Platform Entitlements

An entitlement determines which Delinea Platform capabilities a user receives. The Delinea Platform has two entitlements: IT User and Business User. Contracts and some Delinea content call entitlements license types. The terms mean the same thing.

Every user receives the IT User entitlement by default.

Entitlements are separate from other user classifications, such as membership type (Employee or Vendor). For more information, see User Classifications.

Each user consumes a license that matches their entitlement: an IT User license for the IT User entitlement, or a Business User license for the Business User entitlement. Users with the Vendor membership type do not consume an IT User license. To manage Vendor users, see Contractor and Vendor Access. To view license usage, select Marketplace > Subscriptions. See Software Subscriptions.

Viewing Entitlements

To view entitlements, select Access > Entitlements from the left navigation. The User Entitlements page opens with two tabs: Entitlements and Audit.

The Entitlements tab lists each entitlement with the following columns:

  • Name: The entitlement name, Business User or IT User.

  • Assigned: The number of members assigned the entitlement.

  • Description: A summary of what the entitlement provides.

Viewing Business User Members

  1. On the Entitlements tab, click Business User.

  2. Click the Members tab.

The Members tab lists each member of the Business User entitlement with the following columns:

  • Name: The member's name.

  • Type: The kind of member, such as User.

  • Directory Source: The directory the member comes from.

To narrow the list, use the search box or the Type filter.

The IT User entitlement also has a Members tab that lists its members. You can't add members to IT User directly. A user returns to IT User when you remove them from the Business User entitlement.

Assigning the Business User Entitlement

You can assign the Business User entitlement to individual users or to groups. Members can come from any directory source connected to the Delinea Platform, including Delinea Directory, Active Directory, Entra ID, and federated directories.

  1. Select Access > Entitlements from the left navigation.

  2. On the Entitlements tab, click Business User.

  3. Click the Members tab.

  4. Click Add members.

  5. In the Member type filter, select Users or Groups.

  6. (Optional) To narrow the list, use the search box or the other filters. The Directory source filter defaults to Delinea Directory. To find users or groups from another source, such as Active Directory, Entra ID, or a federated directory, select that source.

  7. Select the check box next to each user or group to add.

  8. Click Add.

Returning a User to IT User

To return a user to the IT User entitlement, remove them from the Business User entitlement.

  1. Select Access > Entitlements from the left navigation.

  2. On the Entitlements tab, click Business User.

  3. Click the Members tab.

  4. Select the check box next to each member to remove.

  5. Click Remove selected.

The removed users return to the IT User entitlement and appear on its Members tab.

Required Permission

To manage entitlement assignments, you need the Manage Entitlements permission (delinea.platform/access/entitlements/manage). For more information, see Platform Permissions.

Entitlement Capabilities

The following table shows the base permissions for each entitlement.

Entity Permission

Business User

IT User

Secrets:

Add/Create

✔

✔

 

Approve Access

✔

✔

 

Copy

 ✔ ✔

 

Delete/Deactivate

 ✔ ✔

 

Edit/Update

 ✔ ✔

 

Launch

 ✔ ✔

 

Own (Personal and Shared)

 ✔ ✔

 

View

 ✔ ✔

Secret Folders:

Add/Create

 ✔ ✔

 

Delete/Deactivate

 ✔ ✔

Audit Logs:

View Secret Audit Logs

✔ (secrets they own)

 ✔

 

View User Audit Logs

✔ (secrets they own)

 ✔

Others’ Secrets:

Request Access

 ✔ ✔

Resources for tasks, websites, or portals:

Use Credential Manager

✔ (for non-IT related only)

 ✔

 

Use Web Templates in Secret Server

✔ (for non-IT related only)

 ✔

Admin:

Create/Delete/Modify folders and add secrets to any folder

   ✔

 

Create/Manage discovery, distributed engines, HA/DR, integrations, pipelines, sites, workflows, etc. 

   ✔

 

Configure password rotation

   ✔

 

Configure security features for a secret

   ✔

 

Use any administrative functions of Secret Server

   ✔

 

Use any launcher including Privileged Remote Access (PRA)

   ✔

 

Use any templates including custom templates

   ✔

 

Use Connection Manager to launch RDP or SSH sessions

   ✔

 

Use the Secret Server SDK or API

   ✔

Business Users

Users with the Business User entitlement have a limited experience:

  • When they log in, the Delinea Platform redirects them to Credential Manager instead of the Delinea Platform web UI.

  • The Delinea Platform enforces a fixed set of Business User permissions. You can't modify these permissions, but you can manage access to specific resources through secrets, policies, or other controls.

  • A user with the Vendor membership type can't have the Business User entitlement.

For details, see Business User Roles and Entitlements (Credential Manager).

Related Topics