alexmoney

Thanks, I updated RDM and Devolutions Server and turned on the policy, all working nice, much appreciated.

Luc, any update on this one at all, it's pretty important from a regulatory compliance perspective

Was any progress made with this one?

An additional benefit here would be able to checkout new JIT privilege groups at the same time, we want to discourage selecting all available perms on checkout to making it more convenient would be beneficial

Sorry for the delay, can confirm it was the above setting, all now working

Hi @alexmoney,

Thank you for reaching out, we'll look into adding this option for you. We should be able to make it available fairly quickly.

Cheers,

@Luc Fauvel

Many thanks, I think it would make SQL management studio use quite slick

Hi again @alexmoney,

Which active directory entry are you referring to specifically? We currently support privileged accounts in the Active Directory dashboard.

Cheers,

@Luc Fauvel

Was that added in a recent edition? As when i select the My Privilege Account option and try to open the dashboard it just says it is not supported.

Currently the addin does not support My Privilege Account or Privilege Account Functionality, limiting our ability to use over multiple disparate domains

Whilst JIT is great it moves the availability of the data that is needed to perform privilege access reviews in to Devolutions Server and this is not easy to surface. The ideal will be to make this data available via API so that our IGA platform can surface who has access to elevate in to which privileged groups, if this was not easily possible, some form of report that surfaces this data that could be extracted and imported in to the IGA would be ideal.

You can currently using the 'My Privilege Account' option only when using the Windows Integrated Elevation, whilst this would be improved by allowing the 'Privilege Account' option. The main issue is you can't currently automatically use a database account to login, thus meaning the password must be made visible during checkout to be manually supplied to the client.

You cannot turn this option on before attempting to onboard servers via an AD discovery scan, so the addition will fail. You have the ability to turn it on only if adding an account manually, makes sense to give it when performing a sub scan.