Identity Live in production

Temporary Privilege Elevation

Grant time-boxed elevated access to a privileged group with automatic removal at the end of the window, approval-gated and fully audited.

Integrates with

Entra ID

The problem

Standing administrative access is one of the largest avoidable risks in mid-market IT. Privileges granted "just for now" rarely get removed, and they accumulate until a security review finds accounts with rights nobody remembers approving.

What AscendCore does

A requester names the user, the privileged group, and a window (such as 4h) in Slack or Teams. An approver sees exactly who gets what for how long. On approval, AscendCore adds the user to the group and arms an automatic removal: a recurring expiry sweep takes the access away at the first sweep after the window ends, with no follow-up ticket to remember. A removal that cannot complete is escalated loudly in the audit chain for manual revocation, so an expiry can be late or escalated but never silent. A user who already holds standing membership in the group is refused outright, because a timed elevation would convert standing access into a delayed removal. The grant, the expiry, and any expiry that cannot be completed are separate entries in the audit chain, and if the automatic removal cannot be armed the approval card says so explicitly rather than implying it.

Status

Live in production. Runs against real Microsoft Entra ID tenants today from Slack and Teams; a timed grant and its automatic removal by the recurring expiry sweep are both recorded in the audit chain. The window cap and approver routing are configurable per customer.

Runbook source preview

Versioned, deterministic, auditable

Every runbook is defined as a versioned YAML manifest with explicit triggers, steps, and approval policies. The runbook itself is the audit-ready record of what AscendCore can and will do. Chat is just the interface that triggers it.

name: temporary-privilege-elevation
trigger:
  channels: [slack, teams]
  commands: [elevate]
steps:
  - resolve_target_user         # Entra ID
  - resolve_elevation_group     # exact name match
  - admin_approval              # window shown on the card
  - verify_group                # re-checked by id at execute time
  - refuse_standing_members     # existing membership is never converted
  - add_to_group
  - arm_auto_expiry             # the expiry sweep removes it on schedule
approval:
  required: true
  approvers: [it-admins, sec-team]

Ready to deploy

Run temporary privilege elevation from Teams or Slack today

AscendCore deploys in days, not months for Slack + Okta or Teams + Entra stacks. See your first automated resolution the same day.

See plans & pricing Browse all runbooks

More identity runbooks

Live

Access Role Change

Multi-system orchestrated role transitions for promotions, transfers, and contractor-to-FTE conversions. Five seed roles ship out of the box (support tiers, sales SDR/AE, engineering contractor/FTE/intern, HR generalist/manager); each transition produces a single approval card showing the full access diff and executes sequentially across Okta + Entra + Jira + M365 with per-step audit outcomes.

Live

Account Unlock

Automate Microsoft Entra ID and Okta account unlocks from Slack and Teams. Identity verification, approval-gated unlock, failed-login counter reset.

Live

Compromised Account Response

Contain a suspected account compromise in one approval: revoke every active session, invalidate the password, and force MFA re-enrollment, fully audited.