---
updatedAt: 2026-03-27T16:09:39.000Z
---

# Functional Accounts | PS Pathfinder

Configure Functional Account Requirements in Entra ID

Follow the steps below to set up Entra ID for use with BeyondTrust Password Safe.

* Create enterprise application
* Configure app registration
* BeyondTrust Password Safe configuration
* Create a second enterprise application

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/715ef47fe629589f918c6a4599b315356dcc7a6b19a1852c7d88d7bf013cfd2b-functional_account.png",
        "",
        "Functional Accounts page"
      ],
      "align": "center",
      "border": true,
      "caption": "Functional Accounts page"
    }
  ]
}
[/block]

> ℹ️
>
> Accounts can be managed with or without multifactor authentication enabled in Azure.

## Create enterprise application

Create this enterprise application to map to the Application (Client) ID for the functional account.

1. In Microsoft Azure, go to **Enterprise Applications** and select **New application**.
2. Select **Create your own application**.
3. Name your application, select the application type (**App you're developing**) and click **Create**.
4. Update the name if necessary, select the **Supported Account Types** (**this directory only**) and click **Register**.
5. Under **Properties**, disable **Assignment required** and **Visible to users**, and click **Save**.

## Configure app registration

1. In **Overview** section, copy the **Application (Client) ID** and **Directory (Tenant) ID**. These are needed later to configure the Password Safe functional account.
2. In the **Authentication** section, enable **Allow public client flows**, and click **Save**.
3. In the **Certificates and secrets** section, click **New client secret**. Enter the **Description**, an expiration date, and click **Add**.
4. Copy the secret **Value**. This is needed later to configure the Password Safe functional account.

> ℹ️
>
> The value is displayed only once, immediately after adding the new secret.

5. In the **API permissions** section, add **Microsoft Graph**, and select type **Application permissions**.
6. Add Microsoft Graph application permission **UserAuthenticationMethod.ReadWrite.All**, **Domain.Read.All**, **Group.Read.All**, and **User.EnableDisableAccount.All**.
7. If **User.Read** is not already added, select **Delegated permissions** and add it.
8. Click **Add Permissions**.
9. Click **Grant admin consent for** for your organization, and click **Yes** on the confirmation message.
10. From the main menu, select **Roles and administrators**, then select the **Helpdesk administrator** role.
11. Click **Add assignments**, then assign the application to the **Helpdesk administrator** role.

This completes configuration in Microsoft Azure. The remaining steps are done in BeyondTrust Password Safe.

## BeyondTrust Password Safe configuration

1. At the top left of the page, click ![Main menu icon](https://files.readme.io/8008765b74ecfb3975c6ad5d13f4705ec95477331afdfe9472f38b917fc0baf3-menu.png) **> Password Safe > Configuration**.\
   The **Configuration** page displays. You can also click the **Configuration** container card on the **Password Safe** page.
2. Under **Privileged Access Management**, select **Functional Accounts**.\
   The **Functional Accounts** page displays.
3. Click **+ Create New Functional Account**.
4. For the **Entity Type**, select **Directory**.
5. For the **Platform**, select **Microsoft Entra ID**.
6. Select the Azure scope: **Public** or **US Government** (supports Azure GCC High).
7. Enter the **Username** in UPN format.
8. Enter the previously saved values for the **Application (Client) ID**, **Tenant ID**, and **Client Secret**.
9. Set the **Alias**.
10. Click **Create Functional Account**.
11. At the top left of the page, click ![Main menu icon](https://files.readme.io/8008765b74ecfb3975c6ad5d13f4705ec95477331afdfe9472f38b917fc0baf3-menu.png) **> Password Safe > Managed Systems**.\
    The **Managed Systems** page displays. You can also click the **Managed Systems** container card on the **Password Safe** page.
12. For the **Entity Type**, select **Directory**.
13. For the **Platform**, select **Entra ID**.
14. Enter the **Domain**, select the **Functional Account** created above, and select the **Account Name Format**.
15. Click **Create Managed System**.

## Create the managed account manually

1. At the top left of the page, click ![Main menu icon](https://files.readme.io/8008765b74ecfb3975c6ad5d13f4705ec95477331afdfe9472f38b917fc0baf3-menu.png) **> Password Safe > Managed Systems**.\
   The **Managed Systems** page displays. You can also click the **Managed Systems** container card on the **Password Safe** page.
2. Locate the Managed System created above.
3. Click ![Ellipsis icon](https://files.readme.io/d9ea95bf32c9b0ffd4e11cd1436a37a14108d6e228557fd798168ac3a0ca0bbe-ellipsis.png) **> Create New Managed Account**.
4. Enter the **Username** in UPN format.
5. Enter **ObjectId** for the **User** and **UPN**.

## Create the managed account using a Smart Rule

* Accounts can be onboarded by using **Group Name** or **UPN** (starts with/ends with) filters.

### Create a second enterprise application

Create a second enterprise application to test the Password Safe managed account. The managed account must be a user of the application you create in this section.

Ensure the following properties are set when creating this enterprise application:

* **Assignment required**: Set to **Yes** or **No**. The test application can either have assignment required (all managed accounts must be assigned to test passwords) or it can have assignment not required.
* In **Advanced settings**, **Allow public client flows** is set to **Yes**.
* API permissions, Microsoft Graph **User.Read**(delegated permission) with the status set to **Grant admin consent**.
* Create or use an existing Key Vault. Assign Key Vault Readers access to the Password Safe applications.
* Create a secret in Key Vault. You can also use the existing secret from the Functional Account.

In Password Safe, edit the functional account:

* Update the functional account with the new Client ID in the **Test Application (Client) ID** field.
* Update the secret if a new one was created.