Skip to main content

Admin By Request

Audience: Unit administrators and Platform Engineering

Purpose: Guide for managing temporary administrative privileges and configuring role-based access control

ResourceDescription
Admin By Request PortalAdmin portal login
Run as Admin DocsOfficial Run as Admin documentation
ABR DocumentationOfficial Admin By Request documentation
ABR EditionsProduct edition comparison

Overview​

Admin By Request is a security and privilege management solution that allows users to run applications with elevated privileges without receiving full administrative rights. This promotes the principle of least privilege while maintaining productivity.

Key Features​

Run as Admin

Allows end-users to run specific applications with administrative privileges when necessary:

  • Temporary Elevation — Privileges granted for specific tasks without full admin rights
  • Audit Logging — All elevated actions logged for compliance
  • Risk Reduction — Limits malware and unauthorized changes by scoping privileges
Learn More

See the official Run as Admin Overview for detailed documentation.

Privilege Management

Administrators control and manage privilege elevation:

  • Assign custom roles to unit administrators
  • Approve or deny user requests based on policy
  • Review activities for compliance and security
  • Configure approval workflows per unit
Security & Audit Logging

Comprehensive auditing ensures visibility and compliance:

  • Track all privileged actions across the organization
  • Monitor usage patterns and anomalies
  • Export logs for compliance reporting
  • Configure alerts for suspicious activity

Using the Portal​

The Admin By Request portal provides access to inventory management, approval workflows, and audit capabilities.

Inventory​

In the Inventory section, administrators can:

FeatureDescription
Device DetailsView hardware specs, login time, and status
FilteringFilter devices by status, OS, or other criteria
Break GlassBypass approval for emergency access
PIN CodesGenerate temporary PINs for specific tasks

Break Glass Feature​

Use With Caution

Break Glass bypasses approval workflows for emergency situations. Improper use introduces security vulnerabilities.

Best Practices:

  • Restrict access to senior administrators only
  • Log all Break Glass usage
  • Document reasons and actions taken
  • Review usage in regular audits

PIN Code Feature​

PIN Codes provide temporary administrative privileges for end-users:

Best Practices:

  • Limit PIN validity period
  • Do not share PINs via insecure channels
  • Regularly review PIN issuance patterns
  • Revoke unused PINs promptly

Approvals​

In the Approvals section:

  1. Review incoming privilege elevation requests
  2. Evaluate requests against organizational policies
  3. Approve or deny with documented reason
  4. Monitor request patterns for anomalies

Audit Log​

The Audit Log enables compliance tracking:

  1. Navigate to the Audit Log section
  2. Use filters to locate specific actions by user, device, or date
  3. Export logs for external review or compliance requirements
  4. Set up alerts for specific action types

Role-Based Access Control​

Purpose​

This Standard Operating Procedure (SOP) defines the process for managing unit-scoped RBAC within Admin By Request. Each unit receives a custom role that limits access to only their devices and users.

Custom Roles and Scoped Permissions​

Administrators' permissions are scoped to their unit:

PermissionDescription
View InventoryAccess device inventory within the unit
Approve RequestsApprove privilege elevation for unit devices
View ReportsGenerate reports for unit devices and users
Issue PIN CodesGenerate PINs for unit administrative operations
Manage WorkstationsPerform management tasks for unit workstations
Restrictions

Unit administrators cannot:

  • Modify Global Settings for Windows workstations
  • Create or manage Sub Settings for Windows workstations
  • Access devices or users outside their assigned unit

Role Assignment Process​

Step 1: Identify Unit Membership​

Each unit has at least one Security Group that dynamically feeds the Security Group used for SCIM provisioning.

Step 2: Assign the Custom Role​

  • Director or Manager assigns users to the unit's top-level Security Group
  • SCIM Provisioning automatically syncs permissions to Admin By Request
  • Additional Systems (Entra ID, Intune) receive permissions automatically

Step 3: Review and Audit​

  • Regular Reviews — Directors/managers review Security Group memberships quarterly
  • Platform Engineering Audits — Periodic verification of permission alignment
  • Unauthorized Changes — Report and correct promptly

Requesting Custom Sub Settings​

To request custom sub-settings for your unit:

  1. Identify Needs — Determine the required custom configurations
  2. Submit Request — Contact Platform Engineering with detailed descriptions
  3. Review Process — Platform Engineering evaluates the request
  4. Implementation — Approved settings are configured
Contact

Submit custom configuration requests through ServiceNow or contact Platform Engineering directly via Teams.

Prerequisites​

Administrators using Admin By Request should have:

  • Basic understanding of the Admin By Request platform
  • Familiarity with Role-Based Access Control concepts
  • Experience with Entra ID group management
  • Basic IT administrative skills

Learning Resources​

TopicResource
Windows EndpointsOverview
Installation GuideWindows Install
User InterfaceUI Overview
Portal FeaturesPortal Guide
Tenant SettingsSettings Guide
Key TermsDefinitions