> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/pam/pam-with-devolutions-server/pam-permissions.md).

# PAM permissions

Configure PAM permissions in Devolutions Server, including the Manually create PAM account right and checkout, approval, and reset password rights.

In Devolutions Server, PAM accounts live side by side with regular entries in the same vault. PAM content is identified by its shield indicator, and the content type of a vault can be changed to another type.

## Security level

PAM accounts and PAM providers can only be added to or imported into a vault that uses the ***High*** security level, and they are not allowed in a user vault.

* Setting the content type of a vault to PAM requires the ***High*** security level.
* A vault that holds PAM accounts or PAM providers cannot be set to the ***Standard*** security level.

## Vault management

PAM permission sets are managed in the standard [Vault management](https://docs.devolutions.net/server/web-interface/administration/configuration/system-settings#vault-management) settings.

## Root and folder permissions

Because a root or a folder can hold both regular entries and PAM accounts, the permission tabs on vault roots and folders show both the regular right set and the PAM right set. On an individual entry, the right set that is displayed follows the type of that entry.

To set permissions on a folder, go to ***Properties*** – ***Security*** – ***Permissions***.

### PAM-only settings

|                              |                                                                                                                                                                    |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Reset password**           | Allow every user (or specific ones if ***Custom*** is chosen) to reset PAM entries' passwords in accordance with their ***Password template mode***.               |
| **Approve checkout request** | Allow every user (or specific ones if ***Custom*** is chosen) to approve demands for checkout on PAM entries, including requests to extend an active checkout.     |
| **Force checkin**            | Allow every user (or specific ones if ***Custom*** is chosen) to force other users to checkin PAM entries.                                                         |
| **Checkout**                 | Allow every user (or specific ones if ***Custom*** is chosen) to checkout PAM entries. This also allows users to request extensions on their own active checkouts. |
| **Read logs**                | Allow every user (or specific ones if ***Custom*** is chosen) to read PAM entries' logs.                                                                           |

## Manually create PAM account

Creating a PAM account requires the ***Manually create PAM account*** right. Other PAM rights do not grant this ability, so it must be granted explicitly.

The right can be granted at the following levels:

* Workspace
* Vault
* PAM provider

{% hint style="info" %}
Standalone accounts and certificate accounts do not require this right, because they are not linked to a PAM provider.
{% endhint %}

## PAM license and interface visibility

A PAM license is not required to create a vault. It is required for any write action on PAM entities, such as creating or editing a PAM account or a PAM provider, or changing PAM administration settings.

PAM menus, widgets, and dashboards are displayed when the Devolutions Server instance holds a PAM license, regardless of whether the user has access to a PAM vault. The rights for each action apply.

PAM vaults appear in the vault list of every user who can access them.

## See also

* [PAM vaults](/pam/pam-with-devolutions-server/pam-vaults.md)
* [Devolutions Academy - Simplifying Privileged Access Management with Devolutions PAM](https://academy.devolutions.net/student/path/2007290/activity/3070848)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/pam/pam-with-devolutions-server/pam-permissions.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.