Account groups

What are account groups?

Vault account groups are collections of user accounts within the Vault system, organized based on access permissions or roles. These groups are used to streamline the management of shared Vault accounts that enable Vault administrators to efficiently grant users access to multiple shared accounts. Account groups can also associate a group of shared Vault accounts with a specific group policy.

📘

Note

Shared Vault accounts can only belong to one group at a time, and personal Vault accounts cannot be added to an account group.

How are account groups useful to my organization?

Account groups help simplify credential management which allow administrators to assign access to multiple shared Vault accounts at once. This ensures efficient and controlled access for users. These groups also provide an effective way to apply policies to a collection of shared accounts which enhance security and compliance while reducing administrative overhead.

How do I access the Account Groups page?

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. From the main menu, click Privileged Remote Access > Vault.
   The Vault page opens and the Accounts tab displays by default.
3. Click the Account Groups tab.
   The Account Groups tab displays.

The Account Groups page

Vault admins can use account groups to logically group credentials together, granting users access to multiple shared Vault accounts at one time. Account groups can also be associated to a group policy, allowing policy members to access that group of shared Vault accounts.

1. Left menu: Easy access to all pages in Privilege Remote Access, including Status, Consoles & Downloads, My Account, Configuration, Jump, Vault, Console Settings, Users & Security, Reports, Management, and Appliance pages.
2. Status: Opens the Status page.
3. Header: Change your tenant site, manage your profile, and access documentation.

4. Add: Add a new Account Group.
5. Filter: Search on a Name or Description.
6. Account Group columns: The list of columns varies on what columns you choose to display.

   Account Group columns

   • Name: Unique name of the account.

   • Description: A brief description of the Account Group.

   • Account Policy: Select an existing policy or specify a custom policy.

7. Account Group options: Edit an Account Group or delete an Account Group.

Add an Account Group

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.

2. From the main menu, click Privileged Remote Access > Vault.

3. The Vault page opens and the Accounts tab displays by default.

4. Click the Account Groups tab.

5. Click Add.
   The Add Account Group page displays.

6. In the Name field, enter a name for the account.

7. In the Description field, enter a useful description for the account.

8. Select a specific policy for the account group or leave Account Policy set to the default value of Inherit Policy Settings. If Inherit Policy Settings is selected, the accounts in this account group inherit the policy settings set for the global default account policy on the Vault > Options page.

9. Under Accounts, select the group from the Source Account Group list, and then select the accounts to add to this group.

ℹ️

Note

The Default Group is a system generated group that contains all user accounts that do not belong to an account group. The Default Group is selected by default.

You can filter the list of available accounts to add to the group by selecting a group from the Source Account Group list or by using the Search Selected Account Group box to search by Name, Endpoint, and Description.

6. Click Add to move the accounts over to the Accounts in This Group list.

7. In the Allowed Users section, add a user and select their Vault role from the New Member Role dropdown, and then click Add. Users can be assigned one of two member roles:

   • Inject: Users with this role can use this account in Secure Remote Access sessions (default value).
   • Inject and Checkout: Users with this role can use this account in Secure Remote Access sessions and can check out the account on Support for Admins. The Checkout permission has no effect on generic SSH accounts.

8. Select the type of Jump Item Associations for the account. The Jump Item Associations setting determines which Jump Items the account is associated with, so the account is available only for relevant target computers in the console during credential injection attempts.

   Select one of the following types:

   Jump Item Association Type	Description
   Inherited from the Account Group	Associations for this account are determined by the associations defined in this account's Account Group.
   Any Jump Items	This account can be injected within any session started from a Jump Item in which the account is applicable. The applicable accounts are the following: Local Accounts- discovered on a Vault Endpoint are available for injection on Jump Items targeting the Endpoint. Domain Accounts- are available for injection on Jump Items targeting Vault Endpoints on the Domain. All Domain Accounts- are available for injection on Jump Items targeting remote systems that do not match a Vault Endpoint. Shared Generic Username & Password Accounts- are available for injection into all Jump Items. Shared Generic SSH Accounts- are available for injection into all Shell Jump Shortcuts. Shared Generic Token Accounts- are available for injection into all Kubernetes Cluster Tunnel Jump Shortcuts. ℹ️ Note Personal Jump Items are not supported..
   No Jump Items	This account cannot be injected into any session started from a Jump Item.
   Jump Items Matching Criteria	This account can be injected only within sessions started from Jump Items that match the criteria you define, in which the account is applicable. The applicable accounts are the following: Local Accounts- discovered on a Vault Endpoint are available for injection on Jump Items targeting the Endpoint. Domain Accounts- are available for injection on Jump Items targeting Vault Endpoints on the Domain. All Domain Accounts- are available for injection on Jump Items targeting remote systems that do not match a Vault Endpoint. Shared Generic Username & Password Accounts- are available for injection into all Jump Items. Shared Generic SSH Accounts- are available for injection into all Shell Jump Shortcuts. Shared Generic Token Accounts- are available for injection into all Kubernetes Cluster Tunnel Jump Shortcuts. ℹ️ Note Personal Jump Items are not supported.. If the Jump Item Attributes section is configured, this list combines with any Jump Items that match the criteria. The following Jump Methods are supported: Jump Client Remote RDP Remote Jump Shell Jump Protocol Tunnel Jump Web Jump Injection is not supported for the following items: Personal Jump Items TCP Tunnel Protocol Tunnel Jump Shortcuts IP Tunnel Protocol Tunnel Jump Shortcuts

