---
title: "How to configure a JIT credential"
slug: "pam-credential-how-to-configure-a-jit-credential-in-senhasegura"
updated: 2026-10-14T21:24:07Z
published: 2026-10-14T21:24:07Z
canonical: "docs.senhasegura.io/pam-credential-how-to-configure-a-jit-credential-in-senhasegura"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# How to configure a JIT credential

The Segura® Platform offers the possibility of using Just-In-Time (JIT) credentials. This configuration manages the use time of services, such as when an account is created or activated or needs specific permissions added during a period to perform actions.

Info

Be aware that after this access, the account is deleted, inactivated, or removed.

JIT access configuration is done when you register or edit a credential. If you are registering a credential, access the documentation on [How to configure a credential in Segura®](/v4-2/docs/pam-credential-how-to-set-up-a-credential-in-senhasegura). In case you are editing a credential, follow these steps:

1. On Segura® Platform, in the navigation bar, hover over the **Products menu** and select **PAM Core**.
2. In the side menu, select **Credentials > All credentials**.
3. In the list of credentials, locate the credential you want to edit and in the **Action** column, click on the **Edit** option from the drop-down menu.

Before you register a JIT credential, configure the templates for the JIT type you plan to use: the **privilege grant** and **privilege revocation** templates, or the **credential creation** and **credential removal** templates. You select these templates in the credential, and Segura® uses them when the proxy session starts. For more information, see [Templates](/v4-2/docs/executions-templates).

Info

The user cannot register plugins.

In the **Credential** form, go to the **JIT settings** tab and fill in the following fields:

1. **Just In Time settings:** select **Enabled**.
2. In the **Just in time type** drop-down menu, select the type that matches the credential the privileged session must use:
  1. **Privilege grant:** the session uses the credential configured here. Segura® runs the privilege grant template on this credential before the session starts, and the privilege revocation template when the session ends. No new credential is created. Use this type to activate the credential, elevate its privilege, or add it to a privileged group only for the duration of the session.
  2. **Ephemeral credential:** Segura® creates a new credential with a random username for each session and starts the session with it, instead of the credential configured here. The ephemeral credential is removed when the session ends.
3. In the **JIT execution** field, select where the JIT automation runs: **Domain device** or **Target device**. This field appears only for a domain credential. For what each option does, see [Where the JIT automation runs](/docs/pam-credential-how-to-configure-a-jit-credential-in-senhasegura#where-the-jit-automation-runs).
4. In the **Authentication settings** section, select **Use own credential to connect** to connect with this credential. Otherwise, clear it and select a credential in the **Authentication credential** drop-down menu.
  - With **Privilege grant**, if the template enables a disabled account, use another credential. A disabled account cannot authenticate its own enablement.

Each JIT type has its own section in the form, with a note that describes what the type does. Fill in the section for the type you selected.

In case you selected **Privilege grant**, fill in the following fields:

1. In the **Privilege grant plugin** drop-down menu, select one of the registered plugins.
2. In the **Privilege grant template** drop-down menu, select one of the registered templates.
3. In the **Privilege revocation plugin** drop-down menu, select one of the registered plugins.
4. In the **Privilege revocation template** drop-down menu, select one of the registered templates.

In case you selected **Ephemeral credential**, fill in the following fields:

1. In the **Credential creation plugin** drop-down menu, select one of the registered plugins.
2. In the **Credential creation template** drop-down menu, select one of the registered templates.
3. In the **Credential removal plugin** drop-down menu, select one of the registered plugins.
4. In the **Credential removal template** drop-down menu, select one of the registered templates.

Click the **Continue** button and **Save**.

## Where the JIT automation runs

For a domain credential, Segura® runs the JIT templates on one of two devices. The **JIT execution** field decides which one, for both JIT types:

- **Domain device**: the automation runs on the device linked to the credential. This is the default. Active Directory grants the privilege in the domain and replicates it to the target device.
- **Target device**: the automation runs on the device the session targets.
  - With **Privilege grant**, the privilege grant template runs on that device when the session opens, and the privilege revocation template runs there when the session ends.
  - With **Ephemeral credential**, the credential creation template runs on that device. For example, it grants the ephemeral account membership in the device's local administrators group when the session opens. The credential removal template revokes it when the session ends.

In a domain distributed across regions, replication can take long enough that the privilege does not yet exist on the target device when the session starts. **Target device** grants the privilege where it is used, for the duration of the session, without waiting for replication.

**JIT execution** appears only for a domain credential. A local credential already runs its automation on its own device.

The choice applies to both templates of the selected JIT type. Selecting it changes nothing for credentials you have already configured.

### Requirements for Target device

With **Target device**, Segura® opens a direct WinRM connection to each target device and runs the template there. Every device you target this way must be reachable over WinRM.

Over WinRM HTTP on port 5985, the Windows RM execution template must include `!unsecure`. Confirm that the template you select carries this line before you use it.

Attention

If the template does not include `!unsecure` on port 5985, provisioning fails on an SSL handshake. The operator sees the message **An error occurred while provisioning the credential.** The session does not open, and the matching removal is recorded as canceled.

## Simultaneous sessions with a JIT credential

How many privileged sessions a JIT credential accepts at the same time depends on the JIT type and on where the automation runs:

| JIT type | JIT execution | Simultaneous sessions |
| --- | --- | --- |
| **Privilege grant** | **Domain device** | One session per credential at a time. Enabling the domain account affects every device, so ending one session would revoke the privilege from the others. |
| **Privilege grant** | **Target device** | One session per credential on each device. Sessions with the same credential on different devices can run at the same time. Ending a session revokes the privilege only on its own device. |
| **Ephemeral credential** | Any | Each user can hold one session per credential on the same device. Different users can open sessions at the same time with the same credential and device, each with their own ephemeral credential. |

Two settings outside JIT also limit simultaneous sessions:

- **Allow simultaneous session?**, in the credential policy, on the **Information** tab. When it is set to **No**, Segura® blocks a new session while another one with the credential is active. More information in [Policies](/v4-2/docs/pam-credential-policies).
- **Number of simultaneous user sessions (zero indicates unlimited)**, in **Settings > System parameters > Global**, in the **Remote session** section. It limits the remote sessions of each user. With **Ephemeral credential**, Segura® also applies this number to the JIT sessions of each credential. More information in [System parameters](/v4-2/docs/administration-system-parameters).

For how JIT access is released when a session ends or is abandoned, see [JIT credential models and session lifecycle](/v4-2/docs/pam-credential-jit-models-and-session-lifecycle).

---

Do you still have questions? Reach out to the [Segura® Community](https://community.senhasegura.io/).