Platform Permissions

Add Engine

Create a new engine.

Administer Analytics

View and edit the settings for analytics.

Administer Audit Data Retention

Manage audit data retention, such as editing and running now. This permission does not automatically come with the Administrator role.

Administer Discovery

View and import computers and accounts that are found by Discovery.

Administer Inbox

Administer notification settings for the inbox.

Administer Licenses

View, edit, install, and delete licenses.

Administer Session Recording Configuration

View and edit session recording settings on the Session Recording tab of Configuration settings. (Formerly also known as Administer Session Recordings.)

Approve Registration

Approve a registration.

Approve Via DUO Push

Approve access requests via Duo push notifications. Administrators do not have this permission by default.

Create a Site

Create a new site.

Create Command Group

Create command groups.

Create Granular Command

Create granular commands.

Create Policy

Create policies.

Create Registration Code

Create a registration code.

Delete a Site

Delete a site.

Delete Command Group

Delete command groups.

Delete Engine

Delete an engine.

Delete Granular Command

Delete granular commands.

Delete Policy

Delete policies.

Edit Command Group

Edit command groups.

Edit Granular Command

Edit granular commands.

Edit Policy

Edit policies.

Enable Policy

Enable policies.

Generate a Device Code

Generate a device code.

List Engines

View summary information about all engines.

List Registration Codes

View summary information about all registration codes.

List Registrations

View summary information about all registrations for a registration code.

List Sites

See and choose sites through the platform UI, such as in a dropdown list of sites in the PRA setup page. This permission does not grant the ability to view and modify sites through the Engine Management page. For that, the Manage Sites permission is required.

List Workload Definitions

View summary information about all workload definitions.

Manage All Collections

Manage all collections in the tenant.

Manage Entitlements

Manage entitlement assignments in access.

Manage Sites

View summary information about all sites and make changes.

Read Another Users Profile Settings

Read other users' profile settings (such as the profile image).

Register a Workload

Register a Workload with a registration code.

Retrieve a Managed Application Registration

Retrieve a managed application registration.

Retrieve a Registration

Read detailed information (including sensitive information) about individual registrations.

Retrieve Registration Code

Read detailed information (including sensitive information) about individual registration codes.

Retrieve Workload Definition

Read detailed information (including sensitive information) about individual workload definitions.

Update a Site

Edit a site.

Update Another Users Profile Settings

Update other users' profile settings (such as the profile image).

Update Engine

Edit an engine.

View All Collections

View all collections in the tenant.

View All Computers

The user can view all computers that the user is permitted to access in the tenant.

View Analytics

View, but not edit, settings for analytics.

View Audit Data Retention

View retained audit data. This permission does not automatically come with the Administrator role.

View Command Group

View command groups.

View Discovery

View, but not edit, computers and accounts that are found by Discovery.

View Engine

Read detailed information about an engine.

View Granular Command

View granular commands.

View licenses

View, but not edit, the licenses in the system.

View Policy

View policies.

View Session Recording Configuration

View session recording settings on the Session Recording tab of Configuration settings.

View Session Recording Comments

Read comments in session recording.

View Session Recordings

View active launcher sessions.

Activate PRA Engine

Activate Privileged Remote Access engine.

Add Federation Profile

Add a federation profile.

Add Group Role Assignment

Assign groups to roles.

Add PRA Engine

Add Privileged Remote Access engine.

Add Roles

Add roles.

Add Secret Server On Premises Templates

Add Secret Server On Premises templates. (Formerly Add Secret Server Templates.)

Add User Role Assignments

Assign users to roles.

Configure Secret Server On Premises integration

Configure Secret Server On Premises integration.

Create PRA Site

Create a new Remote Access site to install engines.

Delete Federation Profile

Delete a federation profile.

Delete Group Role Assignment

Remove groups from roles.

Delete PRA Engine

Delete Privileged Remote Access engine.

