Secure Administration via Granular & Just-In-Time (JIT) Access

The Principle of Least Privilege

We do not request or hold a blanket Global Administrator role in your Microsoft 365 tenant. Global Admin is the broadest possible permission — it grants unrestricted access to every mailbox, every file in OneDrive, every Teams message, and every configuration setting. Holding it permanently is a significant and unnecessary security risk for your organisation, and we do not operate that way.

Instead, we use Microsoft’s Granular Delegated Admin Privileges (GDAP) framework to request only the specific administrative roles required to perform infrastructure management tasks. Typical roles we operate under include:

GDAP roles are defined in a formal relationship request that your Microsoft 365 global administrator reviews and approves. The scope is transparent and documented from day one.

Just-In-Time (JIT) Activation

Even within the GDAP-granted roles, our technicians have zero active privileges by default. The roles exist in an assigned but inactive state — they cannot be exercised until a technician explicitly requests elevation for a specific task.

Elevation is managed through Microsoft Privileged Identity Management (PIM). When a technician needs to perform an administrative task in your tenant, they must:

1. i.Open a PIM elevation request, specifying the role required and a written justification for the task.
2. ii.Pass multi-factor authentication to confirm their identity at the moment of the request.
3. iii.Receive approval (either automated or via client sign-off — see step 3).
4. iv.Perform the task within the activation window, after which the role automatically de-activates.

Every step of this process is logged in Microsoft Entra ID’s audit log — the technician’s identity, the role requested, the justification provided, and the exact time of activation and expiry. This creates a complete, unalterable record of every access event.

Client-Controlled Approval

PIM can be configured so that your organisation retains direct approval authority over every role elevation request. When this is enabled, no SoftSol technician can activate any administrative role in your tenant until an authorised individual on your side — typically your internal IT lead or operations manager — receives a notification and digitally approves the request.

Key properties of the approval workflow:

• •Approval requests are delivered via email and optionally the Microsoft Authenticator app, ensuring your approver can respond from anywhere.
• •The approver sees the technician’s stated justification before accepting or denying.
• •Access windows are time-limited and configurable — typically 1 to 4 hours — and expire automatically regardless of whether the task is finished.
• •Approval and denial decisions are permanently logged in the Microsoft Entra audit trail.

For organisations where operational tempo makes real-time client approval impractical, the approval workflow can be replaced with automated approval for pre-approved role types, combined with immediate post-activation notification to your management team. In all cases, the full audit record is preserved.