# Temporary Admin Access

**Categories:** Security

Grants employees temporary local admin on their company device with configurable approval, then revokes it automatically when the access window ends.

- Verifies the requested device is owned by and assigned to the requester
- Checks whether the employee already holds local admin, and resolves the ticket immediately if so
- Checks IdP group membership (Okta, Entra, Google Workspace, JumpCloud) to determine whether auto-approval applies
- Routes to a configurable approval workflow when auto-approval does not apply and approval is required
- Grants local admin via the connected MDM (JumpCloud or Intune) once approved or auto-approved
- Waits for the configured access window, then automatically revokes local admin
- Posts user-facing and internal audit notes at each stage, and alerts IT if revocation fails

## What Temporary Admin Access does

The Temporary Admin Access agent handles the full lifecycle of a time-limited local administrator grant on a company-owned laptop or desktop. When an employee requests access through the Harmony AI agent, the workflow confirms the device belongs to them, checks their current admin status, evaluates any auto-approve group rules via the connected identity provider, and - where required - routes the request to designated approvers with a three-day response window. Once approved or auto-approved, it grants local admin through JumpCloud or Intune, notifies the employee, waits for the configured access window to expire, then revokes the privilege automatically. If revocation fails, the ticket is reopened and IT is alerted with explicit guidance on whether manual intervention is needed - ensuring no grant is ever left open indefinitely.

## Who Temporary Admin Access is for

**Persona:** IT security and helpdesk teams who need to enforce least-privilege on managed devices without blocking employees from legitimate short-term admin tasks. Security engineers and IT managers who own the organisation's privileged-access policy.

**Pain point:** Without automation, temporary admin requests arrive as ad-hoc tickets or Slack messages. An IT team member must manually verify device ownership, obtain approval, push a policy change through the MDM, and then remember to revoke it - often hours or days later. Revocations are frequently missed, leaving accounts with persistent local admin long after the need has passed. Audit trails are incomplete, approval decisions live in chat threads, and the process scales poorly as headcount grows.

## How Temporary Admin Access works

**Trigger:** The agent is triggered by a ticket-creation event on Harmony Service Desk where the ticket's workflow target is set to `temporary-admin-access`. This ticket is created conversationally through the Harmony AI agent when an employee submits a local admin request. The workflow ships disabled and must be enabled per MDM integration instance before it will run.

1. **List the Requester's Devices** — Fetches all company-owned laptops and desktops assigned to the ticket reporter, returning device details including OS type and MDM identifiers.

2. **Resolve Device & Settings** — Validates that the requested device appears in the requester's own asset list, confirms it is managed by a supported MDM provider (JumpCloud or Intune), and reads the per-integration configuration for access window duration, justification requirements, approval settings, and auto-approve group rules. Requests that cannot be handled automatically are routed to IT with an internal note explaining the reason.

3. **Check Current Admin Status** — Queries the MDM to determine whether the requester already holds local admin on the device. If they do, the ticket is resolved immediately with a confirmation message.

4. **Check Auto-Approve Groups & Approval** — Iterates any configured auto-approve IdP groups across Okta, Microsoft Entra, Google Workspace, and JumpCloud. If no auto-approval applies and approval is required, sends an approval request to the configured approvers - individual employees or IdP groups - with a three-day timeout. A denial closes the ticket; approval proceeds to the grant step.

5. **Grant Local Admin** — Pushes the local admin grant to the device via the connected MDM integration. Notifies the employee with the access window duration and any device-sync guidance, and writes an internal audit note recording the device, provider, justification, and approval status.

6. **Wait, Revoke & Resolve** — Sleeps for the configured access window, then revokes local admin via the MDM (retrying up to five times with one-minute back-off if the device is offline). On success, resolves the ticket and notifies the employee. On failure, reopens the ticket and posts an internal alert indicating whether manual revocation is required.

**Outcome:** The ticket is resolved with a full audit trail covering device identity, MDM provider, justification, approval decision, grant time, and revocation. The employee holds local admin only for the approved window, and no grant can persist beyond it without an explicit IT intervention recorded on the ticket.

