Platform Permissions

Access Offline Secrets on Mobile

User can cache their Secrets in the Secret Server mobile application for offline use. This permission does not automatically come with the Administrator role.

Activate PRA Engine

Activate Remote Access OnPrem engine

Add Custom Audit Entry for Secrets

Make a custom audit entry when accessing a Secret using the web services API.

Add Federation Profile

Add a federation profile

Add Group Role Assignment

Assign groups to roles

Add PRA Engine

Add Remote Access OnPrem engine

Add Roles

Add roles

Add Secret

Create new Secrets. The Add permission no longer includes the role permission, View Secret.

Add Secret Server Templates

Add Secret Server templates

Add User Role Assignments

Assign users to roles

Administer Analytics

View and edit the settings for analytics.

Administer Analytics Challenge

Allows user to be challenged by analytics if their behavior deviates from their normal behavior and meets requirements specified by analytics. Administrators do not have this permission by default.

Administer Application Accounts in Secret Server

Create application user accounts to be used exclusively for accessing Secret Server via the API. Formerly Create Application Account.

Administer Audit Data Retention

Manage audit data retention, such as editing and running now. This permission does not automatically come with the Administrator role.

Administer Auto Export

Do everything the other automatic export permissions allow and edit the automatic export configuration.

Administer Custom Columns on Secret Templates

Enable the Expose for Display setting of a Secret template field to make it available for use in Dashboard custom columns

Administer Custom Password Requirements

View and edit custom password requirements that can be configured under the Security tab for individual Secrets.

Administer Devops Secret Vault Tenants

Add, remove, and edit DSV tenants that automatically synchronize with Secret Server on a schedule.

Administer Disaster Recovery

Configure instances as data sources or replicas for Disaster Recovery; initiate or test Data Replication and view related logs and audits.

Administer Discovery

View and import computers and accounts that are found by Discovery.

Administer Distributed Engine Configuration

Update the Distributed Engine configuration.

Administer DoubleLock Keys

View, edit, create, and disable DoubleLock keys. A DoubleLock key acts as a separate encryption key to protect your most sensitive secrets. This option allows users to access and use the DoubleLocks link on the Administration page.

Administer Dual Control Settings

View, edit, create, and disable Dual Control settings for reports and recorded sessions.

Administer Event Subscriptions

View, edit, and create event subscriptions.

Administer Export

View the export log AND export Secrets to which they have access to a clear text, CSV file.

Administer Groups

View, edit, create, and disable groups. Also allows users to assign users to groups and remove users from groups.

Administer HSM Configuration

Change configuration or disable the use of a Hardware Security Module (HSM).

Administer Inbox

Administer notification settings for the inbox.

Administer IP Addresses

Create, edit, and delete IP Address Ranges. These ranges are used to restrict certain users to specific IP Addresses.

Administer Jumpbox

Create, edit, or deactivate jump server routes.

Administer Key Management

Enable, change, or disable the Key Management (Secret Server Cloud only).

Administer Licenses

View, edit, install, and delete licenses.

Administer Platform Integration

Manage the Secret Server connection to the Delinea Platform.

Administer Radius Server Configuration

Manage radius client settings

Administer Remote Password Changing Settings

Turn Heartbeat and Remote Password Changing on and off globally. Also allows users to create new password changers and install password changing agents on remote machines.

Administer Secret Encryption Key Rotation

Start a process that rotates the Secret encryption keys.

Administer Secret Policy

Create and edit Secret Policies.

Administer Secret Server Configuration

View and edit general configuration options. For example, a user with this role permission can turn on Force HTTPS/SSL and disable Allow Remember Me.

Administer Secret Server Data

Manage metadata fields and sections added to secrets and users in Secret Server.

Administer Secret Server Folders

Allows a user to view, edit, create, move, and delete folders. Users still need the relevant view, edit, and owner permissions on the folders to perform these tasks.

Administer Secret Server Lists

Add, remove, and modify lists and list contents in Admin > Lists.

Administer Secret Server Maintenance

Administer Secret Server Maintenance

Administer Secret Server Password Requirements

View and edit character sets and password requirements.

Administer Secret Server Pipelines

Create, edit, and remove event pipelines and event pipeline policies.

Administer Secret Server Reports

View, edit, delete, and create reports. Also allows users to customize report categories.

