DocumentationRelease Notes
Log In
Documentation

Role-Based Access

Suggest Edits

BeyondInsight offers a role-based delegation model so that you can explicitly assign permissions to groups on specific product features based on their role. Users are provisioned based on the permissions of their assigned groups.

A user must always belong to at least one group that has permissions assigned to be able to log in to BeyondInsight and Password Safe.

You can create BeyondInsight local groups, or you can use existing Active Directory, Entra ID, or LDAP groups.

ℹ️

Note

By default, an Administrators user group is created. The permissions assigned to the group cannot be changed. The user account you created when you configured BeyondInsight is a member of the group.

Create and edit directory credentials

A directory credential is required for querying Active Directory (AD), Entra ID, and LDAP. It is also required for adding AD, Entra ID, and LDAP groups and users in BeyondInsight. Follow the steps below for creating each type of directory credential.

ℹ️

Note

Before you can create an Entra ID credential, you must first register and configure permissions for an application in the Entra ID tenant where the user credentials reside.

To create a directory credential in BeyondInsight:

  1. From the left sidebar, click Configuration.
  2. Under Role Based Access, click Directory Credentials.
  3. Click + Create New Directory Credential.
  4. Select the Directory Type and follow the steps below that are applicable for that type.

Create an Active Directory credential

  1. Select Active Directory for the Directory Type.
  2. Provide a name for the credential.
  3. Enter the name of the domain where the directory and user credentials reside.
  4. Enable the Use SSL option to use a secure connection when accessing the directory.

ℹ️

Note

If Use SSL is enabled, SSL authentication must also be enabled in the BeyondInsight configuration tool.

  1. Enter the credentials for the account that has permissions to query the directory.
  2. Enable the Use Group Resolution option to use this credential for resolving groups from the directory.

ℹ️

Note

Only one credential can be set for group resolution per domain or server.

  1. Click Test Credential to ensure the credential can successfully authenticate with the domain or domain controller before saving the credential.
  2. Click Create Credential.

Create an LDAP credential

  1. Select LDAP for the Directory Type.
  2. Provide a name for the credential.
  3. Enter the name of the LDAP server where the directory and user credentials reside.
  4. Enable the Use SSL option to use a secure connection when accessing the directory.

ℹ️

Note

If Use SSL is enabled, SSL authentication must also be enabled in the BeyondInsight configuration tool.

  1. Enter the credentials for the account that has permissions to query the directory.
  2. Enable the Use Group Resolution option to use this credential for resolving groups from the directory.

ℹ️

Note

Only one credential can be set for group resolution per LDAP server.

  1. Click Test Credential to ensure the credential can successfully authenticate with the domain or domain controller before saving the credential.
  2. Click Create Credential.

Create an Entra ID credential

  1. Select Microsoft Entra ID for the Directory Type.
  2. Select a credential scope: Public or US Government (supports Azure GCC High). The scope cannot be changed after the directory credential is created.
  3. Provide a name for the credential.
  4. Paste the Client ID, Tenant ID, and Client Secret that you copied when registering the application in your Entra ID tenant.
  5. Enable the Use Group Resolution option to use this credential for resolving groups from the directory.

ℹ️

Note

Only one credential is supported per Entra ID tenant.

  1. Click Test Credential to ensure the credential can successfully authenticate with the domain or domain controller before saving the credential.
  2. Click Save Credential.

Edit a directory credential

  1. From the Directory Credentials grid, click the vertical ellipsis for the credential, and then select Edit.
  2. Make the changes required.

ℹ️

Note

For AD or LDAP credentials, if you change the Domain or LDAP Server, enable or disable the Use SSL option, or update the Username or Bind DN, you must change the password. Click Change Password to display fields to enter and confirm the new password.

  1. Click Test Credential to ensure the edited credential can successfully authenticate with the domain or domain controller before saving the credential.
  2. Click Save Credential.

ℹ️

Note

To use Entra ID credentials for logging into BeyondInsight, the accounts must use SAML authentication.

Register and configure an application in Entra ID

Before you can create Entra ID credentials and add Entra ID groups and users into BeyondInsight, you must first register and configure an application in the Entra ID tenant where the user accounts reside. The below steps walk through creating a registered application in Entra ID, creating a client secret for the registered app, and configuring API permissions for the registered app.