Delete PRA Site

Delete Privileged Remote Access site.

Delete Roles

Delete roles.

Delete Secret Server On Premises Templates

Delete Secret Server On Premises templates. (Formerly Delete Secret Server Templates.)

Delete User Role Assignment

Remove users from roles.

Read Federation Profile

Read federation profiles.

Update Federation Profile

Update a federation profile.

Update PRA Engine

Upgrade Privileged Remote Access engine.

Update PRA Site

Update Privileged Remote Access site.

Update Roles

Modify roles.

Update Tenant Profile

Edit and update any information under the Tenant Profile page. This permission is not additive, so by only having the "Update Tenant Profile" permission, you do not get the ability to also see the data.

View Group Role Assignment

View roles assigned to groups.

View Other User/Group Permissions

Read the permissions of other users and groups.

View Permissions

Grants a user permission to view permissions .

View Platform Groups

View platform groups.

View Platform Users

View platform users.

View PRA Engine

View Privileged Remote Access engine.

View PRA Site

View Privileged Remote Access Site.

View Roles

View roles.

View Tenant Profile

View tenant profile.

View Secret Server On Premises Integration

View Secret Server On-Premises integration. (Formerly View Secret Server integration.)

View Secret Server On Premises Templates

View Secret Server On-Premises templates. (Formerly View Secret Server Templates.)

Create Behavioral Analytics Notes

Create behavioral analytics notes.

Create Behavioral Analytics Settings

Create behavioral analytics settings.

Delete Behavioral Analytics Notes

Delete behavioral analytics notes.

Delete Behavioral Analytics Settings

Delete behavioral analytics events.

Manage Behavioral Analytics

Manage behavioral analytics settings.

Update Behavioral Analytics Alerts

Update behavioral analytics alerts.

Update Behavioral Analytics Notes

Update behavioral analytics notes.

Update Behavioral Analytics Settings

Update behavioral analytics settings.

View Behavioral Analytics

View the Behavioral Analytics page (Insights > Behavioral Analytics).

View Behavioral Analytics Alerts

View behavioral analytics alerts.

View Behavioral Analytics Events

View behavioral analytics events.

View Behavioral Analytics Notes

View behavioral analytics notes.

Add Session Recording Comments

Write comments in session recording. (Formerly Write Session Recording Comments.)

Modify Session Recording AIDA Settings

Access AIDA setting page.

Read Audit events

Read all administrative and privileged activity events.

Read Own Audit events

Grants a user permission to read their own administrative and privileged activity events.

View AIDA results

Read AIDA results in session recording.

View Authorized Session Recordings

Grants a user permission to vew all authorized session recordings. (Formerly View All Session Recordings or View Session Recordings UI.)

View Own Session Recordings

Grants a user permission to open and view their personal session recordings.

Access Delinea Expert

Chat with Delinea Expert.

Manage Checks

Manage posture checks.

Administer RADIUS Server Configuration

Manage RADIUS client settings.

Manage Identity settings

Manage all Identity-related settings such as users, groups, policies, and more.

View Identity settings

View Identity-related settings such as users, groups, policies, and more.

Customize Marketplace Integration View

Customize Marketplace integration view.

View Marketplace

Show Marketplace to the user.

View Marketplace Download Center

Show Marketplace Download Center to the user. (Formerly View Download Center.)

Close PRA session

Close a Privileged Remote Access session.

Create Remote Applications

Create remote applications.

Create Web Application

Create Web application.

Delete Remote Applications

Delete remote applications.

Delete Web Application

Delete web application.

Download files with PRA

Download a file from the target system during a remote access session.

Launch PRA Session

Launch a Privileged Remote Access session.

Launch Web Application

Launch web application.

Read Remote Applications

Read remote applications.

Read Web Applications

Read web applications.

Update PRA Configuration

Update Privileged Remote Access Configuration.

Update Remote Applications

Update remote applications.

Update Web Application

Update web application.

