---
updatedAt: 2026-07-16T20:56:41.000Z
---

# Account Groups | RS On-prem

## What are account groups?

Vault account groups are collections of user accounts within the Vault system, organized based on access permissions or roles. These groups are used to streamline the management of shared Vault accounts, enabling Vault administrators to efficiently grant users access to multiple shared accounts. Account groups can also associate a group of shared Vault accounts with a specific group policy. Note that shared Vault accounts can only belong to one group at a time, and personal Vault accounts cannot be added to an account group.

## How are account groups useful to my organization?

Account groups help simplify credential management by allowing administrators to assign access to multiple shared Vault accounts at once, ensuring efficient and controlled access for users. These groups also provide an effective way to apply policies to a collection of shared accounts, enhancing security and compliance while reducing administrative overhead.

> ℹ️
>
> A shared Vault account can belong to only one group at a time and personal Vault accounts cannot be added to an account group.

## How do I access the Account Groups page?

1. Use a Chromium-based browser to sign in to your Remote Support URL.\
   This URL is provided in the BeyondTrust welcome email and includes your site URL followed by **/login**.
2. From the left menu, click **Vault**.\
   The **Accounts** page opens and displays by default.
3. At the top of the page, click **Account Groups**.\
   The **Account Groups** page displays.

## The Account Groups page

Vault admins can use account groups to logically group credentials together, granting users access to multiple shared Vault accounts at one time. Account groups can also be associated to a group policy, allowing policy members to access that group of shared Vault accounts.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/ca697295ffc3ad3032afe8ceb92dd035cfb520c737c86ebc03614ce7d40c9524-account-groups-steps-light.png",
        "",
        ""
      ],
      "align": "center"
    }
  ]
}
[/block]

1. **Add:** [Add a new Account Group](#add-an-account-group).
2. **Filter:** Search on a **Name** or **Description**.
3. **Account Groups columns:** The list of columns varies on what columns you choose to display.

   <Accordion title="Account Groups columns">

   - **Name:** Unique name of the account.
   - **Description:** A brief description of the Account Group.
   - **Account Policy:** Select an existing policy or specify a custom policy.
     </Accordion>
4. **Account Groups options**:  [Edit an Account Group](#edit-an-account-group) or [delete an Account Group](#delete-an-account-group).

## Add an Account Group

1. At the top of the page, click **Add**.\
   The **Add Account Group** page displays.

2. In the **Name** field, enter a name for the account.

3. In the **Description** field, enter a useful description for the account.

4. Select a specific policy for the account group or leave **Account Policy** set to the default value of **Inherit Policy Settings**. If **Inherit Policy Settings** is selected, the accounts in this account group inherit the policy settings set for the global default account policy on the **Vault** > **Options** page.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/c4e68a91d7551f530f2165001c5bf754769f84f98989e8425d83e07db517ba91-account-groups.png",
        "",
        ""
      ],
      "align": "center",
      "sizing": "65% "
    }
  ]
}
[/block]

5. **Group policies** shows any links between this account group and a group policy.

6. Under **Accounts**, select the group from the **Source Account Group** list, and then select the accounts to add to this group.

   > ℹ️
   >
   > The **Default Group** is a system generated group that contains all user accounts that do not belong to an account group. The **Default Group** is selected by default.
   >
   > You can filter the list of available accounts to add to the group by selecting a group from the **Source Account Group** list or by using the **Search Selected Account Group** box to search by **Name**, **Endpoint**, and **Description**.

7. Click **Add** to move the accounts over to the **Accounts in This Group** list.

8. In the **Allowed Users** section, add a user and select their Vault role from the **New Member Role** dropdown, and then click **Add**. Users can be assigned one of two member roles:
   * **Inject:** Users with this role can use this account in Secure Remote Access sessions (default value).
   * **Inject and Checkout:** Users with this role can use this account in Secure Remote Access sessions and can check out the account on **Support for Admins**. The **Checkout** permission has no effect on generic SSH accounts.

9. Select the type of **Asset Associations** for the account. The **Asset Associations** setting determines which Assets the account is associated with, so the account is available only for relevant target computers in the console during credential injection attempts.

   Select one of the following types:

