PAM permissions
In Devolutions Cloud, PAM accounts live side by side with regular entries in the same vault.
Add vault
The Add vault system permission allows users to add any vault, including a vault that holds PAM accounts.
Vault, folder, and entry permissions
When the Devolutions Cloud workspace holds a PAM license, the permissions of vaults, folders, and entries include a Privileged access management (PAM) group. This group contains the Manually create PAM account permission and the Approve checkout permission, named Approve checkout request on a vault.
To set permissions on an entry or a folder, select it, click Edit, then go to Security – Permissions.
To set permissions on the vault root, open the vault with Edit vault in the vault selector, or in Administration – Vaults, then go to the Security tab.
Manually create PAM account
Creating a PAM account requires the Manually create PAM account permission. Other PAM permissions do not grant this ability, so it must be granted explicitly. Administrators can create PAM accounts without it. The permission can be granted at the following levels:
In the system permissions
On a vault, which allows creating PAM accounts for the providers stored in that vault
On a provider
PAM license and interface visibility
A PAM license is not required to create a vault. It is required for any write action on PAM entities, such as creating or editing a PAM account or a PAM provider, or changing PAM administration settings.
When the workspace holds a PAM license, the entry form displays a Privileged access management (PAM) section. In Administration – Modules, the Privileged access management (PAM) module is displayed to users who hold a PAM system permission.
See also
Last updated
Was this helpful?