Create a registered application in Entra ID

Sign into Azure and connect to the Entra ID tenant where the credentials you wish to add into BeyondInsight reside. Then follow these steps:

  1. On the left menu, select App registrations.
  2. Click + New Registration.
  3. Under Name, enter a unique application name.
  4. Under Supported account types, select Accounts in this organizational directory only.
  5. Click Register.

Create a client secret for the registered app

  1. Select the newly created app from the list of App Registrations (if not already visible).
  2. Select Certificates & secrets from the left menu.
  3. Click + New Client Secret.
  4. Provide a Description and appropriate Expiry. If you select 1 or 2 years, the directory credential must be refreshed in BeyondInsight with a new client secret on the anniversary of its creation.
  5. Click Add.
  6. Copy the client secret and store it in a safe place. It is required when creating directory credentials for Entra ID in BeyondInsight.

ℹ️

Note

This is the only time this client secret value is displayed.

Assign API permissions to the registered application

  1. Select the newly created app from the list of App Registrations.
  2. Select API Permissions from the left menu.
  3. Click + Add a permission.
  4. Click Microsoft Graph.
  5. Click Application Permissions.
  6. Search for User.Read.All and check the box in the search results.
  7. Search for Group.Read.All and check the box in the search results.
  8. Click Add permissions.
  9. Search for Domain.Read.All and check the box in the search results.
  10. Click Add permissions.
  11. Click Grant Admin Consent for to give consent to the app to have those permissions you just added.
  12. Click Yes to confirm.

Now that your registered app is created, has a client secret, and has API permissions assigned, select Overview from the left menu and copy the Application (client) ID and the Directory (tenant) ID. Store these in a safe place as these are required when creating directory credentials for Entra ID in BeyondInsight.

Map directory credentials to a domain

Domain management allows you to map a default primary directory credential and an optional fallback credential as preferred binding credentials used for account resolution against domains in your environment when logging in to BeyondInsight.

ℹ️

Note

If credentials are not mapped, or both mapped credentials fail, BeyondInsight attempts login following the legacy process of not using mapped credentials.

Follow these steps to add or edit primary and secondary credentials for a domain:

  1. From the left sidebar, click Configuration.
  2. Under Role Based Access, click Domain Management.
  3. Click Create New Domain + to create a new one.
  4. Provide the name of the domain or LDAP server.
  5. Select the type of platform.
  6. Select a Primary Credential from the dropdown.
  7. Select a Fallback Credential from the dropdown.
  8. Click Create Domain.
  9. To edit credentials for an existing domain, select the domain from the left pane, make your edits, and then click Save Domain.

ℹ️

Note

Primary and fallback credentials can include Password Safe managed accounts.

When domain management is configured for a domain and user selects the domain when logging into BeyondInsight, the specified primary and fallback credentials are used to resolve their account. The credentials used for authentication are shown in the Login Details for the specific login activity on the Configuration > General > User Audits page.

Create and configure groups for Role-Based Access

Create user groups and user accounts so that your BeyondInsight administrators can log in to BeyondInsight.

When a user is added to a group, the user is assigned the permissions assigned to the group.

You can create BeyondInsight local groups, as well as add Active Directory groups, add Entra ID groups , and add LDAP groupsin BeyondInsight from the Configuration > Role Based Access > User Management page.

You can filter the groups displayed in the grid by type of group, name of the group, group description, and the date the group was last synchronized.

ℹ️

Note

By default, the first 100 groups are displayed per page. You can change this by selecting a different number from the Items per page dropdown at the bottom of the grid.

Create a Local Group

To create a local group in BeyondInsight, follow the below steps:

  1. From the left sidebar, click Configuration.
  2. Under Role Based Access, click User Management.
  3. From the Groups tab, click + Create New Group.
  4. Select Create a New Group.
  5. Enter a Group Name and Description for the group.
  6. The group is set to Active by default. Check the box to deactivate it, if you prefer to activate it later.
  7. Click Create Group.
  8. Assign users to the group:
    • Under Group Details, select Users.
    • From the Show dropdown list, select Users not assigned.
    • Filter the list of users displayed in the grid by Type, Username, Name, Email, and Domain, if desired.
    • Select the users you wish to add to the group, and then click Assign User above the grid.

ℹ️

Note

By default, new groups are not assigned any permissions. You must assign permissions on features and Smart Groups after creating a new group. For more information on permissions and how to assign them, see Assign Group Permissions.

ℹ️

Note

When a local user logs in to BeyondInsight for the first time using SAML authentication, BeyondInsight provisions their account by mapping it to the groups assigned to their account.