## Capabilities

- **Device ownership verification** - Cross-references the requested asset tag against the requester's own company-owned devices before taking any action, preventing grants on devices the employee does not own.
- **Configurable access window** - The admin duration is set per MDM integration instance via the `admin_duration_minutes` field (defaulting to 120 minutes) and is never supplied by the requester.
- **IdP-based auto-approval** - Checks group membership across Okta, Microsoft Entra ID, Google Workspace, and JumpCloud IdP. Requesters in a configured auto-approve group bypass the manual approval step entirely.
- **Configurable approval workflow** - When auto-approval does not apply, routes to named approvers or IdP groups with a three-day window and optional email notification. Supports any-approver or all-approvers strategies.
- **Automatic revocation with retry** - Revokes local admin via the MDM at the end of the access window, retrying up to five times with one-minute back-off to handle offline or sleeping devices.
- **Manual escalation with audit context** - Requests that cannot be handled automatically (unsupported provider, missing device details, disabled integration, and others) are flagged on the ticket with a machine-readable reason code and left open for IT.
- **Failure-safe alerting** - If the workflow errors after a grant has been made, the ticket is reopened and an internal note explicitly flags that manual revocation may be required, including the MDM device ID.

## Main use cases

**Developer software installation** - A developer needs local admin for a short window to install a licensed tool. They request it through the Harmony AI agent, auto-approval fires because they are in the approved-developers IdP group, and access is granted and revoked without any IT involvement.

**Supervised IT-approved access** - A contractor requests temporary admin to perform a configuration change. The request routes to the IT manager for approval, who approves it in Harmony. The agent grants access for the configured window and revokes it automatically when the window closes.

**Offline device handling** - An employee's laptop is asleep when the grant is pushed. The MDM queues the change for next check-in. At the end of the window, the revocation is issued with retry logic, ensuring the privilege is removed as soon as the device reconnects.

## Integrations

```json
{
  "_key": "temporary-admin-access-int-t",
  "_type": "table",
  "rows": [
    {
      "_key": "temporary-admin-access-int-t-r0",
      "_type": "tableRow",
      "cells": [
        "Integration",
        "Role in the agent flow"
      ]
    },
    {
      "_key": "temporary-admin-access-int-t-r1",
      "_type": "tableRow",
      "cells": [
        "Harmony Service Desk",
        "Receives the ticket that triggers the workflow and is updated with user-facing notifications, internal audit notes, and final resolution status"
      ]
    },
    {
      "_key": "temporary-admin-access-int-t-r2",
      "_type": "tableRow",
      "cells": [
        "Your connected MDM (e.g. JumpCloud MDM, Microsoft Intune)",
        "Used to check current local admin status, grant admin access to the device, and revoke it at the end of the access window"
      ]
    },
    {
      "_key": "temporary-admin-access-int-t-r3",
      "_type": "tableRow",
      "cells": [
        "Your connected IdP (e.g. Okta, Microsoft Entra ID, Google Workspace, JumpCloud)",
        "Queried for auto-approve group membership and used to resolve approval group members"
      ]
    }
  ]
}
```

## FAQ

### Which MDM providers are supported for granting and revoking local admin?

The template supports JumpCloud and Microsoft Intune. Requests for devices managed by any other provider are routed to IT with a `unsupported_mdm_provider` reason code.

### How long does the admin window last?

The duration is configured per MDM integration instance using the `admin_duration_minutes` field, which defaults to 120 minutes. The requester cannot change this value.

### Can some employees bypass the approval step?

Yes. You can configure auto-approve groups in the integration settings. The agent checks membership in those groups via the connected IdP (Okta, Microsoft Entra, Google Workspace, or JumpCloud). Members are granted access without going through the approval workflow.

### What happens if the approval request is not answered?

The approval request times out after three days. If the request is not approved within that window, the ticket is closed and the employee is notified that access was not granted.

### What happens if the revocation fails?

The revoke step retries up to five times with a one-minute delay between attempts. If all attempts fail, the workflow's error handler reopens the ticket and posts an internal note explicitly stating that manual revocation may be required, along with the device name and MDM device ID.

## Related agents and features

- [**Account Lockouts & MFA Reset**](/agents/account-lockouts-mfa) - Automates resolution of account lockouts and MFA resets through the same conversational request flow.
- [**IDP Group Assignment**](/agents/idp-group-assignment) - Manages IdP group membership requests, complementing the auto-approve group checks in this agent.
- [**Domain Access Security Approval**](/agents/domain-access-security-approval) - Applies a similar approval-gated workflow to requests for access to sensitive domains and resources.
- **Harmony Service Desk** - The native service desk that receives requests, manages approval interactions, and records the full audit trail for every access grant.