> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/privileged-access-pam-setup.md).

# Privileged access (PAM) setup

Privileged Access Management controls and monitors access to the accounts that run your estate — administrator accounts, root accounts, database superusers, network device enable secrets, and application service accounts.

This step covers standing that up: connecting the targets, vaulting the credentials, deciding who reaches what, and recording what happens.

## The problem it solves

Privileged credentials are the operational primitive on which every IT estate runs, and consistently the asset class most associated with high-impact security incidents. Three patterns make them hard to control:

* **The privileged population grows non-linearly with system count.** Every new server, database and network device adds more than one privileged account.
* **The population is heterogeneous.** Humans, services, scheduled jobs and autonomous workloads all hold privilege, and they behave nothing alike.
* **Credentials persist.** Standing privilege accumulates over time because nothing forces it to lapse.

SECUREpass PAM addresses all three across the full population of privileged identities — human and non-human, on-premises and cloud.

## Where PAM sits in SECUREpass

PAM is a module of the wider SECUREpass platform, not a separate product. The privileged user, the standard user and the administrator are administered against the same directory, with the same authentication factors, the same approval workflows and the same audit log. That is why a privileged session and an ordinary login land in the same audit trail.

Deeper architecture — the plane model, trust zones, components, deployment models and the full role catalogue — is covered in the Reference section under *Privileged access and privileged identity*.

## Key concepts

| Term                 | Meaning                                                                                                            |
| -------------------- | ------------------------------------------------------------------------------------------------------------------ |
| Privileged account   | An account with elevated rights, managed through SECUREpass                                                        |
| Credential vault     | Where privileged secrets are stored; cryptographic protection at rest is delegated to an external HSM or key vault |
| Checkout and checkin | Requesting time-limited use of a credential, then returning it                                                     |
| Credential injection | The gateway supplies the credential to the target so the user never sees it                                        |
| Session recording    | Capture of the privileged session for audit and forensics                                                          |
| Just-in-time access  | Elevating privilege only when needed, for a limited time, then revoking automatically                              |
| Break-glass          | Emergency access without the normal approval path, fully audited                                                   |
| Dual control         | A second person must approve before a session can start                                                            |

## PAM and PIM

The two are complementary layers over the same population.

**PAM controls what an authenticated privileged user can do** — which targets they reach, what happens in the session, which commands are permitted, what gets recorded.

**PIM controls who the privileged identities are** — what entitlements they hold, how those are reviewed and certified, and how the identity lifecycle is administered.

## Order of work

{% stepper %}
{% step %}

### Onboard the resource

Connect the target system, database, cloud resource or network device.
{% endstep %}

{% step %}

### Vault the credential

Set its rotation policy.
{% endstep %}

{% step %}

### Map users to the resource

Ensure the right people can reach it and no one else can.
{% endstep %}

{% step %}

### Connect

Connect from the Self Service Portal to confirm the path works end to end.
{% endstep %}

{% step %}

### Review the recording

Confirm the session was captured.
{% endstep %}
{% endstepper %}

The end-to-end page below walks all five with screenshots. The pages after it cover each area in depth.

## In this section

| Page                                    | What it covers                                                     |
| --------------------------------------- | ------------------------------------------------------------------ |
| Setting up privileged access end to end | The five steps above, with screenshots                             |
| Connecting target systems               | Onboarding systems, databases, cloud resources and network devices |
| Privileged account vault                | Vaulting, rotation, checkout and break-glass                       |
| Session management and recording        | Recording by target type, live monitoring and playback             |