For releases prior to 21.3, and for upgrades to the 21.3 release, if the user account's group membership has changed (in the SAML claims provided) upon subsequent logins, BeyondInsight does not deprovision the user by removing them from the groups that were initially mapped to their account. Instead, BeyondInsight maps the user to any newly assigned groups, in addition to the groups their account is already mapped to.

You can configure BeyondInsight to synchronize group membership each time a local user logs in using SAML, as follows:

  1. Navigate to Configuration > Authentication Management > Authentication Options.
  2. Under SAML Logon for Local Users, toggle the Enable Group Resync option to enable it.

For new installs of release 21.3 and later releases, this option is enabled by default.

Add an Active Directory group

Active Directory (AD) group members can log in to the management console and perform tasks based on the permissions assigned to the group. The group can authenticate against either a domain or domain controller. Upon logging into BeyondInsight, users can select a domain from the Log in to list on the Login page.

ℹ️

Note

The Log in to list is only displayed on the Login page when there are either AD or LDAP user groups created in the BeyondInsight console. The Log in to list is displayed by default, but may be disabled / enabled by an admin user by toggling the Show list of domains/LDAP servers on login page setting from Configuration > System > Site Options page.

ℹ️

Note

AD users must log in to the management console at least once to receive email notifications.

To create an Active Directory group in BeyondInsight:

  1. From the left sidebar, click Configuration.
  2. Under Role Based Access, click User Management.
  3. From the Groups tab, click + Create New Group.
  4. Select Add an Active Directory Group.
  5. Select a credential from the list.

ℹ️

Note

If you require a new credential, click Create New Credential to create one. The new credential is added to the list of available credentials.

  1. If the Domain field is not automatically populated, enter the name of a domain or domain controller.
  2. After you enter the domain or domain controller credential information, click Search Active Directory. A list of security groups in the selected domain is displayed.

ℹ️

Note

The default filter is an asterisk (*), which is a wild card filter that returns all groups. For performance reasons, a maximum of 250 groups from Active Directory is retrieved.

  1. Set a filter on the groups to refine the list, and then click Search Active Directory.

✅

Example

Sample filters:

  • a returns all group names that start with "a"
  • _d returns all group names that end with "d"
  • _sql returns all groups that contain "sql" in the name

  1. Select a group, and then click Add Group.
  2. The group is added and set to Active but not provisioned or synchronized with AD. Synchronization with AD to retrieve users begins immediately.
  3. Once the group has been synced with AD, you can view the users assigned to the group by selecting Users from the Group Details pane.

ℹ️

Note

Use the filters above the grid to narrow down the list of users displayed in the grid by Type, Username, Name, Email, or Domain, or to show users not assigned to the group.

ℹ️

Note

By default, new groups are not assigned any permissions. You must assign permissions on features and Smart Groups after creating a new group. For more information on permissions and how to assign them, see Assign Group Permissions.

ℹ️

Note

For more information on creating and editing directory credentials, see Create and Edit Directory Credentials.

Propagate domain changes to group members

Domain changes can be propagated to all users in a group by enabling the Propagate this change to all group members option for the group. By default, this is set to OFF. When enabled, changes to the preferred domain controller at the group level are applied to all group members.

When creating a new group, we advise turning this setting on by editing the new group details. This ensures that all users in the new group get a preferred domain controller from the initial setup of the group.

Configure Active Directory group synchronization

Create and enable a recurring schedule for AD groups to automatically synchronize at a specified time and frequency. This ensures your AD groups are up to date with the latest users added to that group in Active Directory. This schedule applies globally to all AD groups in your BeyondInsight instance; however, the global schedule can be overridden at the group level and a group can be configured to be excluded from the synchronization process.

To enable Active Directory Group Synchronization:

  1. Navigate to Configuration > Role Based Access > Active Directory Group Synchronization.
  2. Check the Enable AD Group Synchronization option.
  3. Specify a Start Time. Time is UTC.
  4. Select your desired frequency of Daily, Weekly, or Monthly.
  5. Click Save Configuration.

ℹ️

Note

For more information on overriding the global AD synchronization schedule and excluding a group from the synchronization process, see Edit Basic Group Details.

Add an Entra ID Group

Entra ID group members can log in to the management console using SAML authentication and perform tasks based on the permissions assigned to the group. Upon logging into BeyondInsight, users can select a domain from the Log in to list on the Login page.

