1. Planning.

• Assessment
  ‍Start by identifying users who require access, the Autodesk resources they need, and for what purposes. Document current access rights to see if they could be minimized or eliminated. Consider using an entitlement discovery tool to gain better visibility.
• Policy creation
  Develop explicit policies for both granting and removing access. This should include guidelines about who can seek access, under what circumstances, and for how long. For privileged roles, time-bound parameters should be set.
• Source of truth
  Sync your JIT access system with an Identity Provider like Okta, Google Workspace, Azure AD, or OneLogin. This will be the definitive source for identities. Prioritizing individual identities over shared accounts leads to improved authorization control and audit precision.

2. Execution.

• Self-service access requests
  Ease the process by allowing users to request access via the system rather than through people. To improve adoption rates, consider integrating with IM platforms such as Slack or MS Teams. Requests should specify who is asking for access, the required service/resource/role, duration, and the reason.

• Approval process
  JIT access offers a chance for organizations to assign approvals to those who have a better business context. Resource owners and business unit managers often have better context than IT helpdesks. Use messaging platforms for quick responses, providing approvers with all necessary information for informed decision-making.

• Conditional approval workflows
  Include your defined policies into workflows that specify access permissions. Incorporate them into workflows dictating who can access what, and under what conditions. If-then conditions are an efficient way to manage this - IF group “X” requests access to “Y”, require approval from “Z” and notify “M”.

• Integrations
  Integrate JIT access with other IT and security systems for increased flexibility. This could include IT ticketing systems for automated access based on ticket status, or data classification systems to adjust policies based on data sensitivity. Training systems that grant access upon completion of relevant training are also useful, as is integrating with on-call schedule software for automatic approvals in emergencies.
• Automated provisioning and deprovisioning
  To effectively grant and revoke precise access within Autodesk automatically, a good understanding of its structure and operations is imperative. This is fundamental for JIT access and reinforces the principle of least privilege access (POLP). Ideally, you should manage all permissions in one location instead of creating diverse environments for each application in your organization.

3. Maintenance.

• Regular audits
  Regularly evaluate access logs to ensure JIT access operates as expected. Be on the lookout for any anomalous patterns or behaviors, either directly or through adding the logs into your SIEM.
• Educate users
  Teach users about the significance of least privilege and JIT access and how it works. Make sure users understand how to seek access when necessary.
• Feedback loop
  Regularly review your JIT access procedures and encourage feedback from staff and users to identify areas for improvement. Following this systematic model will ensure the successful implementation of a robust JIT Access for your Autodesk environment.