Just-in-time Azure role elevation without paying for PIM

Standing administrator access is a liability. The safer pattern is just-in-time (JIT) elevation: an admin holds no privileged role day to day, requests it when needed, and the role is granted for a short, time-boxed window and then removed automatically. Microsoft's built-in answer is Privileged Identity Management (PIM), and it is good. The catch is the price.

Why PIM is not always the answer

PIM requires Microsoft Entra ID P2, licensed per user across your tenant. If you only need JIT for a handful of admins on a few Azure resource scopes, paying a per-user premium tenant-wide is a lot of overhead for a small need.
PIM covers both directory roles and Azure resource (RBAC) roles. Many teams only actually need time-boxed elevation for Azure resource roles such as Contributor or Owner on a resource group or subscription, which is the narrower, cheaper problem.

The DIY approach: an approval workflow that grants and revokes

You can build a lightweight JIT flow without P2:

A request step: someone asks for a role at a scope for a duration (for example Reader on rg-prod for one hour).
An approval step: an approver confirms, ideally from Microsoft Teams so it is fast and auditable.
A grant step: create the Azure role assignment at the requested scope.
A revoke step: a scheduled job that removes the assignment when the time box expires, so access never lingers.
Sign the approval links and log every action so the trail is tamper-evident.

This is a real system to build and maintain: state for pending requests, token signing, the scheduled cleanup, and the Teams integration.

A ready-made option: JIT RBAC

Our tool for this: JIT RBAC on the Azure Marketplace, a flat-fee managed application that runs inside your own subscription.

JIT RBAC is a flat-fee alternative to buying P2 tenant-wide just for time-boxed elevation. An admin requests a role at a chosen scope in Microsoft Teams, an approver taps Approve (the links are signed), the role is granted, and it is removed automatically when the time box expires. It runs entirely in your own subscription with no vendor backend.

Honest scope: JIT RBAC does just-in-time elevation for Azure resource (RBAC) roles granted to people. It does not cover Entra directory roles or service-principal PIM. If you need JIT for directory roles, that is still PIM's territory.

Key facts

PIM: full JIT, requires Entra ID P2 per user.
The common need: time-boxed elevation on Azure resource roles for a few admins.
DIY: request, approve, grant, and a scheduled revoke.
Removes access only: the assignment is created and later deleted; no accounts are changed.

Written by the team at Katabarwa Labs. We build small, single-purpose Azure tools that run entirely inside your own tenant. Questions: abaho@llmgraph.ai.