Users & security | PRA Cloud

What is the Users page?

The Users page allows administrators to manage individual user accounts, including creating, editing, and deleting accounts. It provides detailed control over user-specific settings, permissions, and roles within the Privileged Remote Access environment.

How is the Users page useful to my organization?

The Users page enables administrators to customize access and permissions for each user, ensuring security and proper role alignment. It also allows for efficient user management, helping to maintain compliance and support operational needs.

How do I access the Users page?

Use a Chromium-based browser to sign in to your Privileged Remote Access URL.
This URL is provided in the BeyondTrust welcome email and includes your site URL followed by /login.
From the left menu, click Users & Security.
The Users page opens and displays by default.

User accounts

View information about all users who have access to your B Series Appliance, including local users and those who have access through security provider integration.

Add user, edit, delete

Create a new account, modify an existing account, or remove an existing account. You cannot delete your own account.

Search users

Search for a specific user account based on username, display name, or email address.

Security provider

Select a security provider type from the dropdown to filter the list of users by security provider.

Synchronize

Synchronize the users and groups associated with an external security provider. Synchronization occurs automatically once a day. Clicking this button forces a manual synchronization.

Reset failed login attempts and unlock account

If a user has one or more failed login attempts, click the Reset button for their user account to reset the number back to zero.

If a user becomes locked due to too many failed consecutive login attempts, click the Unlock Account button for their user account to reset the number back to zero and unlock their account.

User account report

At the bottom of the page, export detailed information about your users for auditing purposes. Gather detailed information for all users, users from a specific security provider, or just local users. Information collected includes group policy and team memberships and permissions.

Add or edit user

Username: Unique identifier used to log in.
Display name: User's name as shown in team chats, in reports, etc.
Email address: Set the email address to where email notifications are sent, such as password resets or extended availability mode alerts.
Password: Password used with the username to log in. The password may be set to whatever you choose, as long as the string complies with the defined policy set on the /login > Management > Security page.
Must reset password at next login: If this option is selected, then the user must reset their password at next login.
Password never expires: Check this box to set the user's password to never expire.
Password expiration date: Set a date for the password to expire.

Memberships

Account settings

General permissions

Access permissions

Allowed to access endpoints: Enables the user to use the access console in order to run sessions. If endpoint access is enabled, options pertaining to endpoint access will also be available.
Session management
- Allowed to share sessions with teams which they do not belong to: Enables the user to invite a less limited set of user to share sessions, not only their team members. Combined with the extended availability permission, this permission expands session sharing capabilities.
- Allowed to invite external users: Enables the user to invite third-party users to participate in a session, one time only.
- Remove User from session after inactivity: Sets the time interval to remove a user from a session after inactivity. Values range from No Timeout to 24 hours.
- Allowed to enable extended availability mode: Enables the user to receive email invitations from other users requesting to share a session even when they are not logged into the access console.
- Allowed to edit the external key: Enables the user to modify the external key from the session info pane of a session within the access console.
User to user screen sharing
- Allowed to show screen to other users: Enables the user to share their screen with another user without the receiving user having to join a session. This option is available even if the user is not in a session.
- Allowed to give control when showing screen to other users: Enables the user sharing their screen to give keyboard and mouse control to the user viewing their screen.
Jump Technology
- Allowed Jump Item methods: Enables the user to Jump to computers using the following:
  - Jump Clients
  - Local Jump (Windows only)
  - Remote Jump
  - Remove VNC
  - Web Jump
  - Remote RDP
  - Shell Jump
  - Protocol Tunnel Jump
- Jump Item Roles: A Jump Item Role is a predefined set of permissions regarding Jump Item management and usage. For each option, click Show to open the Jump Item Role in a new tab.
  - The Default role is used only when Use User's Default is set for that user in a Jump Group.
  - The Personal role applies only to Jump Items pinned to the user's personal list of Jump Items.
  - The Teams role applies to Jump Items pinned to the personal list of Jump Items of a team member of a lower role. For example, a team manager can view team leads' and team members' personal Jump Items, and a team lead can view team members' personal Jump Items.
  - The System role applies to all other Jump Items in the system. For most users, this should be set to No Access. If set to any other option, the user is added to Jump Groups to which they would not normally be assigned, and in the access console, they can see non-team members' personal lists of Jump Items.
  - The Endpoint automation role sets how a user can use endpoint automation.
    - Not allowed prevents them from seeing the Jump > Endpoint Automation tab altogether.
    - A User can create new automation jobs with these restrictions:
      - They are able to choose any existing Script Template but cannot edit the Script Template, Script Command, nor select or change the template accompanying Resources.
      - The Script Template, Script Command, Operating System, and Resources fields are unavailable.
      - They can run scripts only on Jump Items where their Jump Item Role includes the Start Sessions permission (set on the Jump > Jump Items Role page).
      - An Administrator has full access and ability to create Jobs, Scripts Templates, and Resources.
      ℹ️
      For more information, see Jump Item Roles and Endpoint Automation.
  - External tools
    - Enable static port and username for external tool sessions: This option accepts two values:
      - Enable: Ensures that the port and username generated for a user starting a session with a Jump item using external tools are preserved from session to session.
      - Disable: A new port number and username are randomly generated for that user every time they start a new session with each Jump item.

Session permissions

Availability settings