant is ever left open indefinitely.
Who Temporary Admin Access is for
IT security and helpdesk teams who need to enforce least-privilege on managed devices without blocking employees from legitimate short-term admin tasks. Security engineers and IT managers who own the organisation's privileged-access policy.
Without automation, temporary admin requests arrive as ad-hoc tickets or Slack messages. An IT team member must manually verify device ownership, obtain approval, push a policy change through the MDM, and then remember to revoke it - often hours or days later. Revocations are frequently missed, leaving accounts with persistent local admin long after the need has passed. Audit trails are incomplete, approval decisions live in chat threads, and the process scales poorly as headcount grows.
How Temporary Admin Access works
The agent is triggered by a ticket-creation event on Harmony Service Desk where the ticket's workflow target is set to temporary-admin-access. This ticket is created conversationally through the Harmony AI agent when an employee submits a local admin request. The workflow ships disabled and must be enabled per MDM integration instance before it will run.
- List the Requester's Devices
Fetches all company-owned laptops and desktops assigned to the ticket reporter, returning device details including OS type and MDM identifiers.
- Resolve Device & Settings
Validates that the requested device appears in the requester's own asset list, confirms it is managed by a supported MDM provider (JumpCloud or Intune), and reads the per-integration configuration for access window duration, justification requirements, approval settings, and auto-approve group rules. Requests that cannot be handled automatically are routed to IT with an internal note explaining the reason.
- Check Current Admin Status
Queries the MDM to determine whether the requester already holds local admin on the device. If they do, the ticket is resolved immediately with a confirmation message.
- Check Auto-Approve Groups & Approval
Iterates any configured auto-approve IdP groups across Okta, Microsoft Entra, Google Workspace, and JumpCloud. If no auto-approval applies and approval is required, sends an approval request to the configured approvers - individual employees or IdP groups - with a three-day timeout. A denial closes the ticket; approval proceeds to the grant step.
- Grant Local Admin
Pushes the local admin grant to the device via the connected MDM integration. Notifies the employee with the access window duration and any device-sync guidance, and writes an internal audit note recording the device, provider, justification, and approval status.
- Wait, Revoke & Resolve
Sleeps for the configured access window, then revokes local admin via the MDM (retrying up to five times with one-minute back-off if the device is offline). On success, resolves the ticket and notifies the employee. On failure, reopens the ticket and posts an internal alert indicating whether manual revocation is required.
The ticket is resolved with a full audit trail covering device identity, MDM provider, justification, approval decision, grant time, and revocation. The employee holds local admin only for the approved window, and no grant can persist beyond it without an explicit IT intervention recorded on the ticket.
Capabilities
- Device ownership verification - Cross-references the requested asset tag against the requester's own company-owned devices before taking any action, preventing grants on devices the employee does not own.
- Configurable access window - The admin duration is set per MDM integration instance via the
admin_duration_minutesfield (defaulting to 120 minutes) and is never supplied by the requester. - IdP-based auto-approval - Checks group membership across Okta, Microsoft Entra ID, Google Workspace, and JumpCloud IdP. Requesters in a configured auto-approve group bypass the manual approval step entirely.
- Configurable approval workflow - When auto-approval does not apply, routes to named approvers or IdP groups with a three-day window and optional email notification. Supports any-approver or all-approvers strategies.
- Automatic revocation with retry - Revokes local admin via the MDM at the end of the access window, retrying up to five times with one-minute back-off to handle offline or sleeping devices.
- Manual escalation with audit context - Requests that cannot be handled automatically (unsupported provider, missing device details, disabled integration, and others) are flagged on the ticket with a machine-readable reason code and left open for IT.
- Failure-safe alerting - If the workflow errors after a grant has been made, the ticket is reopened and an internal note explicitly flags that manual revocation may be required, including the MDM device ID.
Main use cases
Developer software installation - A developer needs local admin for a short window to install a licensed tool. They request it through the Harmony AI agent, auto-approval fires because they are in the approved-developers IdP group, and access is granted and revoked without any IT involvement.
Supervised IT-approved access - A contractor requests temporary admin to perform a configuration change. The request routes to the IT manager for approval, who approves it in Harmony. The agent grants access for the configured window and revokes it automatically when the window closes.
Offline device handling - An employee's laptop is asleep when the grant is pushed. The MDM queues the change for next check-in. At the end of the window, the revocation is issued with retry logic, ensuring the privilege is removed as soon as the device reconnects.
Integrations
| Integration | Role in the agent flow |
|---|---|
| Harmony Service Desk | Receives the ticket that triggers the workflow and is updated with user-facing notifications, internal audit notes, and final resolution status |
| Your connected MDM (e.g. JumpCloud MDM, Microsoft Intune) | Used to check current local admin status, grant admin access to the device, and revoke it at the end of the access window |
| Your connected IdP (e.g. Okta, Microsoft Entra ID, Google Workspace, JumpCloud) | Queried for auto-approve group membership and used to resolve approval group members |
FAQ
The template supports JumpCloud and Microsoft Intune. Requests for devices managed by any other provider are routed to IT with a unsupported_mdm_provider reason code.
Meet more Agents