   📘

   Note

   You can define a direct association between Vault accounts and specific Jump Items by selecting the Jump Items from the list and then click Add Jump Item.

   If configured, the account is available for injection for any Jump Items that match the specified attribute criteria in addition to any specific Jump Items you added as matching criteria.

   Local accounts are available for injection within the endpoints on which they were discovered.

   
   

   You can further define the association between Vault accounts and Jump Items by specifying matching criteria. Each of the following values have a maximum length of 64 characters and can contain a maximum of 32 values.

   The different Jump Item attributes are the following:

   • Name: This filter is matched against the value that appears in the Name column of the Jump Item in the console.
   • Hostname / IP: This filter is matched against the value that appears in the Hostname / IP column of the Jump Item in the console.
   • Tag: This filter is matched against the value that appears in the Tag column of the Jump Item in the console.
   • Comments: This filter is matched against the value that appears in the Comments column of the Jump Item in the console.

   For example, a list of filter criteria is:

   Criteria	Result
   value	matches the field exactly.
   value*	matches the field as a prefix.
   *value	matches the field as a suffix.
   **value**	matches if the field contains the value

9. Click Save at the top of the page.

Add an Account Group to an existing shared account

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. From the main menu, click Privileged Remote Access > Vault.
   The Vault page opens and the Accounts tab displays by default.
3. From an existing shared account, click the ellipsis button, and then select Edit.
4. Select the group from the Account Group list, and then click Save.

Import a discovered account

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.

2. From the main menu, click Privileged Remote Access > Vault.
   The Vault page opens and the Accounts tab displays by default.

3. Click the Discovery tab.

4. From the Discovery Jobs section, select a Discovery Job.

5. Click View Results for the job.

6. Select the Local Accounts or Domain Accounts tab as applicable.

7. From the list of accounts, select the account you wish to import.

8. Click Import Selected.

9. Select the group from the Account Group list.

10. Click Start Import.

Add an account group to a group policy

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.

2. From the main menu, click Privileged Remote Access > Users & Security.
   The User page opens and displays by default.

3. Click the Group Policies tab

4. From the list of existing group policies, click the pencil to edit a policy.

5. Scroll down to the Memberships section.

6. Check the Add Vault Account Group Memberships checkbox.

7. Select the Account Group from the list.

8. Select the Vault Account Role from the list.
   Users can be assigned one of two member roles:

   • Inject: Users with this role can use this account in Secure Remote Access sessions (default value).
   • Inject and Checkout: Users with this role can use this account in Secure Remote Access sessions and can check out the account on Support for Admins. The Checkout permission has no effect on generic SSH accounts.

9. Click Add.

10. Click Save at the top of the page.

11. The group policy and its Vault account role are now displayed under the Group Policies section for the account group that was added to the policy.

12. The members of the group policy are now added under Allowed Users for the account group.

ℹ️

Note

If a user was granted access individually from the account group edit page and also through a group policy, the group policy access is overridden by the explicitly granted individual access for this user.

Search Account Groups

You can filter the list of available account groups by using the Search Account Groups box. Based on the account type, you can use Name or Description as the criteria to search.

Edit an Account Group

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.

2. From the main menu, click Privileged Remote Access > Vault.
   The Vault page opens and the Accounts tab displays by default.

3. Click the Account Group tab.
   The Account Groups page displays.

4. Select a group in the list.

5. Click the pencil to edit a group.

6. Make the necessary changes, and then click Save.

Delete an Account Group

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.

2. From the main menu, click Privileged Remote Access > Vault.
   The Vault page opens and the Accounts tab displays by default.

3. Click the Account Group tab.
   The Account Groups page displays.

4. Select a group in the list.

5. Click the trash can to delete a group.

6. Click Yes.