{"id":15807,"date":"2021-08-24T09:00:00","date_gmt":"2021-08-24T16:00:00","guid":{"rendered":"https:\/\/cm-edgetun.pages.dev\/en-us\/power-platform\/blog\/power-apps\/building-a-jit-app-for-elevated-permissions-on-microsoft-power-platform\/"},"modified":"2025-06-11T07:52:53","modified_gmt":"2025-06-11T14:52:53","slug":"building-a-jit-app-for-elevated-permissions-on-microsoft-power-platform","status":"publish","type":"post","link":"https:\/\/cm-edgetun.pages.dev\/en-us\/power-platform\/blog\/power-apps\/building-a-jit-app-for-elevated-permissions-on-microsoft-power-platform\/","title":{"rendered":"Building a JIT app for elevated permissions on Microsoft Power Platform"},"content":{"rendered":"

The Microsoft Digital Transformation Platform team internally uses Dynamics 365 and Power Platform to manage its business operations. As part of the Success Hub<\/a> implementation, we sometimes need to perform administrative and data maintenance tasks in our production environment. In line with the \u201cprinciple of least privilege,\u201d these role assignments need to be temporary. To handle such situations, we built a Just in Time (JIT) app for assigning Admin roles, using Power Platform.<\/p>\n

Solution Design<\/h1>\n

\"Image<\/p>\n

The team set out to build a lightweight and extensible solution that could be linked to a Dynamics 365 instance.\u00a0 Users can request elevated access on the Dynamics 365 environment using a\u00a0canvas app<\/a>.<\/p>\n

Power Automate orchestrates the business logic to log JIT requests, assign and unassign roles, and notify users of the action taken. The flow is triggered on the submit of the form via the canvas app. The flow also stores the user request outside of Dataverse for auditing purposes; the request is stored in SharePoint because if the request were logged in Dataverse and the requester is granted system admin privileges, they could manipulate the JIT audit data itself.<\/p>\n

The flow then checks whether the user is a member of a predefined Azure group containing users approved for JIT access. The request is approved or denied based on the requester\u2019s membership of this Azure group.<\/p>\n

If the request is approved, the user is notified via email and permissions are provided for 8 hours (configurable). After the designated time, the role is removed, and the user is notified of the removal.<\/p>\n

Another flow runs on a scheduled basis to remove users who gained elevated access without a valid JIT request, for example system admin roles provided to users by temporary JIT system admins.<\/p>\n

Get the unmanaged solution, along with setup instructions.<\/a><\/p>\n

The above solution is a simple approach to handle JIT scenarios. There are multiple ways to extend and enhance this capability. Some of them are:<\/p>\n