Access grants
Not every request is about launching a binary. Users also need to change protected OS settings: join a Wi-Fi network, add a printer, fix a display. Access grants give time-boxed access to a settings class instead of handing out admin.
Settings classes
Each class maps to a fixed set of Windows ms-settings: pages. A grant only satisfies prompts for the pages in its class — nothing else is elevated.
| Class | Windows Settings pages it covers |
|---|---|
| network | Wi-Fi, Ethernet, VPN, proxy, dial-up, mobile hotspot and airplane mode. |
| display | Display, night light, screen rotation and multitasking. |
| devices | Bluetooth & connected devices, mouse & touchpad, typing, pen and AutoPlay. |
| printers | Printers & scanners. |
| power | Power & sleep and battery. |
| time | Date & time and timezone. |
USB storage is not part of the devices class. Removable-storage access is governed separately by USB control (device-level enforcement), so an access grant can never re-enable a blocked drive. See USB control.
How it works
- The user requests a class from the tray, picks a duration and gives a reason. The reason is required.
- The request is MFA-protected: the grant records which factor verified the user, and the proof is stored (hashed) with the grant.
- An admin approves or denies from the web console or the iOS approver app, exactly like an elevation request.
- While the grant is live, the agent transparently satisfies the OS credential prompts for that class only. Nothing else is elevated.
- The grant expires on its own at the approved time.
Grant fields
| Field | Meaning |
|---|---|
| class_id | Which settings class the grant covers. |
| granted_at / expires_at / duration_label | The window, plus the human label the user picked ("30 minutes"). |
| reason | The user's justification. |
| mfa_method | The factor that verified the user before the request was accepted. |
| status | pending, active (approved and live; the agent may satisfy prompts) or denied; revocation details are recorded alongside. |
| use_count / last_used_at | How many times the grant actually satisfied a prompt. Surfaces never-used grants, a signal the duration or class was wrong. |
Revocation
A live grant can end three ways, each recorded with its kind:
- user: the user self-revokes from their My Access panel when done early.
- admin: an admin revokes from the grants log.
- system: expiry, device removal or tenant suspension.
Access grants answer the "I just need to change a setting" case that otherwise becomes a full admin session. Keep durations short: the use counters will tell you if users routinely need longer.