Documentation

BeyondTrust Password Safe (cloud) | Insights

Learn how to create a Password Safe connector in BeyondTrust Identity Security Insights (Insights).

The Password Safe connector gives Insights visibility into your organization's privileged account landscape:

  • Insights periodically collects identity and account data from Password Safe, including managed accounts, managed systems, user roles, and vault accounts. This data populates the Insights dashboards and feeds identity analytics, detections, and recommendations.
  • When you generate an Insights installation key in Password Safe (requires Password Safe 24.1.1 or later), the Password Safe event service forwards discovery scan results to Insights as they occur. This gives Insights immediate visibility into newly discovered accounts and systems across your network.

Insights connectors support both cloud and on-premises instances.

ℹ️

For Password Safe cloud information, see BeyondTrust Password Safe (on-prem).

Prerequisites

Before you configure the Password Safe connector, ensure the following requirements are met.

BeyondTrust Password Safe access

  • Administrator access to Password Safe.
  • Password Safe 24.1.1 or later is installed (required for installation key support).
  • You can create API registrations in BeyondInsight.
  • You can create users and groups with role-based access in Password Safe.

Identity Security Insights access

  • Administrator access to Identity Security Insights.
  • Your Insights site is provisioned and active.

Network requirements

The Insights IP addresses for your region are allowlisted in BeyondInsight. See Step 1 for the full IP list.

Configuration path

Before you begin, identify the configuration options that apply to your environment. Your selections determine which steps you complete.

PathWhen to use
Password Safe CloudYour Password Safe instance is cloud-hosted on BeyondTrust Cloud
Password Safe On-PremisesYour Password Safe instance is deployed on-premises in your own infrastructure. See BeyondTrust Password Safe (on-prem).
ℹ️

If using Password Safe Cloud on the Pathfinder platform, see the Pathfinder-specific note in Step 2.

Step 1: Create an API Registration in BeyondInsight

  1. Log in to BeyondInsight.

  2. From the left menu, select Configuration > General > API Registrations.

  3. Click Create API Registration.

  4. Select API Key Policy from the dropdown.

  5. Enter the API's details:

    • Enter a name for the new registration.
    • Select your desired rule options.
    • Optionally, check the User password required box to add a password for the connector.

  6. Add Authentication Rules (one for each Insights IP address for your region):

    1. Under Authentication Rules, click Add Authentication Rule.

    2. From the Type drop-down menu, select Single IP Address.

    3. Add the IP addresses for your region:

      RegionIP addresses
      US50.16.236.14, 54.163.153.193, 54.225.135.48
      EU3.72.126.244, 3.78.41.126, 3.125.93.216
      UK18.130.205.142, 18.133.85.99, 18.135.255.23
      CA35.182.121.100, 3.97.211.0, 3.96.180.135
      IN65.2.101.179, 52.66.21.171, 3.108.43.201
      AU52.64.252.137, 54.252.35.200, 54.153.250.211
      ℹ️

      • Determine the location of your site by clicking Administration on the Insights Home page.
      • For FedRAMP connectors, refer to the IP address shown on the Create Connector page.

    4. Click Create Rule.

    5. Repeat for all remaining IP addresses.

  7. On the registration's details page, check the Active box.

  8. Click Create Registration.

The API is registered. Record the API Key. You need the key in Step 4.

Step 2: Create a user in Password Safe

ℹ️

We recommend creating a new user dedicated to Identity Security Insights. Because this user allows Insights to access Password Safe, a dedicated account is easier to manage and audit.

Standard Password Safe Cloud

  1. Log in to Password Safe.
  2. From the left menu, select Configuration > Role Based Access > User Management.
  3. Click Users.
  4. Click +Create New User.
  5. Click Create a New User.
  6. Enter all Identification fields (required). Optionally, enter the user's contact information.
  7. Select an Activation Date and an Expiration Date for the user account.
  8. Check User Active to activate the user account.
  9. Set Two-Factor Authentication to None.
  10. Click Create User.

The user is created and ready for group assignment in Step 3.

