Before
IT or security staff likely reviewed the employee’s request and justification, confirmed the requester and device, and manually coordinated approval. They then had to update the device-management configuration, track the approved duration, verify that administrator access was removed, and notify the team when the work was complete.
How it works
- Receive the employee’s request, retrieve the requester’s details, and ask the team to approve or reject the elevation.
- If approved, collect the desired session length, identify the employee’s managed computer, and prepare the temporary-access script and policy.
- Wait through the selected session, check the account until administrator access is removed, and update the team with the completion status.
Workflow details
- Request intake and approval: An employee’s elevated-access request enters through a secure webhook, and the workflow retrieves the requester’s identity and justification before posting an approval prompt to the team channel. A team member must explicitly approve or reject the request.
- Duration selection: After approval, the workflow presents predefined session lengths of 30 minutes, 1 hour, 2 hours, 4 hours, or 8 hours. The selected duration is used to calculate when access should begin and expire.
- Device and policy preparation: The workflow locates the employee’s managed computer using the requester’s email address, retrieves the computer identifiers, updates the temporary-access script with the selected duration, and updates the associated management policy for that device.
- Temporary elevation and monitoring: The device policy is prepared to grant administrator rights, while the workflow waits for the approved period. It then repeatedly checks the local account status until the administrator role has been removed.
- Completion notification: Once the account returns to a standard user state, the original team message is updated and a thread notification confirms that access was revoked, including the relevant timing information.
What changed
Approval, duration selection, device targeting, policy preparation, expiration waiting, status checking, and completion notification now occur in one coordinated workflow. Human involvement is limited to the approval decision and the choice of session length, while the access removal and final handoff happen automatically.
Work removed
Reviewing each request and justification manually, looking up the employee’s managed computer, updating the temporary-access script and device policy, tracking the selected access duration, repeatedly checking whether administrator access was removed, and posting completion notifications.
Expected outcome
Temporary administrator access is limited to an approved duration and followed by an automated revocation check; a conservative planning estimate is 6–8 recurring manual actions avoided per approved request.
