Altiward View on GitHub

Temporary admin on Macs: five approaches compared

How Jamf, Iru (formerly Kandji), PrivilegesDemoter, Admin By Request and SAP Privileges with Altiward give people admin rights for a while and take them back, based on each vendor's own documentation.

Last reviewed October 2026Vendor documentation checked 24 October 2026SAP Privileges 2.6.0

We make Altiward, so read this with that in mind. Every statement about another product links to that vendor's own documentation, release notes or source code in the sources at the end. Where a vendor's documentation doesn't cover something, the table says "not documented" rather than guessing. Products change quickly, so check the sources before you decide.

If we've got something wrong, email hello@altiward.com or suggest a change on GitHub.

The short version

  • Admin By Request documents the widest set of controls of the five: elevation of a single app or installer, timed admin sessions, optional approval, app pre-approval, malware checks and a vendor-hosted portal.
  • Jamf builds timed elevation into Self Service+, configured through a Jamf Connect profile, with reasons, authentication, monthly limits and per-role durations. Jamf's Jamf Connect 3.0 announcement says a Jamf Connect licence is still required.
  • Iru, the new name for Kandji, doesn't document an elevation feature of its own. Its documentation deploys SAP Privileges 2 as an Auto App instead.
  • PrivilegesDemoter is a free community script that reminds the logged-in admin to step down and removes their rights if they don't answer. It has had no release since May 2023.
  • SAP Privileges with Altiward is free and open source. Privileges grants admin; Altiward checks each Mac's admin group against the grants, alerts on or removes rights past expiry, and sends records to your SIEM. It has no approval step and no per-app elevation, and you run its server yourself.

Getting and ending admin

ToolHow someone gets adminApprovalHow admin ends
Jamf: Self Service+ with Jamf ConnectThe person elevates in Self Service+ or with jamfconnect acc-promo --elevate and becomes a local administrator for the minutes you set. Options include a reason from a list you define, authentication first, a monthly limit and per-role durations from your identity providerNot documentedStandard user again when the timer ends, or with --demote. Changing the system clock sets a time-tampering flag that blocks further elevation
Iru (formerly Kandji)No elevation feature of its own is documented. Iru documents deploying SAP Privileges 2 as an Auto App and keeping it up to dateAs SAP Privileges: no approval setting in SAP's settings referencePrivileges' own timer. Iru's separate Demote user accounts to Standard parameter makes every non-excluded local account standard, but Iru says not to use it with SAP Privileges 2
PrivilegesDemoterDoesn't grant admin itself when used with SAP Privileges. In standalone mode, a self-service policy in your MDM runs its --elevate command as rootNot documentedEvery 5 minutes it checks whether the logged-in user is an admin. Past a threshold, 15 minutes by default, it asks if they still need it; No, or no answer, removes the rights
Admin By RequestRun As Admin elevates one app or installer package. Admin Session makes the person a local administrator for a set time, 15 minutes by default. Pre-approved apps can skip the requestOptional for each type, off by default. Approve from the portal, mobile app or API. Reasons and multi-factor authentication through Entra ID or a SAML provider are availableThe session ends when its time runs out or the person finishes it. At logon, Revoke admin rights, on by default, makes admin accounts standard unless you exclude them
SAP Privileges with AltiwardPrivileges grants full admin for a time you limit, with an optional reason and authentication. Altiward never grants adminNone: SAP's settings reference has no approval setting, and Altiward doesn't add onePrivileges' timer and revocation rules. Altiward's root agent also alerts on rights past the recorded expiry, or removes them if you turn enforcement on, and your team can revoke from the console

