Users & security | PRA Pathfinder

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. Sign into the Administration tenant located in the upper-right hand corner with administrative permission.
3. Click the hamburger menu in the upper left-hand corner of the window.
4. In the User Administration section, click User Management.
   The Organization Users page displays.

Add a new user

1. Click Invite User.
2. In User Details section, enter an Email Address, First Name, and Last Name. All fields are required.
3. In the User Permissions section, for Organization Role, select either Standard User or Administrator.
4. For Site Access, select the site(s) and at least one application you wish to grant user access to.
5. Click Invite User.

Edit a user

1. From the list of users, click the ellipsis .
2. Click Edit User.
3. Make the necessary changes, and then click Save Changes.

Delete a user

1. From the list of users, click the ellipsis .
2. Click Delete User.

• Allowed to access endpoints: Enables the user to use the access console in order to run sessions. If endpoint access is enabled, options pertaining to endpoint access will also be available.
• Session management
  • Allowed to share sessions with teams which they do not belong to: Enables the user to invite a less limited set of user to share sessions, not only their team members. Combined with the extended availability permission, this permission expands session sharing capabilities.
  • Allowed to invite external users: Enables the user to invite third-party users to participate in a session, one time only.
  • Remove User from session after inactivity: Sets the time interval to remove a user from a session after inactivity. Values range from No Timeout to 24 hours.
  • Allowed to enable extended availability mode: Enables the user to receive email invitations from other users requesting to share a session even when they are not logged into the access console.
  • Allowed to edit the external key: Enables the user to modify the external key from the session info pane of a session within the access console.
• User to user screen sharing
  • Allowed to show screen to other users: Enables the user to share their screen with another user without the receiving user having to join a session. This option is available even if the user is not in a session.
  • Allowed to give control when showing screen to other users: Enables the user sharing their screen to give keyboard and mouse control to the user viewing their screen.
• Jump Technology
  • Allowed Jump Item methods: Enables the user to Jump to computers using the following:
    • Jump Clients
    • Local Jump (Windows only)
    • Remote Jump
    • Remove VNC
    • Web Jump
    • Remote RDP
    • Shell Jump
    • Protocol Tunnel Jump
  • Jump Item Roles: A Jump Item Role is a predefined set of permissions regarding Jump Item management and usage. For each option, click Show to open the Jump Item Role in a new tab.
    • The Default role is used only when Use User's Default is set for that user in a Jump Group.
    • The Personal role applies only to Jump Items pinned to the user's personal list of Jump Items.
    • The Teams role applies to Jump Items pinned to the personal list of Jump Items of a team member of a lower role. For example, a team manager can view team leads' and team members' personal Jump Items, and a team lead can view team members' personal Jump Items.
    • The System role applies to all other Jump Items in the system. For most users, this should be set to No Access. If set to any other option, the user is added to Jump Groups to which they would not normally be assigned, and in the access console, they can see non-team members' personal lists of Jump Items.
    • The Endpoint automation role sets how a user can use endpoint automation.
      • Not allowed prevents them from seeing the Jump > Endpoint Automation tab altogether.
      • A User can create new automation jobs with these restrictions:
        • They are able to choose any existing Script Template but cannot edit the Script Template, Script Command, nor select or change the template accompanying Resources.
        • The Script Template, Script Command, Operating System, and Resources fields are unavailable.
        • They can run scripts only on Jump Items where their Jump Item Role includes the Start Sessions permission (set on the Jump > Jump Items Role page).
      • An Administrator has full access and ability to create Jobs, Scripts Templates, and Resources.

        ℹ️

        For more information, see Jump Item Roles and Endpoint Automation.

  • External tools
    • Enable static port and username for external tool sessions: This option accepts two values:
      • Enable: Ensures that the port and username generated for a user starting a session with a Jump item using external tools are preserved from session to session.
      • Disable: A new port number and username are randomly generated for that user every time they start a new session with each Jump item.