---
updatedAt: 2026-03-25T20:29:42.000Z
---

# Managed accounts: Configure | PS Pathfinder

## Prerequisite

Before you configure managed accounts, ensure you understand what managed accounts are and the benefits they provide, see [Managed Accounts: Overview](https://docs.beyondtrust.com/bips/v25.3/docs/pathfinder-managed-accounts).

## View managed accounts

When you view managed accounts, you can change the number of items displayed on the page using the **Items per page** dropdown at the bottom of the grid. You can use the filters above the grid to filter the list by smart group and the various attributes listed in the **Filter by** dropdown.

After the account is added to Password Safe management, you can:

* Review the attributes and settings assigned to the account, such its identifying details, settings, and policies.
* View managed systems linked to the account.
* View Smart Groups associated with the account, as well as their last process date and processing status.
* See which accounts are synced to the managed account.
* View a list of password changes and the reason for each change.

### View managed account details

To view details on a specific managed account:

1. From the left menu, click ![Managed Accounts icon](https://files.readme.io/a6badb503284a51e2a056527a81a01fcab939ddad30aa0b78498b7563e2b7603-managed-accounts.png).\
   The **Managed Accounts** page displays.
2. Locate the managed account you want to view the details for.
3. Click ![Ellipsis icon](https://files.readme.io/d2bc9c722920effce8dddffdbcb6267a0a2c306a684e8e45b33d3b1e183cf711-ellipsis.png) **> Go to Advanced Details**.\
   The **Advanced Details** page displays.
4. Managed account details, such as identification information, account settings, policies and attributes are displayed under **Details & Attributes** for quick access.
5. To see more granular details, click through the tabs in the **Advanced Details** pane to view details on each topic:
   * **Smart Groups** displays the groups that the user belongs to.
   * **Synced Accounts** allows you to sync managed accounts and their passwords with a managed primary account.
     * Locate the account you want to sync in the grid.
     * Check the box next to the account.
     * Click **+ Sync Accounts**, located above the grid.
   * **Events** displays events of the managed account.
     * **Filter by** further narrows results in the grid.
   * **Propagation Actions** allows you to assign one or more propagation actions to the account.
     * Locate the action you want to assign in the grid.
     * Check the box next to the action.
     * Click **Assign Propagation Action**, located above the grid.
   * **Password History** displays all previously used passwords for the account.

> ℹ️
>
> Click the **View Managed System** link above the grid to view the advanced details for the managed system associated with the managed account. To return to the advanced details for the managed account, click the **View Managed Account** link.

## Edit managed accounts.

1. From the left menu, click ![Managed Accounts icon](https://files.readme.io/a6badb503284a51e2a056527a81a01fcab939ddad30aa0b78498b7563e2b7603-managed-accounts.png).\
   The **Managed Accounts** page displays.
2. Locate the managed account you want to delete.
3. Click ![Ellipsis icon](https://files.readme.io/d2bc9c722920effce8dddffdbcb6267a0a2c306a684e8e45b33d3b1e183cf711-ellipsis.png) **> Edit Account**.
4. Make any necessary changes, and then click **Update Account**.

## Delete managed accounts

Managed accounts can be deleted, except for synced accounts. A message is displayed if an account cannot be deleted.

1. From the left menu, click ![Managed Accounts icon](https://files.readme.io/a6badb503284a51e2a056527a81a01fcab939ddad30aa0b78498b7563e2b7603-managed-accounts.png).\
   The **Managed Accounts** page displays.
2. Locate the managed account you want to delete.
3. Click ![Ellipsis icon](https://files.readme.io/d2bc9c722920effce8dddffdbcb6267a0a2c306a684e8e45b33d3b1e183cf711-ellipsis.png) **> Delete Account**.
4. Click **Delete** on the confirmation message.

