Access Duration
Learn about access duration, granting periods, and requiring requestors to specify how long they need access
Access duration is the period of time that a user is able to use a resource before Apono automatically revokes access.
Access duration depends on two settings.
Granting period
Maximum amount of time access can be granted for a resource, defined when creating a self serve access flow
A granting period is specific to an access flow and required for every self serve access flow.
Require duration for access request
Account-level setting that requires requestors to specify how long they need access when submitting an access request
The requested duration cannot exceed the granting period.
If this setting is not enabled, approved access uses the full granting period defined in the access flow.
The granting period is not always the exact amount of time a requestor receives. When requestors are required to specify a duration, they can request less time than the granting period. The granting period is the maximum available time for the request.
When a request is submitted, the approver sees the requested duration along with other request details. Once a request is approved, access is granted only for the specified period and is revoked when the approved access period ends.
If the requestor needs more time, a new access request should be submitted unless extended access has been enabled for the access flow.
By enforcing time limits, access duration provides the following benefits:
Reduced standing access
Improved accountability
Support for just-in-time access aligned with the principle of least privilege.
All Apono access requests, approvals, and expirations are logged and retained for at least 36 months. For longer retention needs, export this data to your organization’s storage tools.
Granting period best practices
A granting period is defined when creating a self serve access flow and should be based on the risk and sensitivity of an access flow's resources.
Use the recommendations in the table below as a starting point to define granting periods that meet your organization’s security and operational needs.
The Typical Requested Duration column reflects how long access is usually needed to complete a task.The Granting Period column defines the upper limit configured in the self serve access flow.
Development / Sandbox / Staging / QA
Quarterly
No fixed recommendation
Based on role and environment risk
Automatic Approval
Guidance:
Longer durations are acceptable due to lower risk, especially when tied to developer roles.
Production Systems
Up to 2 hours
4 hours
Approval of
OR
Automatic Approval
Settings:
Require MFA
Requester and grantee cannot self approve
Guidance:
Approval of: Choose an approver from a production team, such as DevOps or Infra.
Automatic Approval: Select this approval type for ongoing incidents or during on-call shifts.
Sensitive Data (PII, Financial, Customer)
Up to 1 hour
2 hours
Approval of
Settings:
Require Approver Reason
Requester and grantee cannot self approve
Guidance:
The approver should be able to authorize sensitive data access such as Security team, GRC, or manager.
Break-glass / Emergency
Up to 1 hour
2 hours
Approval of
OR
Automatic Approval
Setting:
Require MFA
Guidance:
The request should be reviewed post-incident.
Ticket ID may be required to make the request
Approval of: Choose an approver from an on-call shift or production team, such as DevOps or Infra.
Automatic Approval: Select this approval type for ongoing incidents or during on-call shifts.
After granting periods are defined, Apono analyzes access requests and identifies Excessive access duration when requested durations are consistently below the configured maximum.
Through Right Sizing, Apono recommends reviewing and reducing granting periods to better align with least-privilege access.
Enable Require duration for access request
By default, the Require duration for access request is disabled. We recommend enabling this setting to help limit approved access to the time requestors need to complete a task.
Follow this step to require requestors to specify a duration:
On the Settings page, click the Require duration for access request toggle to on. The toggle will turn green.
Once enabled, requestors must specify a duration a duration that does not exceed the granting period defined by the access flow. If the requested duration exceeds the granting period or is invalid, an error message prompts the requestor to enter a valid duration.
Last updated
Was this helpful?