ℹ️

Note

The Log in to list is only displayed on the Login page when there are either AD or LDAP user groups created in the BeyondInsight console. The Log in to list is displayed by default, but may be disabled / enabled by an admin user by toggling the Show list of domains/LDAP servers on login page setting from Configuration > System > Site Options page.

ℹ️

Note

AD users must log in to the management console at least once to receive email notifications.

Direct Connect does not support using SAML as an authentication method. Therefore, Direct Connect is not available with Entra ID accounts.

Create an Entra ID group in BeyondInsight, as follows:

  1. From the left sidebar, click Configuration.
  2. Under Role Based Access, click User Management.
  3. From the Groups tab, click + Create New Group.
  4. Select Add a Microsoft Entra ID Group.
  5. Select a credential from the list.

ℹ️

Note

If you require a new credential, click Create a New Credential to create a new credential. The new credential is added to the list of available credentials.

  1. Click Search Microsoft Entra ID. A list of security groups displays.

ℹ️

Note

For performance reasons, a maximum of 250 groups from Entra ID is retrieved. The default filter is an asterisk (*), which is a wildcard filter that returns all groups. Use the group filter to refine the list.

  1. Set a filter on the groups that are to be retrieved, and then click Search Microsoft Entra ID.

✅

Example

Sample filters:

  • a returns all group names that start with a.
  • _d returns all group names that end with d.
  • _sql returns all groups that contain sql in the name.

  1. Select a group, and then click Add Group.
  2. The group is added and set to Active but not provisioned or synchronized with Entra ID. Synchronization with Entra ID to retrieve users begins immediately.
  3. Once the group has been synced with Entra ID, you can view the users assigned to the group, as well as unassigned users, by selecting Users from the Group Details section and then using the filters.

ℹ️

Note

By default, new groups are not assigned any permissions. You must assign permissions on features and Smart Groups after creating a new group. For more information on permissions and how to assign them, see Assign group permissions.

ℹ️

Note

To use Entra ID credentials for logging into BeyondInsight, the accounts must use SAML authentication.

ℹ️

Note

For more information on creating and editing directory credentials, see Create and Edit Directory Credentials.

Configure Entra ID group synchronization

Create and enable a recurring schedule for Entra ID groups to automatically synchronize at a specified time and frequency. This ensures your Entra ID groups are up to date with the latest users added to that group in Entra ID. This schedule applies globally to all Entra ID groups in your BeyondInsight instance; however, the global schedule can be overridden at the group level and a group can be configured to be excluded from the synchronization process.

To enable Entra ID Group Synchronization:

  1. Navigate to Configuration > Role Based Access > Entra ID Group Synchronization.
  2. Check the Enable Microsoft Entra ID Group Synchronization option.
  3. Specify a Start Time.
  4. Select your desired frequency of Daily, Weekly, or Monthly.
  5. Click Save Configuration.

ℹ️

Note

For more information on overriding the global Entra ID synchronization schedule and excluding a group from the synchronization process, see Edit Basic Group Details.

Add an LDAP group

LDAP group members can log in to the BeyondInsight console and perform tasks based on the permissions assigned to the group. The group can authenticate against either a domain or domain controller. Upon logging in to BeyondInsight, users can select a domain or LDAP server from the Log in to list on the Login page.

ℹ️

Note

The Log in to list is only displayed on the Login page when there are either AD or LDAP user groups created in the BeyondInsight console. The Log in to list is displayed by default, but may be disabled / enabled by an admin user by toggling the Show list of domains/LDAP servers on login page setting from Configuration > System > Site Options page.

ℹ️

Note

LDAP users must log in to the BeyondInsight console at least once to receive email notifications.

Create an LDAP group in BeyondInsight, as follows:

  1. From the left sidebar, click Configuration.
  2. Under Role Based Access, click User Management.
  3. From the Groups tab, click + Create New Group.
  4. Select Add an LDAP Group from the list.
  5. Select a credential from the list.

ℹ️

Note

If you require a new credential, click Create a New Credential to create a new one. The new credential is added to the list of available credentials.

  1. Enter the name or IP address for the LDAP server.
  2. Click Fetch to load the list of Base DNs.
  3. If the Base DN list does not populate, manually enter the details and click Add as New Option to populate the list.
  4. Select the Base DN.
  5. To filter the group search, enter keywords in the group filter or use a wild card.
  6. Click Search LDAP.