## Test passwords for managed accounts

1. From the left menu, click ![Managed Accounts icon](https://files.readme.io/a6badb503284a51e2a056527a81a01fcab939ddad30aa0b78498b7563e2b7603-managed-accounts.png).\
   The **Managed Accounts** page displays.
2. Locate the managed account you want to test the password for.
3. Click ![Ellipsis icon](https://files.readme.io/d2bc9c722920effce8dddffdbcb6267a0a2c306a684e8e45b33d3b1e183cf711-ellipsis.png) **> Test Password**.

## Change passwords for managed accounts

1. From the left menu, click ![Managed Accounts icon](https://files.readme.io/a6badb503284a51e2a056527a81a01fcab939ddad30aa0b78498b7563e2b7603-managed-accounts.png).\
   The **Managed Accounts** page displays.
2. Locate the managed account you want to change the password for.
3. Click ![Ellipsis icon](https://files.readme.io/d2bc9c722920effce8dddffdbcb6267a0a2c306a684e8e45b33d3b1e183cf711-ellipsis.png) **> Change Password**.
4. A modal dialog box appears to confirm the change:

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/2c04b1ad9e2cb708b56bbb0ecaa58851ddc78c62d14e9fba68b2c305e9cbb542-confirmpassword.png",
        "",
        "Confirmation dialog for password change with checkbox and buttons for Cancel and Change Password."
      ],
      "align": "center",
      "sizing": "40% ",
      "border": true
    }
  ]
}
[/block]

<br />

5. Click **Change Password** on the confirmation message.

> ℹ️
>
> Selecting the **Don’t show me this again** checkbox suppresses the confirmation dialog for future password change actions. This setting is shared across both managed accounts and managed systems. If enabled for one, the dialog suppresses for both.
>
> When the **Don’t show me this again** checkbox is selected and you click **Changed Password**, the confirmation dialog is bypassed for future password change actions initiated from the grid. The password updates immediately without requiring additional confirmation.

## View password history for managed accounts

1. From the left menu, click ![Managed Accounts icon](https://files.readme.io/a6badb503284a51e2a056527a81a01fcab939ddad30aa0b78498b7563e2b7603-managed-accounts.png).\
   The **Managed Accounts** page displays.
2. Locate the managed account you want to view the password history for.
3. Click ![Ellipsis icon](https://files.readme.io/d2bc9c722920effce8dddffdbcb6267a0a2c306a684e8e45b33d3b1e183cf711-ellipsis.png) **> Password History**.\
   The **Password History** page displays.

## Unlink managed accounts

You can unlink managed accounts from managed systems; however, this applies to Active Directory accounts only. If accounts included in the unlink selection are not domain accounts, no action is taken on those accounts.

1. From the left menu, click ![Managed Accounts icon](https://files.readme.io/a6badb503284a51e2a056527a81a01fcab939ddad30aa0b78498b7563e2b7603-managed-accounts.png).\
   The **Managed Accounts** page displays.
2. Locate the managed account you want to unlink.
3. Check the box next to the account.
4. Click ![Unlink icon](https://files.readme.io/19d400b186e4bcd861434a2d2cf44032d70d35cdfd5f0f2df5ab760a5f843e2d-unlink.png) above the grid.
5. Click **Unlink** on the confirmation message.

## Configure subscriber accounts

> ℹ️ Subscriber Accounts vs. Synced Accounts
>
> * A parent account can have one or more synced accounts connected to it.
> * A child account is considered a subscriber account of its parent.
>
> You can view synced accounts in the Managed Account Details section of the parent account.
>
> In the Managed Accounts API, child accounts are labeled as subscriber accounts, and include the ID of their parent account.
>
> To enable Password Safe to update the account automatically, Automatic Password Management must be turned on for both the subscriber account and the associated managed system.

Any managed account can be synced to multiple accounts. These synced accounts become subscribers to the managed account. The managed account and all of its subscribers always share an identical password. When the password of the managed account or any of the subscriber accounts is changed, Password Safe automatically changes the password of the primary managed account and all of its subscribers to a new password.

> ℹ️
>
> To allow Password Safe to update the account, **Automatic Password Management** must be enabled for both the subscriber account and its associated Managed System.

