1. Planning.

• Assessment
  Start by identifying who requires access to Salesloft, the information they need, and the reason. Review existing access rights to see if they can be condensed or eliminated. An entitlement discovery tool might provide a more comprehensive view.
• Policy creation
  Formulate clear policies for granting and revoking access. Establish guidelines on who can request access, under what circumstances, and for how long. For privileged roles, it’s crucial to set time-bound parameters.
• Source of Truth
  Align your JIT access system to an Identity Provider such as Okta, Google Workspace, Azure AD, or OneLogin. This will act as the primary source for identities. Prioritizing individual identities over shared accounts promotes superior authorization control and audit precision.

2. Execution.

• ‍Self-serve access requests
  Make the process easier by enabling users to request access through the system, instead of through individuals. Boost adoption rates by integrating with IM platforms such as Slack or MS Teams. Requests should clearly indicate who is asking for access, the necessary service/resource/role, duration, and reason.

• ‍Approval process
  JIT access allows organizations to entrust approvals to individuals who understand the business's context better. Resource owners and business unit managers often have superior understanding than IT helpdesks. Utilize messaging platforms for swift responses and to provide approvers with all the information needed for a well-informed decision.

• ‍Conditional approval workflows
  Incorporate your established policies into workflows that determine access permissions. Placing them into workflows guiding who can access what and under which conditions is highly effective. This can be achieved by implementing if-then conditions: "IF identity group “X” requests access to “Y”, seek approval from “Z” and notify “M"."

• Integrations
  Integrating JIT Access protocols with other IT and security systems can provide more adaptability. Integrate with IT ticketing systems for automated access depending on ticket status. Connect with data classification systems to adjust policies based on data sensitivity. An ability to tag resources and bundle them together can streamline this process. Collaborate with on-call schedule software for automated approvals during emergencies and with training systems to grant access based on training completion.
• Automated provisioning and deprovisioning
  Gain a comprehensive understanding of Salesloft to effectively grant and revoke access automatically within the service. Automated deprovisioning of access is central to JIT Access and the principle of least privilege access (POLP). Manage all permissions in one place, without having to contend with creating or managing a distinct environment for every application in your organization.
• Access methods
  For Salesloft JIT Access, APIs are a viable option due to their flexibility and real-time capabilities. A combination may be required - for instance, employing SAML for authentication, SCIM for user provisioning, and APIs for refined access control decisions.

3. Maintenance.

• Regular audits
  Periodically check access logs to ensure that JIT access is functioning appropriately. Search for any abnormal patterns or behaviors, either directly or by integrating the logs into your SIEM. Automating the user access review process can accelerate evidence gathering and delegate reviewers, ensuring compliance with applicable industry regulations or standards.
• User training
  Educate users, particularly privileged users, about the importance of least privilege and JIT Access and how it operates. Make sure users understand how to request access when needed.
• Feedback loop
  Implement a continuous review of your JIT access procedures. Collect feedback from users and IT staff to understand where improvements can be made.

By adhering to this organized approach, you can efficiently implement a robust Just-in-Time Access system for Salesloft.