Managed systems | BI Cloud

What are managed systems?

A managed system is any system being managed by Password Safe. A managed system can be an asset, database, directory, or cloud platform. By default, all managed systems are listed on the Managed Systems page, as the Smart Group filter is set to the built-in Smart Group All Managed Systems. You can filter the systems listed in the grid by selecting a different Smart Group from the Smart Group filter list.

Managed systems can be manually created from the Managed Systems page, as well as from the Assets page. Managed systems can also be added using Smart Rules.

How are managed systems useful?

Managed systems provide centralized control, security, and organization for various assets, databases, directories, etc.

How do I access managed systems?

1. Use a browser to sign in to your BeyondInsight/Password Safe URL.
   This URL is provided in the BeyondTrust welcome email and includes your site URL followed by /login.
2. From the left menu, click .
   The Managed Systems page displays.

The Managed Systems page

3. Select to Manage Smart Rules.
4. Filter dropdowns: Select a filter to refine your results.

   Filter types

   - Smart Group filter: Filter by Smart Group.

   • Filter by: Filter by System, IP Address, Entity Type, Platform, Workgroup, Auto Managed, Description, or Change Agent.

5. Select to Create New Managed System.
6. Grid display preferences: Set display preferences on the Managed Systems grid using the following options represented by icons above the grid:
   • Click to refresh the list, to download the list to a .csv file, to select which columns to display on the page, to configure your page display, andto expand the grid.
7. Managed Systems list columns:

   Column Names

   - System

   • IP Address
   • Entity Type
   • Platform
   • Workgroup
   • Auto Managed
   • Description
   • Change Agent

8. Managed Systems grid: Displays information based on filter selections.
9. List navigation options: Navigate in the Managed Systems list.

Work with managed systems

Managed systems can be manually created from the Managed Systems page, as well as from the Assets page. Managed systems can also be added using Smart Rules.

View managed system details

You can view details about the managed system, such as:

• Identifying details, attributes, and policies
• Managed accounts on the managed system
• Smart Groups associated with the managed system
• Accounts linked to managed accounts on the managed system
• Public keys related to the managed system
• Functional account for the managed system

To view the details of a managed system:

1. From the left menu, click .
   The Managed Systems page displays.
2. Locate the managed system you want to view the details for.
3. Click > Go to Advanced Details.
   The Advanced Details page displays.
4. Click through the items under Advanced Details to view details on each topic.

ℹ️

For managed systems that are linked to assets, you can click the View Asset link above the Advanced Details pane to view the details of the asset. Click View Managed System to return the Advanced Details for the managed system.

Import an SSH Server key using a Smart Rule

You can import SSH Server keys from a host and accept the key on the Advanced Details for a managed system. Supported key types are RSA, DSA, and ECDSA. From the Smart Rules page, create an asset-based Smart Rule using Actions settings:

1. Select Manage Asset Using Password Safe from the dropdown.
2. Select a Platform that supports server keys, such as Cisco.
3. Select the Functional Account.
4. For the Key Enforcement Mode option, choose either Auto Accept Initial Key or Manually Accept Keys.
5. Set the other settings as desired or leave as defaults.
6. Add another action to Show Asset as Smart Group.
7. Click Create Smart Rule.

ℹ️

For more information, see Create a Smart Rule.

Manage the SSH Server keys

After the Smart Rule processes, hosts with SSH Server keys are populated in the Smart Group you created.

An email notification is sent to the Administrators user group when a key is imported and the Key Enforcement Mode is set to Manually Accepted Keys. The email notifies the administrators that a fingerprint requires action, what asset the key is on, and also provides details about the fingerprint.

The Fingerprint Verification email template can be modified from Configuration > Privileged Access Management > Mail Templates.

Accept or deny a key

1. From the left menu, click .
   The Managed Systems page displays.
2. Locate the managed system you want to accept or deny a key for.
3. Click > Go to Advanced Details.
4. Under Advanced Details, select Server Keys.
5. Click for the server key you wish to work with.
   • If auto approved, no further action is required.
   • If manually approved, click Accept or Deny.
6. After a key is accepted, from the Functional Accounts tab, click the Test Functional Account button to verify the key with the functional account.

Add a key manually

1. From the left menu, click .
   The Managed Systems page displays.
2. Locate the managed system you want to accept or deny a key for.
3. Click > Go to Advanced Details.
4. Under Advanced Details, select Server Keys.
5. Click + Create New Server Key above the grid.
6. Click Accept or Deny.
7. Select a Key Type.
8. Enter a Fingerprint and Description.
9. Click Create Key.
10. After a key is added, from the Functional Accounts tab, click the Test Functional Account button to verify the key with the functional account.

ℹ️

The fingerprint must be unique. An error message displays if the key is already imported.

Access token and API key management

Password Safe supports the discovery and management of Azure-based credentials used for API access. You can identify Azure service principals with active client secret keys and bring them under centralized control in Password Safe, helping you enforce consistent security policies.

After onboarding, you can securely access and use these credentials through the Password Safe user interface or integrate them into automated workflows, such as CI/CD pipelines and custom scripts. This approach enables secure, programmatic access to Azure resources while reducing the need to manually manage or expose sensitive keys.

Prerequisites

• For Azure, you must create a Service Principal before you can use this feature.

ℹ️

For more information on how to create a Service Principal in Azure, see Create service principal.

• For AWS, you must create an IAM user before you can use this feature.

