Elevate24
com.jigsaw24.Elevate24
macOS privilege access management tool from Jigsaw24
macOS
Configuration Keys (52)
Showing 52 of 52 keys
| Key | Type | Description | Default | Range |
|---|---|---|---|---|
PFC_SegmentedControl_0stringrequired | string | — | Default: — | Range: — |
LicenseKeystringLicense Key (Premium) | string | Enter your Elevate24 license key. Mandatory key for Premium customers only. | Default: — | Range: — |
LicenseAPIKeystringLicense API Key (Premium) | string | Enter your Elevate24 license api key. Mandatory key for Premium customers only. | Default: — | Range: — |
newUIbooleanNew UI | boolean | Change Elevate24 to show to the new UI. Not required for Elevate24 2.3+ as this is now default. | Default: false | Range: — |
messagestringMessage | string | Change the standard application message in the application. | Default: "Use of admin accounts is recorded for security compliance. Select why you require admin privileges and select how long for." | Range: — |
iconPathstringIcon (Premium) | string | Prodvide the file path to a JPEG or PNG to use as the icon in the Elevate24 application. | Default: "Main Jigsaw24 Logo" | Range: — |
headingstringHeading (Premium) | string | Change the standard header from Elevate24 in the application. Always displays in bold. | Default: "Elevate24" | Range: — |
subheadingstringSub Header (Premium) | string | Change the standard text "Privilege Access Management" under the Elevate24 header. New UI V2.2.0+ Only. | Default: "Privilege Access Management" | Range: — |
mainbuttonstringMain Button Text (Premium) | string | Change the standard button text from Elevate in the application. | Default: "Elevate24" | Range: — |
HideLogobooleanHide Powered By Jigsaw24 Logo (Premium) | boolean | Hide the “Powered by Jigsaw24” logo in the application. | Default: false | Range: — |
DisableUserElevationbooleanDisable User Elevation | boolean | Elevate24 2.5+ Only. When enabled, the Elevate24 menubar UI is hidden and cannot be launched manually from /Applications. End users will have no visible way to request elevation, view their session status, or interact with Elevate24 directly. The underlying agent continues to run in the background, enforcing session policies and authorisation rules as normal. | Default: false | Range: — |
AllowCliElevationbooleanAllow CLI Elevation | boolean | Elevate24 2.5+ Only. When enabled, allows user to elevate from the command-line. | Default: false | Range: — |
EnabletimelistbooleanEnable Choice of Session Times | boolean | Enables the option for the application to display a choice of times. To be used in conjuction with Session Times list. | Default: false | Range: — |
enableReasonbooleanEnable free text reason | boolean | Will replace reasons drop down list with a free text entry box. | Default: false | Range: — |
blockExtendbooleanBlock extending session | boolean | Will disable the ability to extend the time of an active Elevate24 session. | Default: false | Range: — |
SessiontimestringSession Time | string | Change the length of time (in seconds) the user will be elevated for. Do not use this key if you want to present a list of times to choose from. | Default: "3600" | Range: — |
timesarraySession Times | array | List of available times to chose from in the Application. Enter time below in seconds. | Default: ["1800","3600","7200"] | Range: — |
| string | — | Default: — | Range: — | |
reasonsarrayReasons | array | The reasons to choose for needing elevated rights in dropbox within the application. | Default: — | Range: — |
| string | — | Default: — | Range: — | |
advancedReasonsarrayAdvanced Reasons | array | New reason type that can require a free-text note. Combined with the existing Reasons list. The selected reason is logged to Reason, the note to ReasonText. | Default: — | Range: — |
| dict | — | Default: — | Range: — | |
reasonstringReason | string | — | Default: — | Range: — |
requireFreeTextbooleanRequire Free Text | boolean | — | Default: false | Range: — |
freeTextPlaceholderstringFree Text Placeholder | string | — | Default: — | Range: — |
sessionExpiryReminderintegerSet Session Expiry Notification (Premium) | integer | Set the number of minutes before the application notifies the user that the session is expiring | Default: 0 | Range: — |
AllowUserDefinedScriptsbooleanAllow User Defined Scripts | boolean | Elevate24 2.4+ Only. When enabled, allows users to specify their own elevation and demotion script paths in addition to any admin-defined scripts. If scripts are configured at both the admin and user level, all scripts will execute. When disabled, only admin-defined scripts (ElevateScriptPath and DemoteScriptPath) will be used. | Default: false | Range: — |
ElevateScriptPathstringElevate Script Path | string | Elevate24 2.4+ Only. Specify the full file path to a script that will be executed automatically when a user's session is elevated to admin. This can be used to perform actions such as logging, launching tools, or configuring the environment at the point of elevation. | Default: — | Range: — |
ElevateScriptHashstringElevate Script Hash | string | Elevate24 2.4+ Only. Optionally provide the SHA256 hash of the elevation script specified in ElevateScriptPath. When configured, Elevate24 will verify the script's integrity before execution and refuse to run it if the hash does not match, protecting against unauthorised modification of the script. | Default: — | Range: — |
DemoteScriptPathstringDemote Script Path | string | Elevate24 2.4+ Only. Specify the full file path to a script that will be executed automatically when a user's elevated session ends and they are demoted back to a standard user. This can be used to perform clean-up tasks, revoke temporary access, or audit the end of an elevated session. | Default: — | Range: — |
DemoteScriptHashstringDemote Script Hash | string | Elevate24 2.4+ Only. Optionally provide the SHA256 hash of the demotion script specified in DemoteScriptPath. When configured, Elevate24 will verify the script's integrity before execution and refuse to run it if the hash does not match, protecting against unauthorised modification of the script. | Default: — | Range: — |