Upload files with PRA

Upload a file to the target system during a remote access session.

View PRA Configuration

View Privileged Remote Access Configuration.

Allow creating vaultbroker connection information

Create the vaultbroker connection information. Still requires an admin to log into SecretServer first and configure the platform configuration.

Access Offline Secrets on Mobile

User can cache their secrets in the Secret Server mobile application for offline use. This permission does not automatically come with the Administrator role.

Add Custom Audit Entry for Secrets

Make a custom audit entry when accessing a secret using the web services API.

Add Secret

Create new secrets. The Add permission no longer includes the role permission View Secret.

Add Users or Groups From Identity

Search for users and groups from Identity sources and add those users or groups to Secret Server.

Administer Analytics Challenge

Allows user to be challenged by analytics if their behavior deviates from their normal behavior and meets requirements specified by analytics. Administrators do not have this permission by default.

Administer Application Accounts in Secret Server

Create application user accounts to be used exclusively for accessing Secret Server via the API. Formerly Create Application Account.

Administer Auto Export

Do everything the other automatic export permissions allow and edit the automatic export configuration.

Administer Custom Columns on Secret Templates

Enable the Expose for Display setting of a secret's template field to make it available for use in Dashboard custom columns.

Administer Custom Password Requirements

View and edit custom password requirements that can be configured under the Security tab for individual secrets.

Administer Devops Secret Vault Tenants

Add, remove, and edit DSV tenants that automatically synchronize with Secret Server on a schedule.

Administer Disaster Recovery

Configure instances as data sources or replicas for disaster recovery; initiate or test data replication and view related logs and audits.

Administer Distributed Engine Configuration

Update the Distributed Engine configuration.

Administer DoubleLock Keys

View, edit, create, and disable DoubleLock keys. A DoubleLock key acts as a separate encryption key to protect your most sensitive secrets. This option allows users to access and use the DoubleLocks link on the Administration page.

Administer Dual Control Settings

View, edit, create, and disable Dual Control settings for reports and recorded sessions.

Administer Event Subscriptions

View, edit, and create event subscriptions.

Administer Export

View the export log and export secrets to which they have access to a clear text, CSV file.

Administer HSM Configuration

Change configuration or disable the use of a Hardware Security Module (HSM).

Administer Jumpbox

Create, edit, or deactivate jump server routes.

Administer Key Management

Enable, change, or disable the Key Management (Secret Server Cloud only).

Administer Platform Integration

Manage the Secret Server connection to the Delinea Platform.

Administer Platform Migration

Manage the Secret Server migration to the Delinea Platform.

Administer Remote Password Changing Settings

Turn Heartbeat and Remote Password Changing on and off globally. Also allows users to create new password changers and install password changing agents on remote machines.

Administer SSH Cipher Suite

View and edit the SSH Cipher Suite.

Administer SSH Menus

Create and edit SSH Menus, used in allowlisting commands that can be used on a SSH session.

Administer Secret Encryption Key Rotation

Start a process that rotates the Secret encryption keys.

Administer Secret Policy

Create and edit Secret Policies.

Administer Secret Server Configuration

View and edit general configuration options. For example, a user with this role permission can turn on Force HTTPS/SSL and disable Allow Remember Me.

Administer Secret Server Data

Manage metadata fields and sections added to secrets and users in Secret Server.

Administer Secret Server Folders

View, edit, create, move, and delete folders. Users still need the relevant view, edit, and owner permissions on the folders to perform these tasks.

Administer Secret Server Lists

Add, remove, and modify lists and list contents in Admin > Lists.

Administer Secret Server Maintenance

Administer Secret Server maintenance.

Administer Secret Server Password Requirements

View and edit character sets and password requirements.

Administer Secret Server Pipelines

Create, edit, and remove event pipelines and event pipeline policies.

Administer Secret Server Reports

View, edit, delete, and create reports. Also allows users to customize report categories.