ℹ️

For more information on how to create an IAM user, see Create an IAM user.

• Permissions to edit secrets and trigger synchronization.
• A Key Vault secret is configured in Password Safe and linked to the Microsoft Entra ID application secret. This configuration is not limited to Entra ID application secrets, Password Safe can sync any supported secret to Azure Key Vault.
• (Optional) Omni Worker is running if you want automatic sync instead of manual sync.

Rotate Azure Key vault keys

The following steps describe how to rotate an application secret in Secrets Safe and then sync the updated secret to Key Vault. Use this process when you need to update a credential immediately and confirm the change is reflected in both systems.

🚧

Important information

Azure client secrets can only be read immediately after generation. Existing secrets that were created outside of Password Safe cannot be onboarded retroactively.

Why is this important

Rotating application secrets on a regular schedule limits the window of exposure if a credential is compromised. Keeping Key Vault in sync with Secrets Safe ensures that applications consuming the Key Vault secret always use the current value and do not fail due to a stale credential.

ℹ️

The credential is being stored and protected in Password Safe.

Workflow summary

Steps

Step 1: Rotate the application secret in Microsoft Entra ID

Performed in: Microsoft Entra ID (Azure portal)

1. Sign in to the Azure portal.
2. Navigate to Microsoft Entra ID > App registrations.
3. Select the application whose secret you want to rotate.
4. Select Certificates & secrets.
5. Under Client secrets, locate the secret you want to rotate.
6. Select New client secret.
7. Enter a description and set an expiration period.
8. Select Add.
9. Copy the new secret value immediately, it is only shown once.
10. Delete the old secret to complete the rotation.

Step 2: Confirm the secret updated in Microsoft Entra ID

Performed in: Microsoft Entra ID (Azure portal)

11. Remain on the Certificates & secrets page.
12. Confirm that the new secret appears in the Client secrets list and the old secret is removed.

ℹ️

Omni Worker runs on a schedule and will sync the updated secret to Key Vault automatically within a few minutes. If you need the sync to happen immediately, continue to Step 3.

Step 3: Manually sync the secret to Key Vault

Performed in: Password Safe (BeyondInsight)

13. Locate the Key Vault secret that is linked to the application secret.
14. From the table grid, right-click the ellipsis, and then select Sync Account to push the current secret value to Key Vault immediately.

    ℹ️

    This step is optional for customers that want to fetch the credentials directly from Azure Key Vault.

Step 4: Confirm the new version appears in Key Vault

Performed in: Azure Key Vault

15. Open your Key Vault in the Azure portal.
16. Select Refresh to load the latest data.
17. Locate the secret and confirm that a new version is listed.
18. Verify that the new version value matches the secret you rotated in Entra ID.

Verify the results

Confirm that the new version in Key Vault contains the same value as the secret you rotated in Microsoft Entra ID. If the values match, the sync was successful and downstream applications will use the current credential.

Rotate AWS IAM user keys

This workflow shows you how to rotate AWS IAM user access keys using Password Safe.
Password Safe automatically generates a new key pair in AWS and stores the key secret
so your applications can continue to authenticate without interruption.

Prerequisites

• BeyondInsight and Password Safe is installed and licensed.
• You have an IT Admin role in BeyondInsight.
• A functional account is configured on the AWS managed system in Password Safe.

  🚧

  Important information

  The Functional Account is not required if initial secret/key is known. You can manage by using Use Own credentials to self-manage.

• The AWS IAM user account is added as a managed account in Password Safe.
• The AWS managed system is reachable from the Password Safe host.

Why is this important

AWS IAM access keys are long-lived credentials. Rotating them regularly limits the
window of exposure if a key is compromised. Password Safe automates this rotation
and stores the new key secret in the vault — so your team never needs to handle
the secret manually.

Workflow summary

Steps

Step 1: Verify the functional account and managed account

Performed in: Password Safe (BeyondInsight)

1. Sign in to BeyondInsight.
2. Navigate to Password Safe > Managed Systems and select the AWS managed system.
3. Select Advanced Details.
4. Confirm that a functional account is assigned to the managed system.
5. Navigate to Password Safe > Managed Accounts and locate the AWS IAM user account.

Step 2: Test the current key

1. On the managed account, select Test Password (or Test Key).
2. Confirm that the test returns a success status.

   ℹ️

   This confirms that the current key and key secret are valid before you rotate.

Step 3: Rotate the key

Performed in: Password Safe (BeyondInsight)

1. On the managed account, select Change Password.
2. Confirm that the rotation returns a success status.

   ℹ️

   Password Safe connects to AWS using the functional account, creates a new IAM
   access key, and stores the new key secret in the vault. AWS provides the key
   secret only at the moment of creation, Password Safe captures it automatically.

Step 4: Verify the new key in AWS

Performed in: AWS Management Console

1. Sign in to the AWS Management Console.

2. Navigate to Access Management > IAM users and select the IAM user.

3. In the Summary section, view the new access key.

   

4. Confirm that a new access key appears. The old key is no longer active.

   🚧

   Important information

   AWS does not display the key secret after creation. Password Safe stores it.

Verify the results

Confirm that the new access key appears in AWS and that the previous key is inactive.
In Password Safe, the managed account stores the new key and key secret together,
formatted as <key>:<key_secret> in the Password field for API use.

📘

For more information about AWS IAM user, see AWS IAM documentation.

Resources

For more information on how to configure a managed account, see Managed Accounts.