Oversight, records and running costs

ToolAdmins nobody grantedRecords and SIEMWhere it runs and cost
Jamf: Self Service+ with Jamf ConnectNot documentedElevation events go to the Mac's unified log, and reasons to an ElevationReasons log file. Jamf documents collecting them with Jamf Protect, a separate product, and sending them to a SIEMSelf Service+ on each Mac, configured with a Jamf Connect profile. Needs a Jamf Connect licence
Iru (formerly Kandji)The Demote user accounts to Standard parameter demotes any admin except the accounts you exclude, at each agent check-in, then restarts the Mac after a 30-minute countdown. Not for use with SAP Privileges 2Not documented by Iru for elevation. SAP Privileges 2 can send its own events to syslog or a webhookPart of Iru Endpoint, Iru's device management product. SAP Privileges is free and open source
PrivilegesDemoterChecks only the logged-in user, however they became admin. Other admin accounts on the Mac aren't checkedA log file on each Mac, /var/log/privileges.log, and Jamf Pro policy logs if you use a Jamf policyA script and LaunchDaemon on each Mac, with no server. Free, Apache 2.0
Admin By RequestRevokes admin at logon unless excluded, as above. Its Admin Session page says changes to the local admin group during a session are reverted when it endsAn audit log in the portal. After an Admin Session, the processes run and software installed or removed are uploaded. Splunk through its HTTP Event Collector and webhooks; Microsoft Sentinel through a Logic App and the audit log APIAn agent on each Mac and a portal hosted as SaaS on Microsoft Azure, in one of several regions, with no on-premises servers needed. Free for up to 25 seats; paid plans priced on request
SAP Privileges with AltiwardAltiward reads the whole admin group every 15 seconds and flags accounts with no recorded grant that aren't on your permanent-admin list. It removes them only when someone revokes them from the consoleSessions and findings as OCSF to Splunk, Microsoft Sentinel or syslog, including what changed while someone was admin. Events wait in your database until the SIEM accepts themAn agent on each Mac, plus a server, Postgres database and console that you run. Free, Apache 2.0; you pay for the hosting and do the upgrades

Jamf

Jamf's temporary admin feature lives in Self Service+, which Jamf describes as formerly the Jamf Connect menu bar app. You turn it on with the TemporaryUserPromotion setting in a Jamf Connect configuration profile. While elevated, Jamf says the person "is able to conduct any actions available to local administrators", and a timer in the menu bar shows the time left.

Where it goes further than SAP Privileges with Altiward:

  • Durations can follow roles from your identity provider, and a role with a duration of 0 can't elevate at all.
  • A limit on the number of elevations per calendar month, with a time-tampering flag if someone changes the clock to get round it.
  • Reasons are picked from a list you define, with an other option.

Jamf's pages don't describe an approval step, reporting in Jamf Pro, or how Self Service+ treats admin accounts it didn't create. For evidence outside the Mac, Jamf points to Jamf Protect's unified log filters. In Jamf's Jamf Connect 3.0 announcement, Jamf said licence profiles "remain compatible and required" for the account features in both Jamf Connect and Self Service+.

Iru, formerly Kandji

Iru's documentation says Kandji branding changed to Iru from 8 April 2026, and calls the device management product Iru Endpoint. We found no Iru page describing a temporary admin feature of its own. What Iru documents for admin rights on Macs:

  • A SAP Privileges 2 Auto App that installs Privileges and, with Continuously enforce, keeps it up to date. Iru links to SAP's own documentation for configuring it.
  • A Demote user accounts to Standard parameter that checks every local account at each agent check-in, demotes any admin you haven't excluded, then restarts the Mac after a 30-minute countdown. Iru warns that it "can remove administrator privileges granted by SAP Privileges 2", so don't assign both to the same Macs.
  • A LAPS Library Item that rotates passwords for the local administrator accounts you name and stores them in Iru.

For temporary admin on Iru-managed Macs, then, the choice is mostly about what you put around SAP Privileges. Altiward works with Privileges, so it can run on Macs that use the Auto App. List Iru's managed admin account in Altiward's PermanentAdmins, as you would for any LAPS account.

PrivilegesDemoter

PrivilegesDemoter is a community project on GitHub (sgmills/PrivilegesDemoter), licensed under Apache 2.0. SAP doesn't maintain it. A LaunchDaemon runs it as root every 5 minutes. If the logged-in user is an admin past the threshold, 15 minutes by default, it asks whether they still need admin rights. Yes resets the timer; No or no answer removes them. You set it up with a configuration profile, including a list of accounts it should never demote. Notifications can use swiftDialog, IBM Notifier or Jamf Helper, or be turned off for silent demotion.

Where it goes further than SAP Privileges with Altiward:

  • It's small: one script and one LaunchDaemon, with no server or database.
  • It can work without SAP Privileges, using a self-service policy to elevate.
  • It nudges people to give up rights early, which Altiward doesn't do.