Administer Secret Server Scripts

View, edit, and add PowerShell, SQL, and SSH scripts on the Scripts Administration page.

Administer Secret Server Security Configuration

View and edit security configuration options in Secret Server. Currently, these include enabling FIPS compliance mode and protecting the encryption key. Formerly Administer Security Configuration.

Administer Secret Server SSH Proxy Configuration

View and edit SSH Proxy settings.

Administer Secret Server System Logs

View and clear the System Log, which shows general diagnostics information for Secret Server.

Administer Secret Server Teams

Create, delete, and view all teams.

Administer Secret Templates

View, edit, disable, and create Secret Templates.

Administer Session Recording Configuration

View and edit session recording settings on the Session Recording tab of Configuration settings.

Administer session recordings

View and terminate active launcher sessions.

Administer SSH Cipher Suite

View and edit the SSH Cipher Suite

Administer SSH Menus

Create and edit SSH Menus, used in allowlisting commands that can be used on a SSH session.

Administer Users

Create, disable, and edit users in the system.

Administer Workflows

Manage workflows (advanced access management).

Advanced Import

Import Secrets from an XML file. Users with the this permission can import groups, folders, site connectors, sites, and secret templates, without having to create a secret. Users must have the Secret Server permissions needed for the objects listed in the XML.

Allow List Secret Access For Assigning Policy

Users with list access to a secret can assign policies. Users need the view permission if they do not have this one.

Approve Registration

Approve a Registration

Approve Via DUO Push

Approve access requests via Duo push notifications. Administrators do not have this permission by default.

Assign Secret Policy

Assign Secret Policies to folders and secrets.

Assign Secret Server Pipelines

Assign an event pipeline policy to secret policies, or folders.

Audit Secret Server Session Recordings

Users with at least List Access permission on a secret can access the session recording of the secret. Administrators do not have this permission by default.

Browse Secret Server Reports

Access reports restricted by permissions. Permissions are configurable at the category and report levels and share a similar inheritance model to secrets and folders. You can define users or groups with view or edit permissions for each category or report.

Bypass Direct API Authentication Restriction

Ignore the PreventDirectApiAuthentication advanced setting and log in via the API with a non-application account

Bypass SAML Login

Log in with local account without using SAML (Secret Server specific)

Configure Secret Server integration

Configure Secret Server integration

Copy Secret

Copy secrets when the user also has Own Secret role permission.

Create a Site

Create a new site.

Create Engine

Create a new engine.

Create Engine Pool Group

Create a new engine pool group.

Create Policy

Create Policies

Create PRA Site

Create a new Remote Access site to install engines

Create Registration Code

Create a Registration Code

Create Root Folders in Secret Server

Create new folders at the root level of the folder structure

Create Users

Create new local users in Secret Server, but not edit them once created.

Deactivate Secret

Mark secrets as deactivated.

Deactivate a Secret within a Report

Run the delete Secrets action from a report.

Delete a Site

Delete a site.

Delete Engine

Delete an engine.

Delete Engine Pool Group

Delete an engine pool group.

Delete Federation Profile

Delete a federation profile

Delete Group Role Assignment

Remove groups from roles

Delete Policy

Delete Policies

Delete PRA Engine

Delete Remote Access OnPrem engine

Delete PRA Site

Delete Remote Access site

Delete Roles

Delete roles.

Delete Secret Server Templates

Delete Secret Server templates

Delete User Role Assignment

Remove users from roles.

Download Auto Export

View all automatic export tabs and download exports from cloud storage (cloud customers only)

Edit Policy

Edit Policies

Edit Session Recording AIDA Settings

Access AIDA setting page

Enable Policy

Enable Policies

Enable Unlimited Administrator in Secret Server

Turn on Unlimited Admin Mode. When this mode is enabled, users with the Unlimited Administrator role permission can view and edit all Secrets in the system, regardless of permissions. Note that you can assign Administer Unlimited Admin Configuration to one user and Unlimited Administrator to another user. This would require one user to turn on the mode and another user to view and edit secrets. Formerly Administer Unlimited Admin Configuration.

Erase Secret

Permanently erase a secret (as opposed to deactivate a secret, which is reversible)

Expire Secrets from Reports

Expire Secrets listed in a report.

