Technician mode
MSP technicians doing maintenance need many elevations in a row; making them justify each one guarantees the tool gets bypassed. Technician mode trades a short, hard-capped, fully-attributed session for that friction, without recreating standing admin.
Two session types
| Type | What it does |
|---|---|
| ElevateIQ only | While the session is active, elevation requests on that device are auto-approved and individually recorded. The technician still works through the normal launch flow; nothing else changes on the device. |
| Temporary admin | The technician's account gets real admin membership for the session window, then loses it automatically. For the rare jobs the request flow cannot cover. |
Guardrails
| Control | Default | Notes |
|---|---|---|
| Feature switch | Off | Dark until enabled per tenant; temporary admin has its own separate switch. |
| Session length | 30 min (ElevateIQ only), 15 min (temp admin) | Hard cap of 60 minutes enforced in code. No "until manually disabled" option exists anywhere. |
| MFA for temp admin | Required | The technician verifies a factor before the session starts. |
| Manager approval | Optional | Temp-admin sessions can require a second person to approve activation. |
| End on reboot / logout | On | The session dies with the context it was granted in. |
Attribution
Every elevation auto-approved during a session is stamped with that session's identity, so the audit trail reads "approved via Technician Mode, session by [technician], [when], on [device]" rather than a bare auto-approval. The Sessions page (Requests → Technician) lists every session with the technician, device, mode, remaining time and its per-elevation history, and an active session can be revoked from there at any moment.
When to use which
- Routine maintenance, installs, updates: ElevateIQ only. It keeps the full per-elevation record.
- Deep system surgery where the request flow is in the way: Temporary admin, with MFA and ideally manager approval, for the shortest window that works.
Technician mode is a scoped exception to the approval flow, not to the audit trail. Nothing that happens inside a session is less visible; it is more attributable, not less.