[block:parameters]{"data":{"h-0":"Asset Association Type","h-1":"Description","0-0":"**Inherited from the Account Group**","0-1":"Associations for this account are determined by the associations defined in this account's **Account Group**.","1-0":"**Any Assets**","1-1":"This account can be injected within any session started from an Asset in which the account is applicable. The applicable accounts are the following: <ul><li>**Local Accounts**- discovered on a Vault Endpoint are available for injection on Assets targeting the Endpoint.</li><li>**Domain Accounts**- are available for injection on Assets targeting Vault Endpoints on the Domain.</li><li>**All Domain Accounts**- are available for injection on Assets targeting remote systems that do not match a Vault Endpoint.</li><li>**Shared Generic Username & Password Accounts**- are available for injection into all Assets.</li><li>**Shared Generic SSH Accounts**- are available for injection into all SSH Assets.</li><li>**Shared Generic Token Accounts**- are available for injection into all Kubernetes Cluster Tunnel Assets.</li></ul>  \n  \n<blockquote class=\"callout callout_info\">ℹ️ Personal Assets are not supported.</blockquote>","2-0":"**No Assets**","2-1":"This account cannot be injected into any session started from an Asset.","3-0":"**Assets Matching Criteria**","3-1":"This account can be injected only within sessions started from Assets that match the criteria you define, in which the account is applicable. The applicable accounts are the following:  \n  \n<ul><li>**Local Accounts**- discovered on a Vault Endpoint are available for injection on Assets targeting the Endpoint.</li></ul><ul><li>**Domain Accounts**- are available for injection on Assets targeting Vault Endpoints on the Domain.</li></ul><ul><li>**All Domain Accounts**- are available for injection on Assets targeting remote systems that do not match a Vault Endpoint.</li></ul><ul><li>**Shared Generic Username & Password Accounts**- are available for injection into all Assets.</li></ul><ul><li>**Shared Generic SSH Accounts**- are available for injection into all SSH Assets.</li></ul><ul><li>**Shared Generic Token Accounts**- are available for injection into all Kubernetes Cluster Tunnel Assets.</li></ul>\n<blockquote class=\"callout callout_info\">ℹ️ Personal Assets are not supported.</blockquote>\nIf the Asset Attributes section is configured, this list combines with any Assets that match the criteria.  \n  \nThe following connection methods are supported:<ul><li>Jump Client</li><li>Remote RDP</li><li>Remote Jump</li><li>SSH</li><li>Database Connection</li><li>Website</li></ul>  \nInjection is not supported for the following items: <ul><li>Personal Assets</li><li>TCP Tunnel Database Connections</li><li>IP Tunnel Database Connections</li></ul>"},"cols":2,"rows":4,"align":["left","left"]}[/block]

> ℹ️
>
> You can define a direct association between Vault accounts and specific Assets by selecting the Assets from the list and then click **Add Asset**.
>
> If configured, the account is available for injection for any Assets that match the specified attribute criteria in addition to any specific Assets you added as matching criteria.
>
> Local accounts are available for injection within the endpoints on which they were discovered.

You can further define the association between Vault accounts and Assets by specifying matching criteria. Each of the following values have a maximum length of 64 characters and can contain a maximum of 32 values.

The different Asset attributes are the following:

* **Name**: This filter is matched against the value that appears in the **Name** column of the Asset in the console.
* **Hostname / IP**: This filter is matched against the value that appears in the **Hostname / IP** column of the Asset in the console.
* **Tag**: This filter is matched against the value that appears in the **Tag** column of the Asset in the console.
* **Comments**: This filter is matched against the value that appears in the **Comments** column of the Asset in the console.

  For example, a list of filter criteria is:

| Criteria          | Result                                  |
| :---------------- | :-------------------------------------- |
| **value**         | matches the field exactly.              |
| **value\***       | matches the field as a prefix.          |
| **\*value**       | matches the field as a suffix.          |
| \***\*value\*\*** | matches if the field contains the value |

9. Click **Save** at the top of the page.

## Search Account Groups

You can filter the list of available account groups by using the **Search Account Groups** box.  Based on the account type, you can use **Name** or **Description** as the criteria to search.

## Edit an Account Group

1. From the list of account groups, find the group you want to edit.

2. Click **Edit** ![Image of the Edit icon](https://files.readme.io/fb6de16cf3cebf96f19df9f2e34e703b9a5ba05bc70a9b74bfaacc13f6768ad3-image.png) to make changes to a group.

3. Make the necessary changes, and then click **Save**.

## Delete an Account Group

1. From the list of account groups, find the group you want to delete.

2. Click **Delete** ![Image of the Delete icon](https://files.readme.io/0b7577da0b116c1c22f07ef5d0427c74664210462faa3ce4396a07eb29586ed3-DeleteIcon.png) to delete a group.

3. When prompted to confirm, click **Yes**.

## Add an existing account to an account group

1. Switch to the **Vault > Accounts** page.
2. From an existing shared account, click the ellipsis button, and then select **Edit**.
3. Select the desired account group from the **Account Group** list, and then click **Save**.

## Import a discovered account

1. Switch to the **Vault > Discovery** page.

2. From the **Discovery Jobs** section, select a discovery job.

3. Click **View Results** for the job.

4. Select the **Local Accounts** or **Domain Accounts** tab as applicable.

5. From the list of accounts, select the account you wish to import.

6. Click **Import Selected**.

7. Select the group from the **Account Group** list.

8. Click **Start Import**.

## Add an account group to a group policy

1. Switch to the **Users & Security > Group Policies** page.\
   The **User** page opens and displays by default.

2. From the list of existing group policies, click the pencil ![Image of the Edit icon](https://files.readme.io/fb6de16cf3cebf96f19df9f2e34e703b9a5ba05bc70a9b74bfaacc13f6768ad3-image.png) to edit a policy.

3. Scroll down to the **Memberships** section.

4. Check the **Add Vault Account Group Memberships** checkbox.

5. Select the **Account Group** from the list.

6. Select the **Vault Account Role** from the list.\
   Users can be assigned one of two member roles:
   * **Inject:** Users with this role can use this account in Secure Remote Access sessions (default value).
   * **Inject and Checkout:** Users with this role can use this account in Secure Remote Access sessions and can check out the account on **Support for Admins**. The **Checkout** permission has no effect on generic SSH accounts.

7. Click **Add**.

8. Click **Save** at the top of the page.

9. The group policy and its Vault account role are now displayed under the **Group Policies** section for the account group that was added to the policy.

10. The members of the group policy are now added under **Allowed Users** for the account group.

> ℹ️
>
> If a user was granted access individually from the account group edit page and also through a group policy, the group policy access is overridden by the explicitly granted individual access for this user.