Skip to main content

The elevation console

Grant a host-local elevation — local admin, sudo, or a temporary ephemeral Windows account — through the PAM agent, with a per-host timeline and a revoke control.

Written for whoever runs IT6 min readUpdated

This is a third thing called elevation in this product, and it is worth being precise about which one before you use it. Just-in-time elevation covers JIT access requests (a time-boxed grant to open a session against a vaulted credential) and JIT cloud elevation (unreachable — a design that mints cloud tokens with no caller wired up). Neither of those is what the elevation console does. This one grants a local privilege on a specific enrolled host, through the PAM agent installed on it — the same shape as a local-admin or sudo elevation request in CyberArk EPM.

The screen: /pam/elevation

The screen starts with a host picker, drawn from your enrolled PAM agents — install status is what Enrolling the PAM agent and its Deploy Agent screen already cover, so this picker is not where you install one. Pick a host and you get a timeline table of every elevation grant raised against it, each in one of five states: pending, active, expired, revoked or failed.

Granting an elevation

The Grant dialog takes:

Account
The account the elevation applies to on the target host.
Kind
Local admin, sudo, or an ephemeral Windows account. The third is a temporary managed account the agent creates for the duration of the grant rather than elevating an existing one — the same ephemeral-account mechanism The credential vault and the session launcher badge it for once it exists as a credential.
Duration
How long the grant stays active.
Justification
A reason, recorded with the grant.

Granting is disabled, with an explanation shown in place of the control, when the agent on the selected host is itself revoked — there is no point queuing a grant an agent that is no longer trusted will never act on.

Revoking

A Revoke control on any pending or active grant ends it early, with an optional reason. Revoking does not require the same justification the original grant did — it is the console's own undo, not a second approval step.

What to do next

  1. Confirm the host you need is showing as enrolled before you try to grant anything — an agent that never installed cannot act on a grant, and the picker only lists what has actually enrolled.
  2. Read what an ephemeral Windows account actually is before granting one, since it behaves differently from local admin or sudo.
  3. Read the JIT access-request mechanism if what you actually want is time-boxed access to a credential already in the vault — that is a different control from this one.

Was this article wrong?

If a procedure here does not match what you see, or a limit we described has changed, tell us and we will fix the page. Email us about this article, or see how to get help if you need an answer rather than a correction.

Everything in privileged access