Temporary Access Approvals When Staff Genuinely Need a Blocked Device
The vendor has arrived with firmware on a pen drive. The auditor needs a file on an external disk today. A policy without a working exception route does not stay strict — it gets bypassed, resented and finally removed. Temporary access is the safety valve that keeps the whole DLP policy alive.
🎥 Watch the full DLP setup in the video — every policy screen, step by step
ManageEngine's Device Control includes temporary access by design: a device can be allowed on specific computers for a defined time frame, after which access is revoked automatically. Your job is to build the human process around that button — who may ask, who approves, how long, and where it is written down — before the first urgent request arrives at 6 pm on a deadline day.
Temporary Access Request — What a Complete Request Looks Like
WhoNamed staff member, not a department
DeviceThat specific pen drive or disk
WhyOne-line business reason
WhereWhich computer or computers
How longHours, with an expiry time
Approved byManager request + IT grant
Example request format. If a request is missing a row, it is not ready to approve.
1
Decide the Chain Before the First Request
Write this down while nobody is in a hurry:
The staff member asks their manager, not IT directly — the manager owns the business reason
IT checks the request against the exception register and grants access in the console
Standard grant is hours, not days — one working day maximum for a genuine project need, with a fresh request to extend
2
Grant It in the Console, Not by Removing the Policy
The worst exception is the admin who 'just disables DLP for now' and forgets. Always use the product's own mechanism:
Allow the specific device on the specific endpoint for the set window
Keep file tracing on during the window — temporary trust is still recorded trust
Let expiry do the revoking. If you must remember to switch something off, one day you will not
3
Watch the Pattern, Not Just the Requests
Review the register monthly. The patterns tell you the truth about your policy:
The same device approved every week? It should probably join the trusted list properly, with an owner
The same person asking constantly? Their workflow may need an approved channel, not repeated exceptions
Requests spiking in one department? Your policy row for that team is wrong — fix the policy, not the people
4
Refuse Well When You Must Refuse
Some requests should be refused — a personal pen drive for the salary database is the classic. Refuse with the reason, an alternative ('use the office encrypted drive, I will issue it now'), and a note in the register. A documented refusal is a policy working. A silent workaround is a policy dying.
🎥 Watch the Complete Setup in the Video
Temporary access on screen — where the grant is given and how it expires — is shown step by step in the video.
Can temporary access be given for a few hours only?
Yes. Temporary access in Device Control is granted for a defined time frame on chosen endpoints, and it revokes automatically when the window ends. Grant hours by default; a fresh request is cheaper than a forgotten permanent hole.
Who should approve — IT or the manager?
Both, in their own roles. The manager confirms the business need; IT performs the grant and keeps the record. IT alone should not judge business reasons, and managers alone should never hold the console password.
What if the request is genuinely urgent and the approver is away?
Name a deputy approver in the written process before you need one. Urgency is exactly when undocumented shortcuts happen — the deputy rule keeps the urgent case inside the policy instead of outside it.
This guide is based on the ManageEngine DLP video by Technical Anshu • Stuck on a step? Ask in the video comments — answers happen there.