Once an account is synchronized as a subscriber account, settings modifications are limited to:

* Enable API
* Allow for scanning
* Application

### Sync an account

To sync an account:

1. From the left menu, click ![Managed Accounts icon](https://files.readme.io/a6badb503284a51e2a056527a81a01fcab939ddad30aa0b78498b7563e2b7603-managed-accounts.png).\
   The **Managed Accounts** page displays.
2. Locate the managed account you want to sync.
3. Click ![Ellipsis icon](https://files.readme.io/d2bc9c722920effce8dddffdbcb6267a0a2c306a684e8e45b33d3b1e183cf711-ellipsis.png) **> Go to Advanced Details**.\
   The **Advanced Details** page displays.
4. Under **Advanced Details**, click **Synced Accounts**.
5. Select the account or multiple accounts that you want to sync to the managed account.
6. Click **+ Sync Accounts** above the grid.

### Remove a synced account

1. From the left menu, click ![Managed Accounts icon](https://files.readme.io/a6badb503284a51e2a056527a81a01fcab939ddad30aa0b78498b7563e2b7603-managed-accounts.png).\
   The **Managed Accounts** page displays.
2. Locate the managed account you want to change the password for.
3. Click ![Ellipsis icon](https://files.readme.io/d2bc9c722920effce8dddffdbcb6267a0a2c306a684e8e45b33d3b1e183cf711-ellipsis.png) **> Go to Advanced Details**.\
   The **Advanced Details** page displays.
4. Under **Advanced Details**, click **Synced Accounts**.
5. Select the account or multiple accounts that you want to unsync from the managed account.
6. Click ![Unlink icon](https://files.readme.io/19d400b186e4bcd861434a2d2cf44032d70d35cdfd5f0f2df5ab760a5f843e2d-unlink.png) above the grid.

## Configure password reset for managed account users

You can grant managed account users permission to reset the password on their own managed account, without granting them permission to reset passwords on other managed accounts. You can do this by creating a group, adding the managed account to the group, and then assigning permissions and the **Credential Manager** role to the group.

1. From the left menu, click ![](https://files.readme.io/320547984ba547444d375ab04a94c9ab7e3cdda3fbf7c26c896ce5e6426e52f3-configuration.png).\
   The **Configuration** page displays.

2. Under **Role Based Access** select **User Management**.\
   The **User Management** page displays.

3. From the **Groups** tab, click **+ Create New Group**.

4. Select **Create a New Group**.

5. Provide a name and description for the group.

6. Click **Create Group**.

7. From the **Group Details** pane, select **Users**.

8. Select users to add to the group, and then click **+ Assign User** above the grid.

9. From the **Group Details** pane, select **Features**.

10. Select the **Management Console Access** and Password Safe **Account Management** features.

11. Click **Assign Permissions** above the grid.

12. Select **Assign Permissions Read Only**. Do not grant **Full Control**.

13. From the **Group Details** pane, select **Smart Groups**.

14. Filter the list of Smart Groups by **Type > Managed Account**.

15. Select the Smart Group that contains the applicable managed accounts.

16. Click ![](https://files.readme.io/d2bc9c722920effce8dddffdbcb6267a0a2c306a684e8e45b33d3b1e183cf711-ellipsis.png) **> Edit Password Safe Roles**.\
    The **Password Safe Roles** pane displays.

17. Select the **Credentials Manager** role.

18. Click **Save Roles**.

### Reset password for managed accounts

The managed account user can now log in to the console and reset the password for the managed account as follows:

1. From the left menu, click ![Managed Accounts icon](https://files.readme.io/a6badb503284a51e2a056527a81a01fcab939ddad30aa0b78498b7563e2b7603-managed-accounts.png).\
   The **Managed Accounts** page displays.
2. Locate the managed account you want to change the password for.
3. Click ![Ellipsis icon](https://files.readme.io/d2bc9c722920effce8dddffdbcb6267a0a2c306a684e8e45b33d3b1e183cf711-ellipsis.png) **> Change Password**.\
   The **Advanced Details** page displays.