Password Safe Cloud on Pathfinder

If your Password Safe Cloud instance is on the Pathfinder platform, create the user as follows:

  1. Sign in to app.beyondtrust.io.
  2. At the top right of the page, click your site name to display a drop-down menu.
  3. Select Administration.
  4. From the top left of the page, select Pathfinder navigation menu > Administration > User Management.
  5. Click Invite User.
  6. Select specific sites and associated applications for the user to access.
  7. Click Invite User.

Then complete the standard Password Safe user creation:

  1. Log in to Password Safe.
  2. From the left menu, select Configuration > Role Based Access > User Management.
  3. Click Users > +Create New User > Create a New User.
  4. Enter all Identification fields (required). Optionally, enter the user's contact information.
  5. Select an Activation Date and an Expiration Date for the user account.
  6. Check User Active to activate the user account.
  7. Set Two-Factor Authentication to None.
  8. Click Create User.

The user is created and ready for group assignment in Step 3.

Step 3: Create and configure a group in Password Safe

  1. Sign in to Password Safe.
  2. From the left menu, select Configuration > Role Based Access > User Management.
  3. Click Groups.
  4. Click Create a New Group.
  5. Enter a group Name and Description.
  6. Click Create Group.

Assign the user to the group

  1. Under Group Details, select Users.
  2. From the Show drop-down list, select Users not assigned.
  3. Locate the user created in Step 2 (or an existing user you wish to use).
  4. Click Assign User.

Configure API access for the group

  1. Under Group Details, select API Registrations.
  2. Check the box next to the API registration created in Step 1.

Assign feature permissions to the group

  1. Under Group Details, select Features.
  2. From the Show dropdown menu, select All Features.
  3. Select the following features:
    • Analytics and Reporting
    • Asset Management
    • Password Safe Account Management
    • Password Safe Role Management
    • Password Safe System Management
    • Ticket System
    • User Accounts Management
  4. Click Assign Permissions > Assign Permissions Read Only.
  5. Click User Audits > Assign Permissions Full Control.

Assign read-only permissions to all Smart Groups

  1. Under Group Details, select Smart Groups.
  2. From the Show dropdown menu, select All Smart Groups.
  3. Select ALL Smart Group.
  4. Click Assign Permissions, and select Assign Permissions Read Only.

Assign All Assets Smart Group roles

  1. Under Group Details, select Smart Groups.
  2. From the Show dropdown menu, select All Smart Groups.
  3. Select the All Assets Smart Group.
  4. Click the vertical ellipsis button (⋮) for the All Assets Smart Group.
  5. Select Edit Password Safe Roles.
  6. Check the Auditor box.
  7. Click Save Roles.

Step 4: Create the connector in Insights

  1. From Insights Home, select Pathfinder navigation menu > Connectors.

  2. Click Total configured.

  3. Click + Create Connector > Password Safe Cloud.

    The configuration settings for a Password Safe cloud connector in Insights

  4. Enter the connector details:

    • Name: A human-readable name for your Password Safe Cloud connector.

    • Domain: Your Password Safe Cloud domain (e.g., https://company.ps.beyondtrustcloud.com).

    • API Key: Paste the API key created in Step 1.

    • Use password: Select Yes or No based on whether the User password required option is enabled in your API registration.

      ℹ️

      To check: In Password Safe, navigate to Configuration > General > API Registrations. In the Details panel, check the Authentication Rules Options section.

    • Username: Enter the username of the user created in Step 2 (or the existing user assigned to the group in Step 3).

  5. Click Create Connector.

⚠️

Important

An installation key displays. Do not close this panel until you complete the Final step.

  1. Copy the installation key.

Final step: Enable the installation key in Password Safe

  1. Open Password Safe Cloud.
  2. From the left menu, click Configuration > Identity Security Insights > Connect to Identity Security Insights.
  3. In the Connector Key field, paste the installation key copied in Step 4.
  4. Click Update Settings.
  5. Confirm the toggle is Enabled.

Verify the connector (optional)

  1. In Identity Security Insights, select Pathfinder navigation menu > Connectors.
  2. Click Total configured.
  3. Locate Password Safe Cloud in the list.
  4. Click the vertical ellipsis button (⋮) > View Connector.
  5. Review connector settings and confirm the status.

Updated 6 days ago

©2003-2026 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.