Platform Upgrade Center

This topic only applies to standalone Secret Server Cloud.

The Platform Upgrade Center (PUC) is a guided workflow in Secret Server Cloud that permanently upgrades your tenant to the Delinea Platform. After the upgrade, the Delinea Platform becomes the login and user-management layer for Secret Server. Your vault does not move, your secrets are not copied, and your existing Secret Server Cloud URL continues to work.

This topic covers what you need before you start and what changes in Secret Server. For the upgrade steps, see Using Platform Upgrade Center in the Delinea Platform documentation.

Secret Server On-Premises does not have the Platform Upgrade Center.

Availability

The Platform Upgrade Center is rolled out each month to a selection of Secret Server Cloud customers. To check whether it is enabled on your tenant, navigate to Settings > Platform Upgrade Center. If the menu item appears, the Platform Upgrade Center is enabled.

If the menu item does not appear, first confirm that your role has the Required Permissions. To get access before your tenant is included in the rollout, do one of the following:

  • Contact your Delinea support or account team.

  • Navigate to the Advanced Config Settings page at https://<tenant>.secretservercloud.com/app/#/admin/advanced-config-settings, set Delinea Platform Enablement Code to BETTERTOGETHER, and save.

Required Permissions

To access the Platform Upgrade Center, make sure the following role permissions are assigned to the Secret Server Administrator role:

  • Administer Platform Integration

  • View Platform Integration

  • Migrate Data to Platform

Migrate Data to Platform is applied automatically to roles that have both Administer Users and Administer Platform Integration. For descriptions of these permissions, see Secret Server Role Permissions List.

Before You Upgrade

  • Review the readiness checklist in Using Platform Upgrade Center. It covers the AD Connector servers, Entra ID roles, single sign-on details, and Teams review that the upgrade needs.

  • If you have a Resilient Secrets replica in the cloud, do not upgrade the replica.

  • Plan how you will tell users to log in through the Delinea Platform after the upgrade.

What Changes in Secret Server

  • Roles and permissions become read-only. When the upgrade completes, role and permission management moves to the Delinea Platform. You make user, group, and role changes on the Delinea Platform under Access. Roles are not synchronized back to Secret Server, so Delinea Platform role changes take effect but do not appear on the Secret Server roles pages. See Secret Server Roles on the Platform.

  • Upgraded local groups become read-only. Local groups that you synchronize are set to Managed by Platform in Secret Server.

  • Users log in through the Delinea Platform. Users appear on the Delinea Platform after they log in to the Delinea Platform URL for the first time. Have all users log in through the Delinea Platform soon after the upgrade.

  • Directory synchronization moves to the Delinea Platform. After the upgrade completes, disable User Synchronization on the Secret Server Directory Services Configuration tab. Leaving it enabled creates a second source of user and group information and can cause group-membership conflicts. If you use Resilient Secrets, see the post-upgrade cleanup section of Using Platform Upgrade Center for the exception.

  • Single sign-on needs a new integration. Your Secret Server SSO configuration remains, but you must set up a new SSO integration on the Delinea Platform.

What Stays the Same

Secrets, folders, secret permissions, integrations, customizations, and audit history remain in Secret Server and work the same way after the upgrade. Session Connector continues to work with application accounts created in Secret Server. Create any new application accounts in Secret Server, not as Delinea Platform service users.

This upgrade is different from upgrading the Secret Server version. To upgrade a Secret Server On-Premises installation, see Upgrading.