✅

Example

Sample filters:

  • a returns all group names that start with a.
  • _d returns all group names that end with d.
  • _sql returns all groups that contain sql in the name.

  1. Select a group, and then click Continue to Add Group.
  2. Select the Group Membership Attribute and Account Naming Attribute.
  3. Enter a Base Distinguished Name, if not automatically populated.
  4. Click Add Group.
  5. The group is added and set to Active but is not provisioned or synchronized with LDAP. Synchronization with LDAP to retrieve users begins immediately.
  6. Once the group has been synced with LDAP, you can view the users assigned to the group, as well as unassigned users, by selecting Users from the Group Details section, and then using the filters.

ℹ️

Note

By default, new groups are not assigned any permissions. You must assign permissions on features and smart groups after creating a new group. For more information on permissions and how to assign them, see Assign group permissions.

ℹ️

Note

For more information on creating and editing directory credentials, see Create and Edit Directory Credentials.

Assign group permissions

The following permissions may be assigned to user groups in BeyondInsight for each feature and Smart Group.

PermissionDescription
No AccessUsers cannot access the selected feature or Smart Group. In most cases, the feature is not visible to the users.
Read OnlyUsers can view selected areas, but cannot change information.
Full ControlUsers can view and change information for the selected feature.

Permissions for a BeyondInsight user must be assigned cumulatively and at the group level. You must assign permissions on features and Smart Groups after creating a new group in order for users in that group to be able to access features in the product. For example, if you want a BeyondInsight administrator to manage discovery scans only, then you must assign full control for the following features:

  • Management Console Access
  • Asset Management
  • Reports Management
  • Scan – Job Management
  • Scan Management

ℹ️

Note

In addition to the group permissions noted, for the group to be provisioned, there must be at least one enabled Smart Group for the group. This sets the scope for the features.

Assign features permissions

ℹ️

Note

The features listed are based upon your BeyondInsight license. Only features relevant to your licensed installation are listed.

  1. From the left sidebar, click Configuration.

  2. Under Role Based Access, click User Management.

  3. From the Groups tab, click the vertical ellipsis for the group.

  4. Select View Group Details.

  5. Under Group Details, click Features.

  6. Filter the list of features displayed in the grid using the Show and Filter by dropdowns.

  7. Select the features you wish to assign permissions to.

  8. Click Assign Permissions above the grid.

  9. Select Assign Permissions Read Only, Assign Permissions Full Control, or Disable Permissions.

The following table provides information on the features permissions you can assign to your groups.

