> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/pam/pam-with-devolutions-cloud/pam-vaults.md).

# PAM vaults

Create and configure PAM vaults in Devolutions Cloud, setting visibility, checkout policy, and password rotation rules for privileged accounts.

PAM vaults are one of the key features of Devolutions Cloud's privileged access management module. They are secure vaults that allow admins to manage their different privileged accounts. PAM accounts live side by side with regular entries in the same vault. PAM content is identified by its shield indicator, and the [content type](https://docs.devolutions.net/cloud/web-interface/ui-customization/vault-content-types) of a vault can be changed to another type.

### Security level

PAM accounts and PAM providers can only be added to a vault that uses the ***High*** security level, and they are not allowed in a user vault. The ***High*** security level prohibits offline mode.

* Setting the content type of a vault to PAM requires the ***High*** security level.
* The security level of a vault that holds PAM accounts cannot be lowered to ***Standard***.
* PAM encryption keys are not included in the data retrieved for offline mode.

### Vault list

PAM vaults appear in the vault list of every user who can access them.

{% hint style="info" %}
For the permissions that apply to PAM vaults and PAM accounts, see [PAM permissions](/pam/pam-with-devolutions-cloud/pam-permissions.md).
{% endhint %}

### PAM vault creation

Creating a PAM vault via the Devolutions Cloud web interface is not that much different from creating a regular vault. In ***Administration – Vaults***, click on ***Add (+)***, then ***Add PAM vault***.

### PAM vault setup

Once this is done, the setup window for a new PAM vault should appear.

Start by entering a ***Name*** for the PAM vault (mandatory) and a ***Description*** (optional). Then, set its visibility:

* ***Default***: Refers to the system-wide vault visibility set in ***Administration – Configuration & Security – System Settings – Vault***.
* ***Private***: A private PAM vault is not visible to users that do not have access to it. Thus, vault access requests cannot be performed. It can only be accessed on invitation.
* ***Public***: A public vault is visible to all users of the workspace, even to those who do not have access to it. A user can request access to the public vault.

{% hint style="info" %}
For more information on vault access and visibility, visit [Vault access in Devolutions Cloud](https://docs.devolutions.net/cloud/web-interface/vault-access-in-devolutions-cloud).
{% endhint %}

Then, set the vault's PAM checkout policy.

And its PAM password rotation policy.

In the ***Password Settings***, choose whether to use the provider's password policy or select a custom one.

{% hint style="warning" %}
When using a custom policy, make sure it follows the provider's password policies.
{% endhint %}

When clicking ***Add***, the new PAM vault will be created. It can then be found in ***Administration – Vaults***. The number of PAM vaults is also displayed at the top.

All the vaults can be accessed via the vault selector in the ***navigation pane***.

{% hint style="info" %}
The next step is to add privileged accounts to the new PAM vault. Visit [Privileged accounts](/pam/pam-with-devolutions-server/privileged-accounts.md) for more information.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/pam/pam-with-devolutions-cloud/pam-vaults.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.