> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/pam/pam-with-devolutions-cloud/pam-permissions.md). # PAM permissions Configure PAM permissions in Devolutions Cloud, including the Manually create PAM account permission, the PAM permission group, and PAM license requirements. In Devolutions Cloud, PAM accounts live side by side with regular entries in the same vault. ## Add vault The ***Add vault*** system permission allows users to add any vault, including a vault that holds PAM accounts. ## Vault, folder, and entry permissions When the Devolutions Cloud workspace holds a PAM license, the permissions of vaults, folders, and entries include a ***Privileged access management (PAM)*** group. This group contains the ***Manually create PAM account*** permission and the ***Approve checkout*** permission, named ***Approve checkout request*** on a vault. * To set permissions on an entry or a folder, select it, click ***Edit***, then go to ***Security*** – ***Permissions***. * To set permissions on the vault root, open the vault with ***Edit vault*** in the vault selector, or in ***Administration*** – ***Vaults***, then go to the ***Security*** tab. ## Manually create PAM account Creating a PAM account requires the ***Manually create PAM account*** permission. Other PAM permissions do not grant this ability, so it must be granted explicitly. Administrators can create PAM accounts without it. The permission can be granted at the following levels: * In the [system permissions](https://docs.devolutions.net/cloud/web-interface/administration/configuration-and-security/system-permissions) * On a vault, which allows creating PAM accounts for the providers stored in that vault * On a provider ## PAM license and interface visibility A PAM license is not required to create a vault. It is required for any write action on PAM entities, such as creating or editing a PAM account or a PAM provider, or changing PAM administration settings. When the workspace holds a PAM license, the entry form displays a ***Privileged access management (PAM)*** section. In ***Administration*** – ***Modules***, the ***Privileged access management (PAM)*** module is displayed to users who hold a PAM system permission. ## See also * [PAM vaults](/pam/pam-with-devolutions-cloud/pam-vaults.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.devolutions.net/pam/pam-with-devolutions-cloud/pam-permissions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.