Administer Secret Server Scripts

View, edit, and add PowerShell, SQL, and SSH scripts on the Scripts Administration page.

Administer Secret Server Security Configuration

View and edit security configuration options in Secret Server. Currently, these include enabling FIPS compliance mode and protecting the encryption key. Formerly Administer Security Configuration.

Administer Secret Server SSH Proxy Configuration

View and edit SSH Proxy settings.

Administer Secret Server System Logs

View and clear the System Log, which shows general diagnostics information for Secret Server.

Administer Secret Server Teams

Create, delete, and view all teams.

Administer Secret Templates

View, edit, disable, and create secret templates.

Administer Workflows

Manage workflows (advanced access management).

Advanced Import

Import secrets from an XML file. Users with the this permission can import groups, folders, site connectors, sites, and secret templates, without having to create a secret. Users must have the Secret Server permissions needed for the objects listed in the XML.

Allow List Secret Access For Assigning Policy

Users with list access to a secret can assign policies. Users need the view permission if they do not have this one.

Assign Secret Policy

Assign Secret Policies to folders and secrets.

Assign Secret Server Pipelines

Assign an event pipeline policy to secret policies, or folders.

Audit Secret Server Session Recordings

Users with at least List Access permission on a secret can access the session recording of the secret. Administrators do not have this permission by default.

Browse Secret Server Reports

Access reports restricted by permissions. Permissions are configurable at the category and report levels and share a similar inheritance model to secrets and folders. You can define users or groups with view or edit permissions for each category or report.

Bypass Direct API Authentication Restriction

Ignore the PreventDirectApiAuthentication advanced setting and log in through the API with a non-application account

Bypass SAML Login

Log in with local account without using SAML (Secret Server specific).

Copy Secret

Copy secrets when the user also has Own Secret role permission.

Create External Vault Links

Link external vaults in Secret Server.

Create Root Folders in Secret Server

Create new folders at the root level of the folder structure.

Deactivate Secret

Mark secrets as deactivated.

Deactivate a Secret within a Report

Run the Delete Secrets action from a report.

Download Auto Export

View all automatic export tabs and download exports from cloud storage (Secret Server Cloud only).

Edit Secret

Without this permission, a user cannot edit secrets, regardless of the secret permission.

Enable Unlimited Administrator in Secret Server

Turn on Unlimited Admin Mode. When this mode is enabled, users with the Unlimited Administrator role permission can view and edit all secrets in the system, regardless of permissions. You can assign Enable Unlimited Administrator in Secret Server to one user and Unlimited Administrator to another user. This would require one user to turn on the mode, which enables another user to view and edit secrets.

Erase Secret

Permanently erase a secret (as opposed to deactivate a secret, which is reversible).

Expire Secrets from Reports

Expire secrets listed in a report.

Launch Secret in Secret Server

Launch a secret. Previously, a user could launch a secret if their user role had the View Secret permission. As of Version 11.5, a user needs this permission to launch. A user will also need the Secret Launch Remote Access (Platform) permission to be able to launch.

Own Secret

Perform advanced tasks on secrets the user “owns,” such as configuring expiration schedules, configuring the web launcher, converting secret template, and copying secrets.

Personal Folder in Secret Server

Have personal folder when the global personal folders configuration options is enabled.

Run Auto Export

View all automatic export tabs and run the export manually by clicking the Run Export button.

Run Disaster Recovery Replication

Initiate or test data replication.

Run Secret Server Scripts

Separates privileges in script management. Holders of the View Scripts role permission cannot execute test runs of scripts, and this permission must be assigned to perform this task.

Secret Force Check In

Force a secret that is checked out by another user to be checked in.

Secret Server Web Services Impersonate

Send an approval request to act as another user within their organization when accessing Secret Server programmatically. Administrators do not have this permission by default.

