What "can" means when it is standing, requested, or break-glass

Can is a state of this morning, not a badge on an account. Standing access, an open request, and a break-glass account are three ways the word can be true. This chapter splits that fourth statement by state. Fold the three into one privileged cell and you will buy one control and leave two mornings untouched.

Standing means nobody has to ask

Standing access is the verb that succeeds without a fresh decision. The account is already in the group. The role is already active. The client secret is already valid. The local administrator password already works. At nine o'clock nobody files a request. A person does the thing, or a job does it, and the directory answers yes because the object is still there.

That is colder than the word permanent and wider than an assignment blade. Permanent is what a product calls a role that has no end date. Standing is a test. An eligible role that the same person can activate, with a reason string nobody reads and no second approver, is standing access with a form in front of it. Just-in-time is a claim about a gate. If you have not opened the activation policy, you do not have the claim. You have the word eligible, and a sponsor will hear that word as "not really privileged". The morning test is how you stop the hearing becoming the brief.

A vault full of static administrative passwords is standing privilege. The password can rotate on a schedule. The session can be recorded. A checkout can be required before a person sees the secret, and a checkout looks like a request because a person had to click. The account underneath was not created for that click. It was created to be an administrator, and it is still an administrator on mornings when nobody checks anything out. Rotation changes the secret. Recording changes what you can watch afterwards. Neither changes the object that grants the verb. Custody is not the state. A vault report will not be mistaken for an answer to can if you keep those apart. Pride in the vault is a programme emotion. It is not a state.

Where the verb is standing because a shared administrative password is valid every day, the shape that fails the morning test on purpose is temporary elevation of a named person, an ephemeral vendor account that exists for the window and then does not, or a short-lived token for a workload that expires whether or not someone remembers to revoke it. Those are different objects from a static admin account with a rotated password. On a morning when nobody has elevated, when the vendor account has been removed, and when the token has died, the verb does not succeed. A programme that keeps the static account and adds a recording has improved the evidence after the verb. It has not changed whether the verb would succeed.

A role assigned directly to the account, active, with no eligibility and no expiry, is the cleanest standing grant in the directory, and the one group-centric exports skip. If that assignment is the description that wins, the state is standing. Certifying it records a willingness to leave it there. It does not change the morning.

A request is a window, and windows get left open

Requested access is the verb that succeeds because someone asked and someone, or some rule, said yes, and the yes has not ended. An eligible role activated at ten is requested for the length of that activation. An access package that put an account into a group for fourteen days is requested until day fourteen. It is standing on day fifteen if the membership remains and nothing removes it. A change ticket that added a principal "until the release" is requested only when the release has a time you can read. If the ticket is closed and the principal remains, you do not have a request. You have standing access, and a story about a request, and the story is not the object.

The lie a request tells is that the access is temporary because a workflow existed. Workflows record the ask. They do not remove the grant. If the platform's approved flag was taken as the winning description, compare it to the directory after the end date. Approved and ended, membership gone, is not a grant. Approved and still present is. The fourth statement has to say which, or the state column will copy the workflow and call itself a control.

Three shapes cover the requests you will find.

The activation that is open now. List eligible assignments that are currently active, who activated them, when the window ends, and whether that same person can open another window alone when this one closes. An open window is can, of the requested kind, until it ends. A closed window on an assignment the holder reopens alone is standing, and the state cell should say so. Write the activation rule beside the state. Approval by a named second person is a different rule from a reason string. Authentication context is a different rule again. If you have not read the rule, the cell is unknown, not requested-and-therefore-fine.

The approval whose clock is still running. Access packages, group-owner approvals, requests in the governance platform, whatever the tool calls a grant with a duration. Take the duration from the tool and the membership from the directory. The platform's end date is a story about a clock. The group is the object. A model that says the access ended on Friday, while the account is still in the group on Monday, is not a stale model. A stale model is an entitlement that no longer grants anything. Here the clock has finished and the grant has not. The directory wins. The state is standing.

