Session customisation

These keys are to configure the alloted allowed time of Elevation and the reasons given for elevation by the end user.

Enable time list

• Availability: Basic & Premium
• Type: Boolean
• Default: true

Enables the option for the application to display a choice of times. Configure times key to customise default options.

If you set Enabletimelist to false, configure Sessiontime to set a single selection time.

<key>Enabletimelist</key>
<true/>

Enforced session time

• Availability: Basic & Premium
• Type: String
• Default: 3600 seconds

Change the length of time the user will be elevated if Enabletimelist is false. These times should be listed in seconds.

<key>Sessiontime</key>
<string>3600</string>

Choice of times

• Availability: Basic & Premium
• Type: array
• Default: 1800 3600 7200 seconds

Change the choice of times available if Enabletimelist is True.

<key>times</key>
<array>
<string>1800</string>
<string>3600</string>
<string>7200</string>
</array>

Choice of reasons

• Availability: Basic & Premium
• Type: String

Changes the reasons the user selectes within Elevate24 before they are allowed to Elevate.

<key>reasons</key>
<array>
<string>Install Application</string>
<string>Customise Preferences</string>
</array>

Enable reason

• Availability: Basic & Premium
• Type: Boolean
• Default: false

Will replace reasons with a free text entry box.

<key>enableReason</key>
<true/>

Extend session

• Availability: Premium
• Version: 2.2.0+
• Type: Boolean
• Default: false

Will disable the ability to extend the session.

<key>blockExtend</key>
<true/>

Set session expiry notification

• Availability: Premium
• Version: 2.2.0+
• Type: integer
• Default: 0

Set the number of minutes before the application notifies the user that the session is expiring.

<key>sessionExpiryReminder</key>
<integer>2</integer>

Elevate script path

• Availability: Premium
• Version: 2.4+
• Type: String

Specify the full file path to a script that will be executed automatically when a user's session is elevated to admin. This can be used to perform actions such as logging, launching tools, or configuring the environment at the point of elevation. The username of the account being elevated is passed as the second argument ($1).

<key>ElevateScriptPath</key>
<string>/path/to/elevate_script.sh</string>

NOTE

The script must be executable and should complete quickly to avoid delaying the elevation process. Ensure the script has appropriate permissions and is located in a secure directory. Scripting features also requires UseSystemExtension to be set to true.

Elevate script hash

• Availability: Premium
• Version: 2.4+
• Type: String

Optionally provide the SHA256 hash of the elevation script specified in ElevateScriptPath. When configured, Elevate24 will verify the script's integrity before execution and refuse to run it if the hash does not match, protecting against unauthorised modification of the script.

<key>ElevateScriptHash</key>
<string>sha256hashofscript</string>

Demote script path

• Availability: Premium
• Version: 2.4+
• Type: String

Specify the full file path to a script that will be executed automatically when a user's elevated session ends and they are demoted back to a standard user. This can be used to perform clean-up tasks, revoke temporary access, or audit the end of an elevated session. The username of the account being demoted is passed as the second argument ($1).

<key>DemoteScriptPath</key>
<string>/path/to/demote_script.sh</string>

NOTE

The script must be executable and should complete quickly to avoid delaying the elevation process. Ensure the script has appropriate permissions and is located in a secure directory. Scripting features also requires UseSystemExtension to be set to true.

Demote script hash

• Availability: Premium
• Version: 2.4+
• Type: String

Optionally provide the SHA256 hash of the demotion script specified in DemoteScriptPath. When configured, Elevate24 will verify the script's integrity before execution and refuse to run it if the hash does not match, protecting against unauthorised modification of the script.

<key>DemoteScriptHash</key>
<string>sha256hashofscript</string>

Allow user defined scripts

• Availability: Premium
• Version: 2.4+
• Type: Boolean
• Default: false

When enabled, allows users to specify their own elevation and demotion script paths in addition to any admin-defined scripts. If scripts are configured at both the admin and user level, all scripts will execute. When disabled, only admin-defined scripts (ElevateScriptPath and DemoteScriptPath) will be used.

<key>AllowUserDefinedScripts</key>
<true/>

CLI support

• Availability: Basic & Premium
• Version: 2.5.0+
• Type: Boolean
• Default: false

NOTE

CLI elevation is compatible with deployments using Apple Auth. It is not compatible with deployments using OTP auth, nor with elevation of a secondary account. Verify compatibility across your entire configuration before rolling out to production.

When enabled, allows user to elevate from the command line with 'elevate24' and the following arguments:

Argument	Description
	No argument - prints available arguments with example, does not elevate session
-e	Elevates user session to the shortest configured session time or 15 minutes if none are configured
-t	Elevates user session for a sepcified number of minutes (valid inputs are 1 - maximum pre-configured session time or 15 minutes if no session times configured)
-r	Define a custom elevation reason. If undefined, users will be prompted to choose from the pre-defined list of reasons

<key>AllowCliElevation</key>
<true/>

CLI example

elevate24 -e -t 60 -r "App Install"

Disable user elevation

• Availability: Basic & Premium
• Version: 2.5.0+
• Type: Boolean
• Default: false

When enabled, the Elevate24 menubar UI is hidden and cannot be launched manually from /Applications. End users will have no visible way to request elevation, view their session status, or interact with Elevate24 directly. The underlying agent continues to run in the background, enforcing session policies and authorisation rules as normal.

This is typically used for deployments where elevation is granted exclusively via CLI (see AllowCliElevation) or through MDM-triggered workflows.

<key>DisableUserElevation</key>
<true/>