> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/understanding-securepass/capabilities-overview.md).

# Capabilities overview

What SECUREpass does, grouped the way the console is organised.

## Identity management

Onboarding from AD, LDAP, Azure AD, Excel and JSON, or by hand. Self-registration and SCIM. Groups, departments and branches. Roles and entitlements. Joiner-mover-leaver lifecycle automation. Dormant account detection and handling.

## Authentication

Single sign-on for web and mobile applications over SAML 2.0, OpenID Connect, OAuth 2.0, agentless desktop SSO (Kerberos and NTLM), header-based authentication and RADIUS. Multi-factor authentication across password, OTP, hardware token, certificate, biometric, push, GRID and QR modes. Adaptive, risk-based authentication driven by an anomaly-detection model over device, location, time and session behaviour.

## Access management

Application onboarding and configuration. Role-based, attribute-based and time-based access control. Dynamic groups. Risk profiles. Access request and approval workflows.

## Security policy

Password and MFA policies. Geo-fencing and geo-tagging. Session controls. User entitlements. Dormant user policies. Bot protection. Blocked settings by IP, location, browser and operating system.

## Governance

Access reviews and certifications. Entitlement and role management. Policy enforcement and segregation of duties. Access requests and workflow automation. Identity lifecycle management. Auditing, reporting, analytics and risk management.

## Agentic identity

Verifiable identity for non-human callers — scripts, workloads and AI agents — issued as SPIFFE identities. Agentic Services with their own policies, credential lifetimes and sub-agent limits. Scoped delegation through sub-agents that cannot exceed their parent. Runtime allow or deny decisions on every agent request, and a full audit trail of those decisions.

## Privileged access

Windows, Linux, UNIX, AIX and Solaris systems. Databases through a proxy. Cloud resources across AWS, Azure and GCP. Network devices. Credential vaulting with automated rotation. Session recording and live monitoring. Command filtering. Just-in-time elevation. Privileged identity lifecycle.