The ticket that was once a request and is now a comment. Closed changes, migration windows, contractor access "for the project". If the object remains, the ticket explains origin. Origin is not an end. Put the ticket number in the evidence pointer. Do not put temporary in the state column.

A request that is honestly inside its window is the state you wanted when you paid for the gate. Do not brief it as a failure. The finding is a column that calls every historical approval a living window. Count open windows. Count windows whose end has passed while the object remains. Do not count how many workflows you own.

Break-glass is standing access you have agreed not to look at

Break-glass is the account, the role, or the exclusion kept so a bad morning does not leave you outside your own tenant. The intention is the most serious intention in the identity programme. The state is usually standing. The password works on a quiet Tuesday exactly as it works during a declared incident, unless you have built something that makes that sentence false. Most programmes have not built that thing. They have written a procedure, sealed an envelope, or stored a password in the vault under a name that contains the word break. They have then excluded the account from Conditional Access, from certification, and from the leaver process, because a control that fired on the emergency account felt like a risk to the emergency. The exclusions are objects. The procedure is a hope that people will feel the weight before they use it.

Give break-glass its own value so it does not vanish into standing or into out of scope. Would the verb succeed today if someone used that account? If yes, can is true. Hoping they will not is a preference. The sponsor may keep the account. The sponsor may not be told it can do nothing, if it can.

Two facts decide whether the label is honest.

Who can use it. A secret that forty people can retrieve is not an emergency instrument. It is a shared administrator with a frightening name. A secret that takes two people, a recorded session, and a ticket opened in the same hour is closer to a request you have pre-authorised for a dead path. Say which one you actually built. If you have not walked the retrieval, the who-cell is unknown. "Crisis team" is a distribution list wearing a helmet. The refusal of team aliases stands on the worst account in the neighbourhood, not only on the ordinary ones.

Whether the dead path is the only time it works. An account excluded from multi-factor authentication and from Conditional Access works on the best day of the year. That exclusion is a policy exception. Stop calling the exclusion a safety feature while leaving the verb off the row. The verb is whatever the account can do. Reset authentication methods. Grant directory roles. Exclude further accounts from policy. If you cannot say the verb, you do not yet have a break-glass row. You have a password and a myth.

Break-glass accounts are often kept out of the leaver feed on purpose. The same exclusion protects an orphan. If the owner has left, the who-cell is empty.

Workloads do not get a softer can

A person activating a role is easy to picture as a request. A workload rarely asks. It authenticates on a timer, and the verb succeeds because a secret, a certificate, or a managed identity is valid. That is standing, unless the credential is short-lived and the right to mint another one is itself behind a gate you have actually looked at. A client secret with a year of life is standing access for a year. Replacing it, on the morning it expires, with another secret of the same life, keeps the state standing. The rotation ticket will look like activity. Activity on the secret is not a change of state. Managed credentials do not finish the review.

The size of the standing grant is the permission, not the secret. A client secret can authenticate on a path that never meets the multi-factor story told about users, and it skips the Conditional Access policies written for interactive sign-in. What that path is worth is the Graph permission or the app role. Get-MgServicePrincipalAppRoleAssignment still lists it. If the state cell says standing and the object cell says only "secret", you stopped a column too early. The state is standing while a valid credential and that permission are true together. Remove the secret and leave the permission, and the next secret inherits the verb.

Report-only says what would have been refused. It does not refuse it. A row marked covered, while the policy is report-only or the principal is outside the feature, is an intention. Can remains the permission. Write the pointer on the row. Using the limit as a reason not to list the permission is an excuse. List the permission anyway.

Managed identities do not earn a softer word. While the resource lives, a system-assigned identity's role assignment is standing. A user-assigned identity can be shared, and deleting one attached resource does not end it. Split the rows. The vault's silence stays expected. Do not invent a checkout to make the state feel human.

Agents do not get another state. They get a who, a permission set, and an exit cell. The state of the agent's verb is standing when the permission would succeed this morning without a fresh approval. Sponsorship can fill the who-cell. It does not open a window.

The morning test, on the table you have

Add a state column to the Monday table, beside the fourth statement. The new work is the test.