FeatureProvides Permissions To:
Analytics & ReportingLog in to the console and access Analytics & Reporting to generate and subscribe to reports.
After you create a group, go to the Analytics & Reporting Configuration page and run the process daily cube job. Data between the management console and the reporting cube must be synchronized.
API Registration ManagementGrants permission to read or write API Registrations.
Appliance (U-Series) AccessGrant access to manage the U-Series Appliance as a BeyondInsight user.
Asset ManagementCreate Smart Rules.
Edit and delete buttons on the Asset Details window.
Create Active Directory queries.
Create address groups.
Attribute ManagementAdd, rename, and delete attributes when managing user groups.
Credential ManagementAdd and change credentials when running scans and deploying policies.
Directory Credential ManagementGrant access to the configuration area where directory credentials are managed. This feature must be enabled to support access to directory queries as well.
Directory Query ManagementGrant access to the configuration area where directory queries are managed.Access to Directory Credential Management must also be granted.
Domain ManagementGrants the user permission to configure mappings of bind credentials to domains for account resolution.
Endpoint Privilege ManagementGrant access to the Endpoint Privilege Management features, excluding Policy Editor and Reporting.
Endpoint Privilege Management Policy EditorGrant access to the Endpoint Privilege Management Policy Editor feature.
Endpoint Privilege Management ReportingGrant access to the Endpoint Privilege Management Reporting feature.
Endpoint Privilege Management for Unix & LinuxGrant access to the Endpoint Privilege Management for Unix & Linux features.
File Integrity MonitoringWork with File Integrity rules.
License ReportingView the Licensing folder in Analytics & Reporting (MSP reports, Endpoint Privilege Management for Windows, Endpoint Privilege Management for Mac true-up reports, and Assets Scanned report).
Management Console AccessAccess the BeyondInsight management console.
Manual Range EntryAllow the user to manually enter ranges for scans and deployments rather than being restricted to smart groups. The specified ranges must be within the selected smart group.
Option ManagementChange the application options settings (for example, account lockout and account password settings).
Options - ConnectorsAccess the configuration area where connectors are managed.
Options - Scan OptionsAccess the configuration area where scan options are managed.
Password Safe Account ManagementGrant read or write permissions to the following features on the Managed Accounts page and through the public API:
  • Bulk delete accounts
  • Add accounts to a Quick Group
  • Remove accounts from a Quick Group
  • Add, edit, and delete accounts
Password Safe Admin SessionPassword Safe web portal admin sessions.
Password Safe Admin Session ReviewerGrant a user admin session reviewer permissions only.
Password Safe Global API QuarantineAccess to the Quarantine APIs.
Password Safe Bulk Password ChangeChange more than one password at a time.
Password Safe Agent ManagementGrant a user administrator permissions to the Configuration > Privileged Access Management Agents page.
Password Safe Configuration ManagementGrant a user administrator permissions to the Configuration > Privileged Access Management page.
Password Safe Domain ManagementCheck the Read and Write boxes to permit users to manage domains.
Password Safe Policy ManagementGrant a user administrator permissions to the Configuration > Privileged Access Management Policies page.
Password Safe Role ManagementAllows a user to manage roles, provided they have the following permissions: Password Safe Role Management and User Account Management.
Password Safe System ManagementRead and write managed systems through the public API.
Password Safe Ticket System ManagementThis feature is not presently used.
Reports ManagementRun scans, create reports, and create report categories.
Scan - Job ManagementActivate Scan and Start Scan buttons.
Activate Abort, Resume, Pause, and Delete on the Job Details page.
Scan - Report DeliveryAllow a user to set report delivery options when running a scan:
  • Export Type
  • Notify when complete
  • Email report to
  • Include scan metrics in email (only available for All Audits Scan)
Scan ManagementDelete, edit, duplicate, and rename reports on the Manage Report Templates page.
Activate New Report and New Report Category.
Activate the Update button on the Edit Scan Settings view.
Secrets SafeProvides access to Secrets Safe for all members of the selected group.
Session MonitoringUse the session monitoring features.
Smart Rule Management – AssetGrants permission to view, create, and edit asset Smart Rules; editing is limited to Smart Rules that are enabled for groups the user is a member of.
Newly created Smart Rules created by a non-administrator are automatically enabled with full permissions for all groups where the user is a member.
Smart Rule Management – Managed AccountGrants permission to view, create, and edit managed account Smart Rules; editing is limited to smart rules that are enabled for groups the user is a member of.
Newly created Smart Rules created by a non-administrator are automatically enabled with full permissions for all groups where the user is a member.
Smart Rule Management – Managed SystemGrants permission to view, create, and edit managed system Smart Rules; editing is limited to smart rules that are enabled for groups the user is a member of.
Newly created Smart Rules created by a non-administrator are automatically enabled with full permissions for all groups where the user is a member.
Smart Rule Management – Policy UserGrants permission to view, create, and edit policy user Smart Rules; editing is limited to smart rules that are enabled for groups the user is a member of.
Newly created Smart Rules created by a non-administrator are automatically enabled with full permissions for all groups where the user is a member.
Ticket SystemView and use the ticket system.
Ticket System ManagementMark a ticket as inactive. The ticket no longer exists when Inactive is selected.
User Accounts ManagementAdd, delete, or change user groups and user accounts.
A minimum of read access to Directory Credential Management must also be granted to enable creation of AD and LDAP Groups.
User AuditsView audit details for management console users on the User Audits page.
U-Series Appliance AdministratorProvides access to manage all aspects of the U-Series Appliance.
U-Series Appliance BackupsProvides access to manage the Backup and Restore options of the U-Series Appliance.
U-Series Appliance High AvailabilityProvides access to manage the High Availability features of the U-Series Appliance.
U-Series Appliance LoginProvides access to manage the U-Series Appliance as a BeyondInsight user.
U-Series Appliance Manage RDPProvides access to manage Remote Desktop Protocol to the U-Series Appliance.
U-Series Appliance PatchingProvides access to manage updates to the U-Series Appliance.
Workforce PasswordsEnables secure enterprise credential storage.
In order to leverage Workforce Passwords, an additional license is required.

ℹ️

Note

For more information, see the managed accounts API documentation.

