User Classifications

This topic explains the different ways users are classified on the Delinea Platform.

IT User and Business User are entitlements, not user classifications. Contracts and some Delinea content call them license types. For more information, see Platform Entitlements.

On the Delinea Platform, users are classified in multiple ways, including by whether they are human or non-human, by their identity source, by their membership type, and by their relationship to Secret Server. These classifications, along with the user’s permissions granted through their roles and memberships, determine how the user is authenticated and what resources they can access.

For more information see

 

Human vs. Non-Human

  • Users: All human users

  • Service users: Non-human, non-interactive, programmatic access (API and service accounts). For more information, see Platform APIs.

On the Users page, you can change the users displayed by filtering by Users or Service Users.

Identity Source

Platform users are also identified by their Identity Source for authentication purposes:

  • Delinea Platform Directory: (Local) Created and managed directly in the Delinea Platform

  • Active Directory: Synced from on-premises Active Directory.

  • Federated Directory Service: Synced from external identity providers (e.g., SAML, OIDC).

  • Entra ID Directory: Synced from Entra ID

On the Users page, you can change the users displayed by filtering by Source.

Membership Type

Platform users are also identified by their Membership Type, sometimes known as their Identity Type. Membership Type classifies users according to their relationship to the organization, and specifies the policies and compliance standards that apply. Membership Types include the following:

  • Employee: Internal staff members of your organization.

  • Vendor: External users (contractors, consultants, third-party partners, etc.). The Vendor membership type exists so these users receive limited Vendor User capabilities and do not consume an IT User license. The Vendor membership type is separate from the Business User entitlement. A Vendor membership can apply to any identity source (Delinea Platform Directory, Active Directory, Federated Directory Service, etc.). If a vendor is instead left at the Employee membership type—the default for all users—they don't receive Vendor restrictions, and they consume the license for their entitlement (IT User or Business User). Vendors are managed with additional controls and workflows. See Contractor and Vendor Access.

On the Users page, you can change the users displayed by filtering by Membership Type.

Secret Server User Type

Platform users are also identified by their Secret Server user type, which describes their relationship with Secret Server. The user type is one of the following:

  • Hybrid: The user account existed in Secret Server first, and the Platform user account is applied "on top" of that. These users have direct access to both the Delinea Platform and Secret Server. They can log into Secret Server directly if they need to. Passwords are not synchronized between the Platform and Secret Server. Users must reset their passwords independently in Platform and Secret Server.

  • Native: The user account existed on the Platform first, and the associated Secret Server account was created afterward. These users can only log in through the platform, but not through Secret Server. They cannot authenticate directly with Secret Server.

  • None: The user account exists in Secret Server only. It is not associated with any Platform account.

On a specific user page, you can view the user's Secret Server user type in the User type field under Secret Server Details.

See the following content on users: