# Junify for cloud admin accounts: your team signs in to admin consoles without knowing the password. IP restrictions and console settings stay as they are

> An admin adds each console login to Junify. Your team verifies on their own phone and picks a console, and Junify fills in the login. Nobody sees the password, and even a shared admin login shows who signed in.

URL: https://www.junify.com/privileged-access

Your team needs only the Junify phone app and browser extension, on a company laptop or their own.

## Is this how it works today?

Many IT teams still work like this, because handing out the password was the only way to share a console.

- Several people share one admin login. Logs show its name, not who acted.
- Passwords sit in a shared spreadsheet. Anyone who saw one still knows it.
- Each departure means changing passwords. Miss one and they're still in.
- Two-step codes go to one person's phone. When they're out, nobody gets in.
- IP restrictions are on, but they don't show who at that address signed in.

What it costs: A password you've shared can't be taken back. A shared admin login doesn't show who did what. Removing someone means a new password for everyone.

## Three steps

Before you start, an admin adds the console logins to Junify and assigns each one to the people who may use it. Console settings stay as they are.

1. **Verify on your phone**: Scan the QR code on screen with the Junify app on your own phone. That's how Junify verifies you. Okta or Entra ID sign-in works too.
2. **Click a card to sign in**: Each console you may use appears as a card. Click it and the Junify browser extension fills in the login. You never see the password.
3. **Each use is recorded by person**: You verify first, so even shared admin logins record your name. Optional recording shows a notice; only you and admins can watch.

Setup is the phone app and the browser extension. Day to day, it's scan and click.

## What your IT team can do after Junify

A new admin starts, someone moves off the team, someone asks for the record. Here's how each of those days goes.

- **Someone leaves or changes roles**: The admin removes their assignment, and they can't sign in after that. They never had the password, so nothing changes.
- **Audit day**: Show who signed in to which console and when, even on a shared login. Export it as a CSV.
- **After a mistake or an incident**: On consoles with recording, replay the session and report the same day. Without recording, you still know who signed in and when.
- **A new admin starts**: The admin assigns their cards, and they start on day one. Nobody tells them the password. They scan the QR code and click.

## Where it helps with admin consoles

- **Consoles with only a password**: Some domain, payment, and DNS dashboards still don't support SAML. Junify signs people in there without showing the password.
- **Junify enters two-step codes too**: Authenticator-app codes are filled in too, so access doesn't hang on one phone. Each person's own phone still guards it.
- **Control after sign-in**: Cards open in a window Junify manages, so after sign-in admins can still close it, get upload alerts, and block downloads.
- **No passwords left on devices**: Laptops at home or on the road keep passwords and history. Cards open in an incognito window, and closing it clears both.

## Do we have to remove IP restrictions?

No. Traffic runs between the person's browser and the console, so the source IP doesn't change. Junify only fills in the username and password at sign-in. You can also limit access by IP and location in Junify.

## Working with your identity provider

Keep Okta and Entra ID. Your identity provider keeps single sign-on and each employee's own login. Junify covers what's left: consoles without SAML and shared admin logins.

- What your identity provider keeps doing: verifying employees and single sign-on to the apps that support it / adding and removing users in apps with automatic user sync (SCIM) / conditional access by device or location
- What stays outside it, and Junify takes on: shared admin and team logins (Okta SWA and Entra ID password-based SSO fill these in and log access too; after sign-in, Junify adds recording, upload alerts, download blocking, and remote closing) / occasional admins and outside engineers you wouldn't add to it, who verify on their own phone / devices the company doesn't manage / production, staging, and per-department accounts, each its own card
- How the two fit together: your identity provider verifies people (SAML) / users stay in sync (Microsoft Entra ID, Active Directory, or SCIM) / everyone else verifies with the Junify app

If you can give everyone their own account and manage all of them through your identity provider, you don't need Junify. Junify is for the accounts that don't fit that.

## From a real deployment

- **AWS operations**: Console passwords lived in a shared spreadsheet. Now the team signs in from cards in Junify, and each sign-in is under the person's name.

## Frequently asked questions

1. **Is it safe to give Junify our admin console passwords?** Founded in 2016, Junify has served financial institutions and public companies in Japan. Our security program is aligned with the NIST Cybersecurity Framework, and we share security documents for reviews.
2. **What about consoles that require two-step verification?** If codes come from an authenticator app, Junify enters them too. Text and email codes are not supported. Only someone who verified on their own phone can open a card, so that phone still guards the console.
3. **Do we have to remove IP restrictions?** No. Traffic runs between the person's browser and the console. Junify only types the username and password at sign-in and never sits in the path.
4. **What if someone outside the team suddenly needs access?** The admin assigns them the card and they're in right away, with no password to reshare. They need only the Junify app and the browser extension, which work on personal computers too.
5. **Who sets up session recording, and who watches it?** Admins turn it on only for the consoles that need it. The person sees a notice first, and only they and the admins can watch. The record of who signed in and when exports to CSV separately.
6. **We already use an identity provider like Okta. Does Junify replace it?** No. Keep it. People can sign in to Junify through your identity provider, and Junify manages the consoles and shared admin logins that aren't on it.
7. **How is this different from a PAM tool or a password manager?** A privileged access management (PAM) tool routes traffic through a jump server. Junify only fills in the login and doesn't manage server or OS privileges. A password manager shows the password. Junify doesn't.
8. **How much does it cost?** Each plan has a limit on the number of people, and any number up to it costs the same. Prices are fixed monthly amounts in USD. We'll match a plan to your IT team's size in the demo.

## The core

Verify people by phone, never show the password, keep a light record of every use, and work on any computer.

## Company

Junify Corporation. Founded in 2016 in Palo Alto, California. Customers have included financial institutions and public companies in Japan. Security program aligned with the NIST Cybersecurity Framework; we share security and business continuity documents during your security review. Live system status at https://status.junify.com.

## Next steps

- Try the demo (about 5 minutes, no signup): https://www.junify.com/bpo/try?lang=en&scenario=privileged-access
- Book a 30-minute demo: https://www.junify.com/bpo/demo
- Download the overview: https://www.junify.com/bpo/download
- Email: info@junify.com