Session policies

What are session policies?

Session policies define session security permissions tailored to specific scenarios. They can be applied to users, public sites, and all Jump Items. The Session Policies section lists available policies. When you click the arrow by a policy name it does the following:

• Can quickly see where the policy is being used
• Displays availability for users, access invites, and Jump Clients
• Displays the tools configured.

How are session policies useful?

Session policies enhance security and flexibility by allowing administrators to control session behavior and permissions for users, public sites, and Jump Items based on organizational needs.

How do I access the Session Policies page?

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. From the main menu, click Privileged Remote Access > Users & Security.
   The User & Security page opens and the Users tab displays by default.
3. Click the Session Policies tab.
   The Session Policies tab displays.

The Sessions Policies page

1. Left menu: Easy access to all pages in Privilege Remote Access, including Home, Status, Consoles & Downloads, My Account, Configuration, Jump, Vault, Console Settings, Users & Security, Reports, Management, and Appliance pages.

2. Status: Takes you to the Status page.

3. Header: Change tenant site and obtain user profile setting information.

4. Add:- Adds a new session policy.

5. Session Policies columns: The list of Session Policies columns.

   Vendors Group columns

   • Display Name: Unique name of the session policy.
   • Availability/Usage: Displays the user and groups as defined in the Availability section.
   • Description: Detailed comments of the policy.

6. Special Actions list options: Copy, edit or delete a session policy.

Add a session policy

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. From the main menu, click Privileged Remote Access > Users & Security.
   The User & Security page opens and the Users tab displays by default.
3. Click the Session Policies tab.
   The Session Policies tab displays.
4. Click Add.
   The Add Session Policy page displays.
5. For Display Name, create a unique name to help identify this policy. This name helps when assigning a session policy to users and Jump Clients.
6. For Code Name, set a code name for integration purposes. If you do not set a code name, one is created automatically for you.
7. For Description, add a brief description to summarize the purpose of this policy. The description is seen when applying a policy to user accounts, group policies, and access invites.

Availability

1. In the Availability section, for Users, select this to allow users (user accounts and group policies) be assigned to the policy.
2. In the Availability section, for Access Invite, select this to allow users to invite external users to join a session.
3. In the Availability section, for Jump Items, select this to allow users with appropriate permissions to assign this policy to Jump Items.
4. In the Availability section, for Dependents, this field is only displayed if this session policy is already in use. It displays the number of users and Jump Clients using this policy.

Permissions

For all of the permissions that follow, you can choose to enable or disable the permission, or you can choose to set it to Not Defined.

❗️

Important

Session policies are applied to a session in a hierarchical manner, with Jump Clients taking the highest priority, then users, and then the global default. If multiple policies apply to a session, then the policy with the highest priority will take precedence over the others.

If, for example, the policy applied to a Jump Client defines a permission, then no other policies may change that permission for the session. To make a permission available for a lower policy to define, leave that permission set to Not Defined.

You can set which tools should be enabled or disabled with this policy, by selecting any one of the following permissions:

Edit a session policy

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. From the main menu, click Privileged Remote Access > Users & Security.
   The User & Security page opens and the Users tab displays by default.
3. Click the Session Policies tab.
   The Session Policies tab displays.

Delete a session policy

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. From the main menu, click Privileged Remote Access > Users & Security.
   The User & Security page opens and the Users tab displays by default.
3. Click the Session Policies tab.
   The Session Policies tab displays.

Copy a session policy

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. From the main menu, click Privileged Remote Access > Users & Security.
   The User & Security page opens and the Users tab displays by default.
3. Click the Session Policies tab.
   The Session Policies tab displays.

To expedite the creation of similar policies, click Copy to create a new policy with identical settings. You can then edit this new policy to meet your specific requirements.

Export policy

You can export a session policy from one site and import those permissions into a policy on another site.

To export a saved policy file, do the following:

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. From the main menu, click Privileged Remote Access > Users & Security.
   The User & Security page opens and the Users tab displays by default.
3. Click the Session Policies tab.
   The Session Policies tab displays.
4. Edit an existing policy file, click the pencil.
5. Scroll to the bottom of the page, click Export Policy, and save the file.

Import policy

You may import those policy settings to any other BeyondTrust site that supports session policy import.

To import a saved policy file, do the following:

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. From the main menu, click Privileged Remote Access > Users & Security.
   The User & Security page opens and the Users tab displays by default.
3. Click the Session Policies tab.
   The Session Policies tab displays.
4. Edit an existing policy file, click the pencil.
5. Scroll to the bottom of the page, click + Select Policy File.
6. From the Open dialog box, located the exported policy file. The default extension is .bgo.
7. Select the exported policy file, click Open.
8. Once the policy file is uploaded, the Edit Session Policy page displays, which allows you to make modifications. After the modifications are made, click Save.

Session Policy Simulator

Because layering policies can be complex, you can use the Session Policy Simulator to determine what the outcome will be. Additionally, you could use the simulator to troubleshoot why a permission is not available when you expected it to be.

To use the Session Policy simulator, do the following:

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. From the main menu, click Privileged Remote Access > Users & Security.
   The User & Security page opens and the Users tab displays by default.
3. Click the Session Policies tab.
   The Session Policies tab displays.
4. Go to the Session Policy Simulator section.
5. For User, select the user performing the session. This dropdown includes both user accounts and access invite policies.
6. For Session Start Method, select a valid method.
7. For Jump Client or Jump Shortcut, search the client or shortcut by name, comments, Jump group, or tag.
8. Click Simulate.
   In the results, the permissions configurable by session policy are displayed in read-only mode. You can see which permissions are allowed or denied as a result of the stacked policies, as well as which policy set each permission.