Generate a Device Code

Generate a Device Code

Launch PRA Session

Launch a Remote Access session

Launch Secret in Secret Server

Launch a secret. Previously, a user could launch a secret if their user role had the View Secret permission. As of Version 11.5, a user needs this permission to launch. A user will also need the Secret Launch Remote Access (Platform) permission to be able to launch

List Engine Pool Groups

View summary information about all engine pool groups.

List Engines

View summary information about all engines.

List Registration Codes

View summary information about all registration-codes

List Registrations

View summary information about all registrations for a registration-code

List Sites

See and choose sites through the platform UI, such as in a dropdown list of sites in the PRA setup page. This permission does not grant the ability to view and modify sites through the Engine Management page. For that, the Manage Sites permission is required.

List Workload Definitions

View summary information about all workload-definitions

Manage Identity settings

Manage all Identity related settings such as users, groups, policies and more

Manage Sites

View summary information about all sites and make changes.

Own Secret

Perform advanced tasks on secrets the user “owns,” such as configuring expiration schedules, configuring the web launcher, converting secret template, and copying secrets

Personal Folder in Secret Server

Have personal folder when the global personal folders configuration options is enabled.

Publish Audit event

Create and publish audit event

Read Audit event

Read audit events

Read Federation Profile

Read federation profiles

Read Own Audit events

Read own audit events

Register a Workload

Register a Workload with a Registration Code

Retrieve a Registration

Read detailed information (including sensitive information) about individual registrations

Retrieve Engine

Read detailed information about an engine.

Retrieve Engine Pool Group

Read detailed information about an engine pool group.

Retrieve Registration Code

Read detailed information (including sensitive information) about individual registration-codes

Retrieve Site

Read detailed information about a site.

Retrieve Workload Definition

Read detailed information (including sensitive information) about individual workload-definitions

Run Auto Export

View all automatic export tabs and run the export manually by clicking the Run Export button.

Run Disaster Recovery Replication

Initiate or test Data Replication.

Run Secret Server Scripts

Separates privileges in script management. Holders of the View Scripts role permission cannot execute test runs of scripts, and this permission must be assigned to perform this task.

Secret Force Check In

Force a secret that is checked out by another user to be checked in.

Secret Server Web Services Impersonate

Send an approval request to act as another user within their organization when accessing Secret Server programmatically. Administrators do not have this permission by default.

Unlimited Administrator in Secret Server

View and edit all secrets in the system, regardless of permissions, when Unlimited Admin Mode is on. Note that another user with the Administer Unlimited Admin Configuration role permission would still need to turn this mode on.

Unrestricted by Teams in Secret Server

View all users, groups, and sites, regardless of team affiliation. Essentially, teams do not exist for the users with this permission, and the Teams page is not available to them. The default user role has this permission.

Update a Site

Edit a site

Update All Session Recordings

Comment and tag session recordings

Update Audit event

Update audit event

Update Audit Setting

Update audit setting

Update Engine

Edit an engine.

Update Engine Pool Group

Edit an engine pool group.

Update Federation Profile

Update a federation profile

Update PRA Engine

Upgrade Remote Access OnPrem engine

Update PRA Site

Update Remote Access site

Update Roles

Modify Roles.

Update Tenant Profile

Edit and update any information under the Tenant Profile page. This permission is not additive, so by only having the "Update Tenant Profile" permission, you do NOT get the ability to also see the data.

User Audit Expire Secrets

View the User Audit report, which shows all secrets accessed by a particular user in a specified date range. Also allows the user to force expiration on all these secrets, which would make Secret Server automatically change the password.

View Advanced Secret Options

View the Remote Password Changing, Security, and Dependency tabs on a Secret they have access to.

View All Session Recordings

View all session recordings

View Analytics

View, but not edit, settings for analytics.

View Audit Data Retention

View retained audit data. This permission does not automatically come with the Administrator role.

View Audit Settings

View audit settings

View Auto Export

View all automatic export tabs.

View All Computers

View computer assets

View Devops Secret Vault Tenants

View (not edit) the DSV tenants set to synchronize with Secret Server.

View Disaster Recovery

View configuration, logs and audits for Disaster Recovery.

View Discovery

View, but not edit, computers and accounts that are found by Discovery.

View Distributed Engine Configuration

View the Distributed Engine configuration.

View DoubleLock Keys

View which DoubleLock keys exist in the system.

View DownloadCenter

View the Download Center page.

View Dual Control Settings

View configured Dual Control settings for reports and Secret sessions.