Unlimited Administrator in Secret Server

View and edit all secrets in the system, regardless of permissions, when Unlimited Admin Mode is on. Another user with the Enable Unlimited Administrator in Secret Server role permission still needs to turn this mode on.

Unrestricted by Teams in Secret Server

View all users, groups, and sites, regardless of team affiliation. Essentially, teams do not exist for the users with this permission, and the Teams page is not available to them. The default user role has this permission.

User Audit Expire Secrets

View the User Audit report, which shows all secrets accessed by a particular user in a specified date range. Also allows the user to force expiration on all these secrets, which would make Secret Server automatically change the password.

View Advanced Secret Options

View the Remote Password Changing, Security, and Dependency tabs on a Secret they have access to.

View Auto Export

View all automatic export tabs.

View Devops Secret Vault Tenants

View (not edit) the DSV tenants set to synchronize with Secret Server.

View Disaster Recovery

View configuration, logs and audits for Disaster Recovery.

View Distributed Engine Configuration

View the Distributed Engine configuration.

View DoubleLock Keys

View which DoubleLock keys exist in the system.

View Dual Control Settings

View configured Dual Control settings for reports and secret sessions.

View Enterprise Objects

View user and secret metadata.

View Event Subscriptions

View event subscriptions.

View Export

View the export log of the system to see when users exported secrets. Does not allow a user to export.

View External Vaults

View external vaults in Secret Server.

View HSM Configuration

View the Hardware Security Module (HSM) configuration settings.

View Inactive Secrets

View secrets that have been deleted in the system.

View Jumpbox

View the details of all jump server routes in the Admin Jumpbox Route page but not make any changes.

View Key Management

View the Key Management settings (Secret Server Cloud only).

View Launcher Password on Secrets

Unmask the password on the view screen of secrets with a launcher. Typically, this includes Web Passwords, Active Directory accounts, Local Windows accounts, and Linux accounts.

View Platform Integration

View the Secret Server connection to the Delinea Platform.

View Remote Password Changing Settings

View, but not edit, heartbeat and remote password changing settings.

View SSH Cipher Suite

View (only) the SSH Cipher Suite.

View SSH Menus

View existing SSH menus, used in allow-listing commands that can be used on a SSH session.

View Secret

View secret. Without this permission, a user cannot view secrets, regardless of the secret permission.

View Secret Audit

View Secret Audit.

View Secret Password and Private Key History

View the history of passwords, private keys, or passphrases in both old and new UI.

View Secret Policy

View, but not edit, secret policies.

View Secret Server Advanced Dashboard

View advanced dashboard. Without this permission, users can only view the basic dashboard.

View Secret Server Configuration

View, but not edit, general configuration settings.

View Secret Server Folders

View, but not edit, folders in the system.

View Secret Server Lists

View lists and list contents in Admin > Lists.

View Secret Server Password Requirements

View character sets and password requirements.

View Secret Server Pipelines

View event pipeline policies and policy activities.

View Secret Server Reports

View, but not edit, reports.

View Secret Server Scripts

View PowerShell, SQL, and SSH scripts on the Scripts Administration page.

View Secret Server Security Configuration

View the security configuration of Secret Server. Formerly View Security Configuration.

View Secret Server Security Hardening Report

View the Security Hardening Report.

View Secret Server Session Recording Audit

See who has viewed a session recording in the secret audit.

View Secret Server SSH Proxy Configuration

View, but not edit, SSH Proxy settings.

View Secret Server System Logs

View (only) the System Log, which shows general diagnostics information for Secret Server.

View Secret Server Teams

View all teams. This is essentially a read-only Administer Teams.

View Secret Server Templates

View, but not edit, Secret Templates.

View Secret Session Recording

View recorded sessions within Secret Server.

View Unlimited Administrator Audit

View the Unlimited Admin Mode configuration and the Unlimited Admin Mode audit log. Formerly View Unlimited Admin Configuration.

View User Audit Report

View, but not edit, the User Audit Report.