The elevation console
Grant a host-local elevation — local admin, sudo, or a temporary ephemeral Windows account — through the PAM agent, with a per-host timeline and a revoke control.
This is a third thing called elevation in this product, and it is worth being precise about which one before you use it. Just-in-time elevation covers JIT access requests (a time-boxed grant to open a session against a vaulted credential) and JIT cloud elevation (unreachable — a design that mints cloud tokens with no caller wired up). Neither of those is what the elevation console does. This one grants a local privilege on a specific enrolled host, through the PAM agent installed on it — the same shape as a local-admin or sudo elevation request in CyberArk EPM.
The screen: /pam/elevation
The screen starts with a host picker, drawn from your enrolled PAM agents — install status is what Enrolling the PAM agent and its Deploy Agent screen already cover, so this picker is not where you install one. Pick a host and you get a timeline table of every elevation grant raised against it, each in one of five states: pending, active, expired, revoked or failed.
Granting an elevation
The Grant dialog takes:
- Account
- The account the elevation applies to on the target host.
- Kind
- Local admin, sudo, or an ephemeral Windows account. The third is a temporary managed account the agent creates for the duration of the grant rather than elevating an existing one — the same ephemeral-account mechanism The credential vault and the session launcher badge it for once it exists as a credential.
- Duration
- How long the grant stays active.
- Justification
- A reason, recorded with the grant.
Granting is disabled, with an explanation shown in place of the control, when the agent on the selected host is itself revoked — there is no point queuing a grant an agent that is no longer trusted will never act on.
Revoking
A Revoke control on any pending or active grant ends it early, with an optional reason. Revoking does not require the same justification the original grant did — it is the console's own undo, not a second approval step.
What to do next
- Confirm the host you need is showing as enrolled before you try to grant anything — an agent that never installed cannot act on a grant, and the picker only lists what has actually enrolled.
- Read what an ephemeral Windows account actually is before granting one, since it behaves differently from local admin or sudo.
- Read the JIT access-request mechanism if what you actually want is time-boxed access to a credential already in the vault — that is a different control from this one.