Things to check before relying on it. The latest release is v3.0, from 15 May 2023, and the last code change was in November 2024; both predate or coincide with SAP Privileges 2.0, released on 20 November 2024. Its documentation refers to DockToggleTimeout, a setting SAP lists for Privileges 1.0.5 to 1.5.4, so test it against the Privileges version you run. Because it runs every 5 minutes, its wiki notes that a reminder can come up to 5 minutes after the threshold. It checks only the logged-in user, and its log stays on the Mac.

Admin By Request

Admin By Request is a commercial endpoint privilege management product with agents for Windows, macOS and Linux and a cloud portal. On macOS it offers two kinds of elevation: Run As Admin, for one app or installer package, and Admin Session, which makes the person a local administrator for a limited time.

Where it goes further than SAP Privileges with Altiward:

  • Elevation of a single app or installer, so people don't need full admin to install software.
  • An optional approval step for each kind of elevation, from the portal, a mobile app or the API, with email and ticketing notifications.
  • App pre-approval by vendor, Team ID, bundle ID or checksum, and a setting that auto-approves apps once they've been approved manually.
  • Malware checks through OPSWAT MetaDefender before an app runs elevated.
  • Control over which System Settings panes standard users can open, and whether sudo works in Terminal during an Admin Session (off by default).
  • Session records that list the processes run and the software installed or removed, according to Admin By Request's Admin Session page and spec sheet.
  • A hosted portal, so there's no server for you to run.

On the other side of that trade, the portal is SaaS: Admin By Request's spec sheet describes it as hosted on Microsoft Azure, and it keeps customer data in one of its regional data centres. Approval is off by default, including on the free plan. The free plan covers up to 25 seats; Business and Enterprise prices are on request.

SAP Privileges with Altiward

SAP Privileges is a free, open-source app from SAP that grants full admin for a limited time. Altiward works with SAP Privileges: its root agent runs on each Mac alongside Privileges and never grants admin itself. What it adds:

  • An independent check of the admin group. Privileges' timer runs in the person's own session, and SAP says Privileges can't guarantee that rights are removed. Altiward's agent, running as root, compares the whole admin group with the grants Privileges recorded.
  • Expiry you choose how to handle. By default it alerts on rights past their expiry. With ExpiryEnforcement set to enforce, it removes them after a grace period.
  • Admins nobody granted, across the fleet. Accounts with no recorded grant and not on your permanent-admin list are flagged in the console and sent to your SIEM. With Privileges 2.6 or later and its system extension on, the finding names the process that added the account.
  • Revocation from the console, per session, per account or per Mac.
  • Gaps you can see. The server flags Macs that stop checking in, and the agent reports tampering with itself or with Privileges' protection.
  • Evidence in your own systems. OCSF records go to Splunk, Microsoft Sentinel or syslog, and nothing is sent to us.

What Altiward adds to SAP Privileges compares the two in detail.

What Altiward doesn't do

Altiward checks and records admin rights, and leaves some jobs to other tools:

  • It doesn't grant admin. Altiward needs SAP Privileges to do that. If Jamf, Admin By Request or anything else grants admin instead, Altiward shows every admin outside your permanent list as one nobody granted.
  • No approval workflow and no per-app elevation. Privileges gives full admin for a period, and neither it nor Altiward has an approval step. If you need either, Admin By Request documents both.
  • You run the server. That means a Linux server with Docker Compose, or Azure Container Apps, plus two DNS names, Postgres backups and upgrades. For laptops away from the office, the agent hostname has to be reachable from the internet.
  • Rights past expiry stay by default. The default policy alerts; removal happens only once you set ExpiryEnforcement to enforce. Expiry comes from Privileges, so a grant Privileges gives no expiry never counts as overdue.
  • Unexpected admins aren't removed automatically. Altiward flags them and your team revokes them from the console.
  • No app control or malware scanning. Altiward reports what changed while someone was admin, such as launch items, sudoers rules and new accounts, but not every process that ran. Your EDR covers that.
  • A local admin can stop the agent, as with any tool on the Mac. The server then reports the Mac as no longer checking in.

If you need any of these, the products above cover them, and the sources below are the place to confirm the details for your fleet.

Sources

All checked on 24 October 2026.

Try Altiward with demo data first.

The demo console runs with Docker alone, so you can see the findings and records before deciding whether to run a server.

Run the demo