My company is planning to move about 10 company-owned Macs from simpleMDM to Microsoft Intune. I've been asked to design a process for giving developers temporary administrator access when they need it. The current idea is for the user to submit a Jira ticket, after which an administrator assigns a Bash script that adds the user to the local admin group for a specified duration. The script displays when access begins and ends, then removes the user from the admin group when the timer expires. I've also looked at the Privileges app, but it seemed more complicated and less flexible than maintaining our own script. Is this custom-script approach reasonable, and what security or reliability issues should I address?
3 Answers
I would avoid elevating the user’s normal login account if possible. A separate local admin account can be created and rotated, allowing the user to use sudo or enter separate credentials when needed without turning their everyday account into a permanent admin. If you do elevate the normal account, have an independent cleanup script that checks for and removes unexpected admin membership. Microsoft’s Mac management features still have gaps around just-in-time elevation, so durable state and regular reconciliation are more important than whether you use a script or an app.
A purpose-built elevation tool may be worth evaluating if you want less custom maintenance. Tools such as Admin By Request can provide approval workflows and temporary elevation, and some plans support small deployments. However, for only ten Macs, a script can be perfectly workable if it handles reboots, killed processes, clock changes, repeated check-ins, logging, and emergency revocation. The important part is making expiry a recorded policy state rather than trusting a single timer process.
The main weakness is relying on a sleeping process to perform the cleanup. If the Mac reboots, the lid is closed, the process is killed, or the user terminates it, the removal step may never happen and the account could remain an administrator indefinitely. Store the expiry time in a plist or similar state file, then run a reconciliation job through launchd or during regular Intune check-ins. That job should remove admin access whenever the recorded expiry has passed, regardless of what happened to the original process. Also log both the grant and the revoke events so you can prove the access was time-limited.
That makes sense. I was focusing mostly on the timer and user experience, but having a separate account and an independent reconciliation check would make the design much safer.