Features permissions required for configuration options
Configuration OptionFeature and Permission
Active Directory QueriesAsset Management - Full Control.
Address GroupsAsset Management - Full Control.
AttributesAsset Management - Full Control.
ConnectorsAsset Management and Management Console Access - Full Control.
OrganizationsUser Accounts Management - Full Control.
Password Safe ConnectionsMember of the Built-In Administrators group.
Endpoint Privilege Management ModuleManagement Console Access and Endpoint Privilege Management - Full Control.
Scan OptionsScan Management - Full Control.
ServicesMember of the Built-In Administrators group.
User AuditsUser Audits - Full Control.
User ManagementEveryone can access.
Users without the Full Control permission to User Account Management feature can edit only their user record.
WorkgroupsUser Accounts Management - Full Control.

Assign Smart Groups permissions

  1. From the left sidebar, click Configuration.

  2. Under Role Based Access, click User Management.

  3. From the Groups tab, click the vertical ellipsis for the group.

  4. Select View Group Details.

  5. Under Group Details, select Smart Groups.

  6. Filter the list of Smart Groups displayed in the grid using the Show and Filter by dropdowns.

  7. Select the Smart Groups you wish to assign permissions to.

  8. Click Assign Permissions above the grid.

  9. Select Assign Permissions Read Only, Assign Permissions Full Control, or Disable Permissions.

Edit and Delete Groups

Edit groups

The below sections detail how to make basic edits to the settings and options of BeyondInsight local groups, Active Directory groups, Entra ID groups, and LDAP groups using the Edit Group functionality, as well as how to update more advanced group details such assigning permissions, updating group members, and managing API registrations.

Administrators can edit the following basic details for groups in BeyondInsight:

BeyondInsight local groups

  • For BeyondInsight local groups, administrators can update the following:
    • Deactivate or activate a group by enabling or disabling the Active status.
    • Modify the Group Name.
    • Modify the Description.

Active directory groups

For Active Directory groups, administrators can update the following:

  • Deactivate or activate a group by enabling or disabling the Active status.
  • Change the credential used to query the group in Active Directory.
  • Select a new domain or domain controller used for accessing the group in Active Directory.
  • Enable or disable the option to propagate domain changes to all members of the group.
  • Select Sync Schedule Options to control how the user accounts in this group are automatically synchronized on a periodic schedule. The following options are available:
    • Global: This is the default setting which uses the schedule settings specified in the Active Directory Group Synchronization configuration section.
    • Custom: Select Custom to ignore the global synchronization schedule and specify a unique synchronization schedule for this group instead.
    • No scheduled synchronization: Select this option to omit this group from any automatic synchronization. The group can still be synchronized manually.

Entra ID groups

  • For Entra ID groups, administrators can update the following:
    • Deactivate or activate a group by enabling or disabling the Active status.
  • Select Sync Schedule Options to control how the user accounts in this group are automatically synchronized on a periodic schedule. The following options are available:
    • Global: This is the default setting which uses the schedule settings specified in the Microsoft Entra ID Group Synchronization configuration section.
    • Custom: Select Custom to ignore the global synchronization schedule and specify a unique synchronization schedule for this group instead.
    • No scheduled synchronization: Select this option to omit this group from any automatic synchronization. The group can still be synchronized manually.

LDAP groups

  • For LDAP groups, administrators can update the following:
    • Deactivate or activate a group by enabling or disabling the Active status.
    • Change the credential used to query the group in LDAP.
    • Select a new Group Membership attribute from the list. The following options are available:
      • member
      • uniqueMember (default)
      • memberUID
    • Select a new Account Naming attribute from the list. The following options are available:
      • mail
      • cn
      • sAMAccountName
      • uid
      • userPrincipalName
    • Edit the Base Distinguished Name.
To edit a group in BeyondInsight:

  1. From the left sidebar, click Configuration.

  2. Under Role Based Access, click User Management.

  3. From the Groups tab, locate the group using the available filter options above the grid and select it.

  4. Click the vertical ellipsis for the group, and then select Edit Group.

  5. In the Edit Group pane, update the details as required, and then click Update Group.

ℹ️

Note

For more information on configuring Active Directory Group Synchronization settings, see Configure Active Directory Group Synchronization.

Edit advanced group details

Administrators can edit the following advanced details for groups:

  • Update the group permissions for specific BeyondInsight and Password Safe features.
  • Update the group permissions for specific Smart Groups.
  • Edit Password Safe roles for Smart Groups
  • Add and remove users from local groups.
  • Manually synchronize group users for Active Directory and LDAP groups.
  • Enable and disable API Registrations for the group.