At nine o'clock, with no new approval, no new activation, and no incident declared, does this verb succeed? If it does, the state is standing or break-glass. Use break-glass only when the account or the exclusion exists for the dead-path case and you have written who can invoke it. If the verb succeeds only because an activation or an approval is open right now, the state is requested, and the end of the window is part of the cell, not a footnote. If the verb would not succeed this morning because nobody has activated it, that is not a way can is true. Record it separately, as eligible-not-active, and write the activation rule in the same breath. Without the rule, the cell collapses back into the lie that eligibility is safety.

The Billing-Readers row is standing. A member can reset credentials on the billing user store this morning with no fresh approval and no incident. It is not a request, and it is not break-glass. Eligible-not-active does not describe it. Do not file the row as requested because, once, someone asked for a group with readers in the name.

Apply the test to the object that wins the fourth statement, not to the identity as a blob. One identity can hold a standing application permission, an eligible directory role, and a break-glass local account. Those are three rows. Fold them and the sponsor hears just-in-time and misses the standing app role.

Where the vault wins, say whether the account the secret opens is standing. Checkout changes the answer only if the account cannot act until checkout enables it. That is not the default, and a vault's presence does not prove it. Synced and still enabled means the morning test is about the source.

Do not score the states. This chapter only stops three mornings sharing one name. A cell that still says privileged is unfinished.

Read the activation policy and the end date from the system that enforces them. The design document is the intended estate. The table is the actual one. Overwriting actual with intended is how the object column dies. If the implementation of just-in-time is a slide, the slide does not get a cell.

For one break-glass account, run a paper test rather than a production sign-in. Who retrieves the secret. What verb the account can perform. Which policy excludes it. Whether the owner still works here. Any unknown stays unknown. A break-glass row filled with assumptions is worse than a blank, because assumptions get briefed as readiness and blanks get chased. The state column is allowed to stay empty.

What each stack will claim, and which claim is a state

Entra will show active and eligible assignments where PIM is in use and the licence covers the question you are asking. It will show credential end dates on an application. It will not label a vaulted static password as standing privilege, because that label is a judgment and the directory is not there to make it. It will not tell you that an exclusion from certification means break-glass. You bring the exclusion list to the assignment yourself. State, in this chapter's sense, is only partly one of them.

The governance platform will show requests, durations, and entitlements marked privileged in the model. The duration is the platform's clock. Compare it to the grant before it wins. If the application was never aggregated, there is no clock. Classify from the winning description anyway. Waiting for a request object is how unaggregated standing access stays out of the column.

The vault will show checkouts, rotations, and any account a person tagged as break-glass. The tag is a label in the vault's language. The rights of the account on the target are the verb. A month with no checkout is not a month in which can was false. It is a month in which nobody asked. Standing access does not need a customer to remain standing. Briefing "no checkout, therefore no use, therefore no privilege" confuses an audit log with a permission.

When the stacks disagree about state, aim the winning rule at the morning. An eligible role the platform calls certified permanent follows the activation rule, not the campaign. A vault that says controlled, beside an enabled admin account, is custody of a standing verb. A passed end date beside a living membership is standing. The state column refines the fourth statement.

The word just-in-time will try to rename the column. It gets applied to every eligible role, every vault checkout, and every ticket that once mentioned a duration. The defence is the morning test written so a sceptic can replay it without you in the room. If the verb succeeds with no new approval, the word comes off the row.

Vault coverage will try to drop the column, because the programme's metric has no slot for it. Let the metric live where the programme needs it. Keep standing on the row. Onboarding a static administrator is custody.

Fear will try to take break-glass out of scope. You may refuse the removal. Refusal is a decision, and decisions can be written down. You may not hide the verb. Out of scope, with the verb still visible, is allowed.

Workloads get captured by a definition of access that requires a person at a screen. If the state column contains only humans, it was scoped to the review you already knew how to run.

If a column comes back mostly requested, suspect the test before you congratulate the programme. Count break-glass rows with an empty who-cell, standing rows that are static administrative passwords, and requested rows whose window ended while the object remains. Three counts.