CooldownMinutesintegerElevation Cooldown (Minutes) | integer | Enforces a wait between elevations: once a session ends the machine cannot re-elevate for a configurable period. Enforced per-computer inside the system extension (covers UI, CLI, and automatic session expiry), and resistant to clock tampering. The elevate window shows a live countdown while a cooldown is active. Set to 0 to disable. | Default: 0 | Range: — |
CooldownOverrideEnabledbooleanOffline Cooldown Override | boolean | Lets a helpdesk grant a one-time, short code that clears an active cooldown while the device is offline. Uses a Secure Enclave key so no reusable secret is stored on the device; codes are single-use and rate-limited. Presented discreetly behind an ⓘ icon on the countdown (only when enrolled), with customisable contact text. Requires a Secure Enclave (Apple silicon / T2), a roughly-correct device clock, and the backend enrollment/generation service. Enables enrollment + override. | Default: false | Range: — |
CooldownOverrideMessagestringOffline Cooldown Override Message | string | Custom helpdesk contact text shown in the offline cooldown override popover. If unset, a built-in message is used. | Default: — | Range: — |
DisableDefaultLogbooleanDisable Default Log (Premium) | boolean | To disable sending of premium reporting data to Jigsaw24. If you are a basic customer, no data is sent from the device, it is all stored locally. | Default: false | Range: — |
siemURLstringSIEM URL (Premium) | string | — | Default: — | Range: — |
siemAuthHeaderstringSIEM Auth Header (Premium) | string | — | Default: — | Range: — |
siemAuthTokenstringSIEM Auth Token (Premium) | string | — | Default: — | Range: — |
formatLogMessageSplunkbooleanFormat Log Message for Splunk (Premium) | boolean | Enable to ensure correct formatting of logs when using Splunk as the endpoint. Available in Elevate24 2.6.0 and later. | Default: false | Range: — |
microsoftsentinelarrayMicrosoft Sentinel | array | — | Default: — | Range: — |
| dict | — | Default: — | Range: — | |
SentinelClientIdstringClient ID | string | — | Default: — | Range: — |
SentinelTennantIdstringTennant ID | string | — | Default: — | Range: — |
SentinelClientsecretstringClient Secret | string | — | Default: — | Range: — |
SentinelUploadURLstringUpload URL | string | — | Default: — | Range: — |
EnableSessionMonitoringbooleanEnable Session Monitoring (Premium) | boolean | To enable monitoring of administrator activities whilst in an elevated state. | Default: false | Range: — |
enableAppleAuthbooleanApple Auth | boolean | Prompts the user for their local Apple credentials or TouchID (if enabled on device) before allowing elevation. | Default: false | Range: — |
GoogleAuthbooleanOTP Auth (Premium) | boolean | Enables the use of authenticator applications such as Google Auth or Microsoft Auth, prompting for a valid session token before Elevating to admin. | Default: false | Range: — |
standardAtLoadbooleanStandard At Load | boolean | Will remove admin rights when the application first launches. | Default: false | Range: — |
demoteAllAdminbooleanDemote All Admin | boolean | Enables all admin users being demoted to standard users when the current elevation period ends. If you have any accounts on the device you'd like to remain admin please configure Demote Exclusions. | Default: false | Range: — |
demoteAllAdminQuitbooleanDemote All Admin Quit | boolean | Will demote all admin accounts from admin when the application quits or the laptop is restarted. | Default: false | Range: — |
demoteExclusionsarrayDemote Exclusions | array | Will exclude accounts on device from being demoted. | Default: — | Range: — |
| string | — | Default: — | Range: — | |
killterminalsessionsbooleanKill Terminal Sessions | boolean | Will demote the current terminal session from sudo session to standard. | Default: false | Range: — |
UseSystemExtensionbooleanSystem Extension | boolean | Elevate24 v2.3+ Only. To ensure the Application is protected by the on-device system extension, to prevent misuse and tampering. | Default: false | Range: — |
userElevateAdminbooleanUser Elevate Admin (Premium) | boolean | Will create a temporary secondary account instead of Elevating the primary account. A temporary password will also be supplied upon elevation. | Default: false | Range: — |
useCurrentUserAsAdminbooleanUse Current User As Admin (Premium) | boolean | If User Elevate Admin Key is enabled and this key is also enabled, the temporary account will use the current logged in users username as part of the account naming. For example, Joe.Bloggs-adm | Default: false | Range: — |
adminUserNamestringAdmin User Name (Premium) | string | If ‘Use Current User As Admin’ is not enabled, this key allows the ability to create a temporary admin account with a standard name. Such as "Temp Admin" | Default: — | Range: — |
ComplexPasswordbooleanComplex Password (Premium) | boolean | Enables the use of a custom complex password when 'User Elevate Admin' is enabled. | Default: false | Range: — |
PasswordUppercasestringPassword Uppercase (Premium) | string | Enter the amount of uppercase Letters required for the password. | Default: — | Range: — |
PasswordLowercasestringPassword Lowercase (Premium) | string | Enter the amount of lowercase Letters required for the password. | Default: — | Range: — |
PasswordNumbersstringPassword Numbers (Premium) | string | Enter the amount of numbers required for the password. | Default: — | Range: — |
PasswordSymbolsstringPassword Symbols (Premium) | string | Enter the amount of symbols required for the password. | Default: — | Range: — |
showAdminPasswordGraceintegerShow Admin Password Grace (Premium) | integer | Set the number of seconds after elevation or last showing the password that the password will be shown (Max 45 seconds). This only works if 'User Elevate Admin' is enabled. | Default: 0 | Range: — – 45 |