Config Profile: Time-Boxed Admin Rights with Mandatory Justification

Overview

A configuration profile implementing Jamf Connect’s Temporary User Permissions, so standard users can elevate themselves to admin when they genuinely need it — for a fixed 15 minutes, with a written justification, after which the rights expire on their own.

The problem with how admin rights usually work

Most environments end up at one of two bad answers.

Everyone is a local admin, because saying no generates too many tickets. Every workstation is now a machine where any process can install anything, and your endpoint security model is essentially trust.

Nobody is an admin, and IT elevates on request. Better on paper. In practice it means a ticket every time a developer needs to install a tool, IT gets treated as an obstacle, and the pressure to hand out permanent exceptions is constant. Those exceptions never get reviewed, and within a year you’re back at the first answer by accident.

Both fail for the same reason: they treat admin as a permanent property of a person, when what people actually need is admin for the next few minutes, to do a specific thing.

What the profile does

TemporaryUserPromotion  = true
UserPromotionTimer      = true
UserPromotionDuration   = 15
UserPromotionReason     = true
UserPromotionChoices    = [ … ]

Four decisions in five keys.

Self-service elevation — the user promotes themselves. No ticket, no waiting on IT, no reason for anyone to want a permanent exception.

A 15-minute timer — long enough to install something and confirm it worked, short enough that nobody is quietly running as admin all afternoon. The critical property is that expiry is automatic. It doesn’t depend on a cleanup script running, on the user demoting themselves, or on anyone remembering.

A mandatory reason — this is the key that makes the whole thing auditable rather than merely convenient. You cannot elevate without typing why.

Predefined choices — most elevations are one of a handful of routine things, so offering choices keeps the log consistent and skips the friction of composing a sentence.

Why the reason field matters more than it looks

Without it, this profile is a convenience feature: users get admin faster, and you have marginally better hygiene than permanent rights.

With it, every elevation on every machine produces a record of who elevated, when, and what for. That turns admin rights from a permission you audit once a year by exporting a group membership into a stream of events you can actually review. It answers a different and much better question — not “who has admin” but “what is admin actually being used for.”

That log is what the paired extension attribute reads, so the justifications land in Jamf inventory alongside everything else.

Outcome

Users stop needing IT for routine installs. Nobody holds standing admin rights. Every elevation carries a timestamp and a stated purpose, and expiry is enforced by the OS rather than by anybody’s diligence.

Lessons Learned

The most useful security controls are the ones that are easier than the insecure alternative. Nobody games a 15-minute self-service elevation, because there’s nothing to gain — it’s faster than filing a ticket and less hassle than arguing for a permanent exception. Controls that make the right path the fast path don’t need enforcement; controls that make it the slow path get routed around no matter how good the policy document is.