## Use a managed account as a discovery scan credential

A managed account can be used as a credential when configuring a Discovery Scan.

> ℹ️
>
> Once the **Scanner** option is enabled, the key must be specified again if the account is edited. It may be the same key or a new one.

The following credential types are supported:

* Windows
* SSH
* MySQL
* Microsoft SQL Server

The following platforms are supported:

* Windows
* MySQL
* Microsoft SQL Server
* Active Directory
* Any platform with the **IsUnix** flag (AIX, HP UX, DRAC, etc.)

To add the managed account as a scan credential:

1. From the left menu, click ![Managed Accounts icon](https://files.readme.io/a6badb503284a51e2a056527a81a01fcab939ddad30aa0b78498b7563e2b7603-managed-accounts.png).\
   The **Managed Accounts** page displays.
2. Locate the managed account you want to edit.
3. Click ![Ellipsis icon](https://files.readme.io/d2bc9c722920effce8dddffdbcb6267a0a2c306a684e8e45b33d3b1e183cf711-ellipsis.png) **> Edit Account**.\
   The **Edit** pane displays.
4. Expand **Scanner Settings**.
5. Click the toggle to enable the scanner.
6. Enter a name in **Scanner Credential Description** for the account that can be selected as the credential when setting up the scan details. The name is displayed on the **Credentials Management** dialog box when setting up the scan.
7. Assign and confirm a key so that only users that know the key can use the credential for scanning.
8. Click **Update Account**.

> ✅
>
> The Managed Account password can be up to 256 characters, however the password is limited to the length supported by the target platform. With scan credentials, keep in mind the password length limitations on that endpoint.

## Managed account aliasing

Aliases are accessible using the API only. Account mappings can be changed without affecting the alias name. At least one managed account is required to be mapped for the alias to be active; when an alias has two or more managed accounts mapped, it is considered to be highly available. An account can only be mapped to one alias. Managed account aliases can be accessed from **Configuration > Privileged Access Management > Managed Account Aliases**.

### Create a new alias

1. From the left menu, click ![](https://files.readme.io/320547984ba547444d375ab04a94c9ab7e3cdda3fbf7c26c896ce5e6426e52f3-configuration.png).\
   The **Configuration** page displays.

2. Under **Privileged Access Management** select **Managed Account Aliases**.\
   The **Managed Account Aliases** page displays.

3. Click **Create New Alias +**.

4. Enter a name, and then click **Create Alias**.

The new alias appears in the grid under **Account Mappings**, which displays all aliases ready to be mapped. New aliases show as **Unmapped** until they are associated with accounts.

> ℹ️
>
> Each managed account can only be mapped to a single alias.

You can use the **Show** dropdown to select which accounts to display: **All Accounts**, **Mapped**, or **Unmapped Accounts** only.

The **Filter-by** allows you to filter accounts by **System**, **Account Name**, **Account Status**, or **Last Changed Date**.

### Unmap an account

1. From the left menu, click ![](https://files.readme.io/320547984ba547444d375ab04a94c9ab7e3cdda3fbf7c26c896ce5e6426e52f3-configuration.png).\
   The **Configuration** page displays.

2. Under **Privileged Access Management** select **Managed Account Aliases**.\
   The **Managed Account Aliases** page displays.

3. Select the account that you want to unmap from the **Account Mappings** grid.

4. Click ![Unlink icon](https://files.readme.io/19d400b186e4bcd861434a2d2cf44032d70d35cdfd5f0f2df5ab760a5f843e2d-unlink.png) above the grid.

Mapped accounts have three status values:

* **Active:** The account credentials are current and can be requested.
* **Pending:** The account credentials are current but the password is queued to change.
* **Inactive:** The account password is changing.

The list of mapped accounts is rotated in a round-robin fashion, typically in order of last password change date. The preferred account, or the account whose status is active and has the oldest change date, is returned on the Alias API model.