Dedicated directory accounts for Entra ID workflow

A workflow for Password Safe

Individual administrative accounts in Entra ID have broad permissions and should be controlled, audited, and rotated on a regular schedule. A dedicated account restricts a privileged Entra ID account to use by one specific person while still letting Password Safe manage and rotate its password automatically. This reduces the risk of shared or unmanaged privileged access to Entra ID.

Scope of this guide

This workflow shows you how to create a Managed Account Smart Rule that discovers dedicated Entra ID accounts and brings them under Password Safe management. Once discovered, Password Safe can rotate and control these accounts automatically.

Prerequisites

• You have administrator access to the BeyondInsight console.
• An Entra ID managed system is already set up in BeyondInsight.
• You know the Entra ID group name or user principal name pattern for the accounts you want to discover.
• You have permissions to the Assets, Managed Accounts, and Managed Systems grids.

Steps

Step 1: Create a Managed Account Smart Rule for Entra ID

1. From the left navigation in the BeyondInsight console, select Smart Rules.
2. Select Managed Account from the Smart Rule type filter dropdown.
3. Select + Create Smart Rule.
4. Set the category, name, and reprocessing limit:
   • Category: Select Managed Accounts.
   • Name: Enter a meaningful name and description so you can identify the Smart Rule later.
   • Reprocessing Limit: Select a reprocessing limit, if needed.
5. Under Selection Criteria, select Azure Directory Query from the dropdown, then select whether the rule includes ALL or ANY of the criteria you add.
6. Choose a Group Name or User Principal Name match:
   • To discover every account that belongs to a specific Entra ID group, select Group Name, then enter the group name. equals is the only match option available for a group name.
   • To discover accounts by a partial name match, select User Principal Name, then select starts with or ends with and enter the name.
7. Set the sync scope and rerun interval:
   • Enter a value for how many hours the query reruns.
   • Select the option to discover accounts in Azure synced from on-premises if you want the rule to include Entra ID accounts synced from on-premises Entra ID, as well as Azure-only accounts.
   • Leave Discover accounts for Password Safe Management selected.
   • Select an Azure domain from the dropdown.
   • Add more selection criteria or groups, as needed.
8. Under Actions, select Show managed account as Smart Group. Add other actions only after you confirm the rule returns the correct accounts.
9. Select Create Smart Rule.

Step 2: View the Smart Rule results

1. Open the Smart Rule you created, select View Results, and review the grid that lists the accounts the Smart Rule discovered. If the rule is still processing, a banner tells you that.

🚧

Important

The Smart Rule must be saved with Show as Smart Group selected under Actions before you can view results. Review the results with only the Show as Smart Group action applied before you add actions that change accounts or assets in your network. Once you confirm the rule contains the accounts you expect, add any other actions the rule needs.

Verify the results

Confirm that the Smart Rule appears under Managed Account Smart Rules and that its results grid lists the Entra ID accounts you expected to discover.

Next steps

• Create a more specific Managed Account Smart Group if you need to restrict access to a smaller subset of the discovered accounts.
• Set up an access policy that maps each dedicated account to the one Password Safe user allowed to request it.