Follow these steps to access advanced details for a group:

  1. From the left sidebar, click Configuration.

  2. Under Role Based Access, click User Management.

  3. From the Groups tab, locate the group using the available filter options above the grid and select it.

  4. Click the vertical ellipsis for the group, and then select View Group Details.

  5. From the Group Details pane, you can select Features, Smart Groups, Users, and API Registrations to make updates for the group. Specific updates you can make for each of these options are detailed in the below sections.

Update group permissions for features

Permissions provide the members of the group access to BeyondInsight system components and Password Safe features. Assign permissions to groups for specific features, as follows:

  1. From the Group Details pane, click Features.
  2. From the Features grid, select the feature.
  3. Click Assign Permissions above the grid.
  4. Click Assign Permissions Read Only, Assign Permissions Full Control, or Disable Permissions.

Update group permissions for Smart Groups

Assign permissions to groups to provide members of the group access to Smart Groups as follows:

  1. From the Group Details pane, click Smart Groups.
  2. From the Smart Groups grid, select the Smart Group.
  3. Click Assign Permissions above the grid.
  4. Click Assign Permissions Read Only, Assign Permissions Full Control, or Disable Permissions.

Edit Password Safe roles for Smart Groups

Password Safe roles define the actions users can take when using the Password Safe web portal for password releases or access to applications. Assign Password Safe roles to groups as follows:

  1. From the Group Details pane, click Smart Groups.
  2. From the Smart Groups grid, click the vertical ellipsis for the Smart Group.
  3. Select Edit Password Safe Roles.
  4. Check or uncheck each role, as required.
  5. Click Save Roles.

Add users to local BeyondInsight groups

Manually add users to local groups in BeyondInsight as follows:

  1. From the Group Details pane, click Users.
  2. Filter the Users grid to show users not assigned.
  3. Select the user or users, and then click Assign User above the grid.

Sync group users for Active Directory and LDAP groups

To ensure your AD and LDAP groups contain the most recent group members, you can manually synchronize with AD and LDAP to retrieve the group's users. There are two methods for manually synchronizing group users, as follows:

  • From the group header, above the Group Details pane, click the Sync group users icon.
  • From the User Management page, click the vertical ellipsis for the group and select Sync group users.

Manage group API registrations

API Registrations provide a way to integrate part of the BeyondInsight and Password Safe functionality into your applications using an API key. Manage API registrations for groups as follows:

  1. From the Group Details pane, click API Registrations.
  2. Check or uncheck the API registrations to enable or disable them for this group or click Select All to enable all of them. Changes are automatically saved.

ℹ️

Note

Use the filter above the list to narrow down the list of API registrations or to quickly find a specific registration by its name. If you need to create a new API registration, click the Manage API Registrations link above the filter box to go to the API Registrations page where you can create a new one.

ℹ️

Note

For more detailed information on features permissions, Password Safe roles, and API registrations, please see the following:

  • Assign Group Permissions
  • Configure API Registration
  • Password Safe Role

Delete a group

ℹ️

Note

Groups associated with a secret or credential in Secrets Safe cannot be deleted. Users attempting this action receive the following warning: Unable to delete group as it contains secrets which must first be removed.

Administrators can delete groups as follows:

  1. From the left sidebar, click Configuration.

  2. Under Role Based Access, click User Management.

  3. From the Groups tab, locate the group using the available filter options above the grid and select it.

  4. Click the Delete button above the grid.

    • Alternatively, click the vertical ellipsis for the group, and then select Delete Group.

Audit Console Users

You can track the following activities of users logging into the console:

  • Login and logout times
  • IP address from where the user logged in
  • Password change events
  • Other actions taken such as configuring user settings

To view user audit data:

  1. Go to Configuration > General > User Audits.
  2. User the filters above the grid to easily locate specific items listed. You can filter grid items by the following criteria:
    • Date the user took the action
    • Type of action taken
    • Which section of the application the action was taken
    • Username
    • IP Address
    • Key words of the item
    • Key words in the item details
  3. Click the i icon for the item to view more specific details about the action taken.

ℹ️

Note

You can export all of the data in the grid to a CSV file by clicking the Download all (downward arrow) button above the grid.

ℹ️

Note

User audits older than 120 days are purged from the database. Navigate to Configuration > System > Data Retention > Application Maintenance to change the data retention setting for user audits.

Updated 5 days ago

©2003-2025 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.