1. Planning.

• Assessment
  Start by identifying who in your team needs access to Tableau, what resources they require, and the purpose. Catalogue existing access rights and reconsider if they could be minimized or removed altogether. Consider using an entitlement discovery tool for improved visibility.
• Policy creation
  Develop clear policies for granting and removing access. Incorporate parameters on who can request for access, under what circumstances, and for what duration. Particularly for privileged roles, time-bound parameters should be created.
• Source of truth
  Synchronize your JIT access system with an Identity Provider (such as Okta, Google Workspace, Azure AD, OneLogin), which acts as the authoritative source for identities. Prioritizing individual identities over shared accounts allows for better authorization control and audit accuracy.

2. Execution.

• Self-serve access requests
  Make the process simpler by having users request access through the system instead of personal request. Improve adoption rates by integrating with IM platforms like Slack or MS Teams and ensure requests clarify who is asking, the required service/resource/role, duration, and reason.

• Approval process
  JIT access provides the chance for organizations to assign approvals to people who understand the business context. More often than not, resource owners and business unit managers have a better understanding than IT helpdesks. Use messaging platforms for quick responses, providing approvers with all critical information for an informed decision.

• Conditional approval workflows
  Integrate your pre-defined policies into workflows guiding the access. Insert them in workflows determining who can access what and under what circumstances. One effective approach is by assigning if-then conditions. IF group “X” requests access to “Y”, approval from “Z” must be sought and “M” must be notified.

• Integrations
  Integrate JIT access with other IT and security systems for greater flexibility, such as IT ticketing systems for automated access based on ticket status, data classification systems to modify policies depending on data sensitivity, on-call schedule software for automatic approvals during emergencies, and training systems to grant access based on training completion.

3. Maintenance.

• Regular audits
  Regularly check access logs to verify JIT access is functioning as expected. Analyze for any unusual patterns either directly or by introducing the logs into your SIEM.
• User training
  Invest in training users about JIT Access, least privilege, and its workings. Ensure they understand how to request access when necessary.
• Feedback loop
  Consistently review your JIT access policies and procedures. Solicit user and staff feedback to identify where enhancements could be made.

By adopting this structured approach, you can efficiently establish and maintain a robust Just-in-Time Access system for Tableau.