Checkout policies

The Checkout policies section found in Administration – Privileged access management (PAM) – Checkout policies allows administrators to create and edit separate policies for Privileged Access Management (PAM) checkout. Checkout policies can then be applied to specific entries and folders (edit, then Properties – Checkout policies), or configured to be applied by default to everything.

Option	Description
Name	Set a name for the checkout policy.
Is default	Apply the checkout policy to every PAM entry/folder by default.
Checkout mode	Enable or disable checkouts altogether.
Approval mode	Define which requests require approval, if any.
Users can approve their own checkout requests	Choose whether users can approve their own requests, and under which condition.
MFA on checkout	Require multifactor authentication when checking out an entry. The options are: Default, None, Mandatory, or Mandatory on JIT elevation only. Users must have MFA enabled in the Devolutions Portal under Sign-in & security for MFA to be enforced on checkout.
Checkout reason	Choose under which conditions users need to provide a reason for checking out an entry.
Ticket number mode	Determine under which conditions the Ticket # field is required to be filled, if at all, when checking out an entry.
Check out time (minutes)	Set a default checkout duration in minutes.
Max check out time (minutes)	Set a maximum checkout duration. This is also the upper bound for the total duration of a checkout once extensions are applied.
Terminate sessions on check in	Force session termination when the account is checked in.
Allow checkout extensions	Allow users to request additional time on an active checkout instead of checking in and submitting a new request. Disabled by default.
Require approval for extensions	Choose whether checkout extension requests must be approved, or are granted automatically.
Maximum extension duration (minutes)	Set the maximum additional time that can be granted for a single extension request.