> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/identity/administration/jit-admin-templates/add-jit-admin-template.md). # Add JIT Admin Template This page creates a JIT Admin template, which stores the settings for a just-in-time admin grant so the same elevation can be requested repeatedly without rebuilding it. Templates are selected on the [Add JIT Admin](/user-documentation/identity/administration/jit-admin/add.md) page, and everything a template fills in can still be changed before the grant is submitted. {% hint style="info" %} The template is created for the tenant selected in the top menu; there is no tenant field on the form. Select All Tenants before opening this page to create a template available everywhere. {% endhint %} ## Template Information | Field | Description | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Template Name | The name the template is listed under. Required. | | Default for Tenant | Applies this template automatically when the JIT admin form is opened for this tenant. A tenant-specific default takes precedence over an All Tenants default. | ## Default JIT Admin Settings **Admin Roles** and **Group Membership** are switches, and each reveals its own selector. At least one has to be turned on, and the form says so until one is. | Field | Description | | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | Default Roles | The Entra ID directory roles the template assigns. | | Default Groups | The groups the account is added to. Not available on an All Tenants template, since group identifiers do not carry between tenants. | | Default Duration | How long the elevation lasts, which sets the end date on the JIT admin form. Optional. | | Default Expiration Action | What happens to the account when the elevation ends. Required. | | Default Notification Actions | Which channels are notified when the grant is created: Webhook, Email or PSA. Several can be selected. | | Generate TAP by Default | Issues a Temporary Access Pass with the grant. | | Reason Template | Reason text the template pre-fills, which the requester can adjust. | The duration list offers 1 hour, 4 hours, 8 hours, 1 day, 3 days, 7 days, 14 days and 30 days. A value of your own can be typed instead, in [ISO 8601](https://iso8601.com/) duration format, so `PT2H30M` gives two and a half hours and `P1D` gives a day. The expiration action offers **Delete User** and **Disable User** whatever the switches are set to. It also offers **Remove Roles**, **Remove Groups** or **Remove Roles and Groups**, matching whichever switches are on, so the account survives and only the elevation is taken away. Changing the switches after choosing clears the selection, since the option may no longer apply. ## User Creation Settings **Default User Action** decides whether the template creates a new account or elevates an existing one, and which fields follow. | Field | Description | | ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | Default First Name, Default Last Name | The new account's name. Shown for a new user, and optional. | | Default Username | The part before the @ symbol. Shown for a new user, and optional. | | Default Domain | The domain the account is created under. Shown for a new user, and not available on an All Tenants template. | | Default Usage Location | The country the account is licensed in. Shown for a new user, and optional. | | Default User | The account the elevation is granted to. Shown when the template targets an existing user, and not available on an All Tenants template. | {% hint style="warning" %} An All Tenants template can only create a new user. The Existing User option is not offered, because a specific account exists in one tenant and means nothing in the others. Domain and group selection are withdrawn for the same reason, so an All Tenants template covers the roles, timing and expiry behaviour while the tenant-specific details are supplied when the grant is made. {% endhint %} *** ## Feature Requests / Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.cipp.app/user-documentation/identity/administration/jit-admin-templates/add-jit-admin-template.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.