View Enterprise Objects

View user and secret metadata.

View Event Subscriptions

View event subscriptions.

View Export

View the export log of the system to see when users exported secrets. Does not allow a user to export.

View Group Role Assignment

View roles assigned to groups.

View Groups

See which groups exist in the system, and which users belong to each group.

View HSM Configuration

View the Hardware Security Module (HSM) configuration settings.

View Identity settings

View Identity related settings such as users, groups, policies, and more

View Inactive Secrets

View Secrets that have been deleted in the system.

View IP Addresses

View IP Address Ranges that have been created to restrict access. Does not allow a user to edit these ranges.

View Jumpbox

View the details of all jump server routes in the Admin Jumpbox Route page but not make any changes.

View Key Management

View the Key Management settings (Secret Server Cloud only).

View Launcher Password on Secrets

Unmask the password on the view screen of secrets with a launcher. Typically, this includes Web Passwords, Active Directory accounts, Local Windows accounts, and Linux accounts.

View Licenses

View, but not edit, the licenses in the system.

View Marketplace

View the marketplace

View Marketplace Download Center

View, Download Delinea Tools, Connectors, etc. from Marketplace Download Center

View OpenID Connect

View OpenID Connect integration settings in the Configuration Login tab

View Other User/Group Permissions

Read the permissions of other users and groups.

View Own Session Recordings

Open and view their personal session recordings

View Permissions

View permissions.

View Platform Groups

View Platform Groups

View Platform Integration

View the Secret Server connection to the Delinea Platform.

View Platform Users

View Platform Users

View Policy

View Policies

View Radius Server Configuration

View radius client settings

View PRA Engine

View Remote Access OnPrem engine

View PRA Site

View Remote Access Site

View Remote Password Changing Settings

View, but not edit, Heartbeat and Remote Password Changing settings

View Roles

View roles.

View Secret

View secret. If disabled a user cannot view secrets regardless of the secret permission.

View Secret Audit

View Secret Audit.

View Secret Password and Private Key History

View the history of passwords, private keys, or passphrases in both old and new UI.

View Secret Policy

View, but not edit, Secret Policies.

View Secret Server Advanced Dashboard

View advanced dashboard. Without this permission, users will only be able to view basic dashboard.

View Secret Server Configuration

View, but not edit, general configuration settings.

View Secret Server Folders

View, but not edit, folders in the system.

View Secret Server integration

View Secret Server integration

View Secret Server Lists

View lists and list contents in Admin > Lists.

View Secret Server Password Requirements

View character sets and password requirements.

View Secret Server Pipelines

View event pipeline policies and policy activities.

View Secret Server Reports

View, but not edit, reports. See Browse Reports.

View Secret Server Scripts

View PowerShell, SQL, and SSH scripts on the Scripts Administration page.

View Secret Server Security Configuration

View the security configuration of Secret Server. Formerly View Security Configuration.

View Secret Server Security Hardening Report

View the Security Hardening Report.

View Secret Server SSH Proxy Configuration

View, but not edit, SSH Proxy settings.

View Secret Server System Logs

View (only) the System Log, which shows general diagnostics information for Secret Server.

View Secret Server Teams

View all teams. This is essentially a read-only Administer Teams.

View Secret Server Templates

View, but not edit, Secret Templates.

View Secret Server Templates

View Secret Server templates

View Secret Session Recording

View recorded sessions within Secret Server.

View Secrets

View Secrets to launch PRA Session

View Session Recording AIDA Analysis

Read AIDA results in session recording and for aida settings

View Session Recording Comments

Read comments in session recording

View Session Recording Configuration

View session recording settings on the Session Recording tab of Configuration settings.

View Session Recordings

View active launcher sessions.

View Session Recordings UI

Can view the Insights → Audit → Session Recordings UI

View SSH Cipher Suite

View (only) the SSH Cipher Suite

View SSH Menus

View existing SSH Menus, used in allow-listing commands that can be used on a SSH session.

View Unlimited Administrator Audit

View the Unlimited Admin Mode configuration and the Unlimited Admin Mode audit log. Formerly View Unlimited Admin Configuration.

View User Audit Report

View, but not edit, the User Audit Report.

View User Role Assignments

View roles assigned to users.

View Users

View which users exist in the system.

View Workflows

View, but not edit, workflows used for multi-tier secret-access approvals and secret erase requests.