Table of Contents
Upcoming Security Enhancement
Strengthening Your Microsoft 365 Security: Introducing Just‑in‑Time (JIT) Access & Privileged Account Management
As part of our ongoing commitment to protecting your organization, we are implementing Just-in-Time (JIT) administrative access for Microsoft 365 using a dedicated security platform. This change significantly reduces risk while maintaining the same level of support and responsiveness you expect from us. This is fully included in your existing services and comes at no additional cost to your organization.
We'll explain why we are making this change, what will change, and what you can expect during deployment and day-to-day operations.
Why We Are Implementing JIT Access
The Risk With Standing Admin Access
Traditionally, MSP technicians are assigned persistent (always on) administrative permissions in client Microsoft 365 tenants. While convenient, this approach introduces risk:
• If an admin account is compromised, attackers immediately gain high level access
• Admin credentials are a prime target for phishing and token theft
• Persistent access increases blast radius in the event of a breach
Modern security frameworks (Zero Trust, SOC 2, ISO 27001, Microsoft Secure Score) strongly discourage standing administrative access.
How JIT Improves Security
Just-in-time access ensures:
• No permanent admin permissions exist by default
• Admin rights are only granted when needed
• Access is time-bound and automatically removed
• All access is logged and auditable
This dramatically reduces the likelihood and impact of account compromise.
What Is Changing
Before
• MSP admin accounts had continuous elevated permissions
• Permissions existed even when no work was being performed
After
• Admin access is requested and approved on demand
• Access is granted only for a specific task and time window
• Permissions are automatically revoked when the task is complete
There is no change to your support agreement, response times, or scope of services.
What to Expect During Deployment
Deployment Impact
• No downtime for users
• No changes to end-user login experience
• No changes to your Microsoft 365 configuration
What We Will Do
• Securely integrate JIT access with your Microsoft 365 tenant
• Validate least privilege role assignments
• Test emergency and standard access workflows
• Shift traditional Cortavo Global Administrator account to limited availability and daily password rotation
What You May Notice
• Audit logs showing time limited admin access instead of persistent access
• New user accounts being created in the format “FirstInitialLastName_jit@yourdomain.onmicrosoft.com. Example: PMiles_jit@cortavo.onmicrosoft.com
What to Expect Ongoing
Support Experience
From your perspective, nothing changes:
- You submit tickets the same way
- We respond the same way
- Issues are resolved the same way
The difference is entirely behind the scenes and security‑focused.
Emergency Access
For critical or after‑hours incidents:
- Emergency JIT access is immediately available
- No delays in incident response
- Access remains fully logged and time‑bound
Security & Compliance Benefits for You
This enhancement helps your organization:
-
- Reduce risk of administrative account compromise
- Improve Microsoft Secure Score
- Align with cyber insurance expectations
- Support SOC 2 / ISO 27001 / Zero Trust principles
- Strengthen audit readiness and visibility
- Audit and remediate current administrative access
Frequently Asked Questions
1. Does this limit what my MSP can do?
No. It only limits when elevated access exists, not what we can support.
2. Will this slow down support?
No. Access requests are automated and instantaneous.
3. Is any data being accessed or stored outside Microsoft 365?
No customer data is copied or stored. The system manages permissions only.
4. Is this optional?
This is a security standard we are implementing across all managed clients to ensure consistent protection.
5. Will these user accounts affect our billing?
No, these accounts are unlicensed and are disabled when not in use.
6. Does this come at an additional cost?
No, this is fully included as part of your existing services with Cortavo and does not impact your billing.
Summary
This change is a proactive security improvement designed to:
• Protect your Microsoft 365 environment
• Reduce real world attack risk
• Maintain full MSP support capabilities
If you have any questions or would like to discuss this in more detail, please contact our support team.
Thank you for trusting us with your IT and security.