> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/pam/knowledge-base/how-to-articles/configure-a-pam-provider-to-rotate-its-own-password.md). # Configure a PAM provider to rotate its own password Configure a Devolutions PAM provider to rotate its own password with a managed PAM account, or by linking an existing PAM account. A PAM provider can rotate its own password through a ***Managed PAM account***. This account holds the credentials the provider uses for discovery, heartbeat and rotation. It is created as a sub-entry of the provider, and its password is rotated automatically on the provider's schedule. {% hint style="info" %} Self-rotation is available for every PAM provider type except ***Entra ID User***, ***SSH key*** and custom PAM providers. It is also unavailable for sub-providers. {% endhint %} ## Enable self-rotation when creating a provider 1. Create a PAM provider in [Devolutions Server](/pam/pam-with-devolutions-server/getting-started/add-a-pam-provider.md) or [Devolutions Cloud](/pam/pam-with-devolutions-cloud/providers.md), and enter its username and password. 2. Click ***Save***. The ***Set up credentials for*** window opens. 3. Select ***Manage with self-rotation***, the ***Recommended*** option. 4. Click ***Save***. To leave the credentials on the provider itself, select ***Keep credentials in the provider*** instead. No PAM account is created and the password is not rotated automatically. Clicking ***Skip for now*** also leaves the credentials on the provider. ## Convert an existing provider A provider that holds its own custom credentials can be converted to a managed PAM account at any time. 1. Open the provider and click ***Edit***. 2. Under ***Credential type***, make sure ***Custom*** is selected. 3. Click ***Convert to managed PAM account***. For Devolutions Server, the same conversion is available in PowerShell with [Enable-DSPamProviderSelfRotation](https://docs.devolutions.net/powershell/powershell-commands/enable-dspamproviderselfrotation). ## Manage the managed PAM account The managed PAM account is named after the provider's username and carries the description ***Used as provider's own credentials***. In Devolutions Cloud, a provider without a username gives its name to the account instead. In Devolutions Server, the account is stored in the global PAM vault. In Devolutions Cloud, it is stored in the same vault as the provider. Expand the provider in the providers list to view the managed PAM account. From there, the account can be edited, its password reset with ***Reset password***, its heartbeat run with ***Heartbeat***, and the account checked out or checked in. Its ***Password rotation schedule*** and ***Heartbeat schedule*** are also displayed. In Devolutions Server, its ***Password history*** is also available. In Devolutions Cloud, the providers list of the global PAM vault shows the managed PAM account this way. For a provider in another vault, the managed PAM account is a sub-entry of the provider, and the provider's ***Credentials*** section links to it with ***Go to***. The managed PAM account follows its provider. It cannot be moved on its own. In Devolutions Cloud, a PAM provider and its managed PAM account cannot be moved to another vault. {% hint style="warning" %} Changing the provider's ***Credential type*** or selecting another credential deletes the managed PAM account when the provider is saved. A confirmation message appears before the change is applied. {% endhint %} ## Link an existing PAM account A provider can also use a PAM account that already exists in a PAM vault. 1. Open the provider and click ***Edit***. 2. Under ***Credential type***, select ***Linked credential*** in Devolutions Server, or ***Privileged account*** in Devolutions Cloud. 3. In Devolutions Cloud, select the vault holding the account in ***Linked vault***. 4. Select the account in ***Linked credential***, then ***Save*** the provider. The provider password can then be rotated manually with the account's ***Reset password*** button, or on a schedule by setting the account's ***Password rotation schedule***. #### See also * [Devolutions Academy - Configuring an Active Directory Provider](https://academy.devolutions.net/student/path/2354099/activity/3423446) * [Devolutions Academy - Configuring an Entra ID Provider](https://academy.devolutions.net/student/path/2354099/activity/3423447) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.devolutions.net/pam/knowledge-base/how-to-articles/configure-a-pam-provider-to-rotate-its-own-password.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.