Do not equate managed-application JIT notifications with manual approval

Source facts

Managed-application JIT can limit when and for how long the publisher accesses the managed resource group. In automatic approval mode, approvers receive notifications but requests are approved automatically. Manual mode also notifies them, but requires one approver to approve the request.

The consumer can enable JIT only during deployment. Selecting No gives the publisher permanent access in this documented workflow, and JIT cannot be enabled later. Microsoft Learn.

Applicability

Review the publisher’s JIT-enabled offering, current licensing and access prerequisites, intended approvers and deployment decision. Keep notification delivery distinct from the approval mode that controls the request.

DSE recommendation

DSE recommends documenting whether the business requirement is time-limited access alone or time-limited access with a human gate. Select and review the corresponding approval mode before deployment. Confirm who will respond when manual approval is required and how urgent maintenance is handled. Do not describe automatic-mode notifications as evidence of independent authorization.

Verification

In an approved test deployment, submit a low-impact publisher access request and observe whether it waits for an approver or is automatically approved. Compare the grant duration and expiration with the configured decision. Verify the intended approvers receive notifications separately. Retain the mode, request and outcome without claiming that receiving an email proves anyone reviewed the request before access began.

Official references

Microsoft Learn: Approve just-in-time access. Source retrieved September 9, 2026.