Vault guide

What is BeyondTrust Vault?

BeyondTrust Vault is a built-in credential management solution that securely stores, retrieves, and injects credentials for privileged access without exposing them to users. It helps organizations manage and protect sensitive credentials, reducing security risks by eliminating the need for users to know or manually enter passwords. Vault integrates seamlessly with BeyondTrust Remote Support and Privileged Remote Access to provide secure, just-in-time access to critical systems.

How is it useful to my organization?

BeyondTrust Vault fits seamlessly into your service desk workflow by integrating directly with the Secure Remote Access solution, allowing administrator accounts to access systems without exiting BeyondTrust. With just one click in the Secure Remote Access console, users can select the correct credential and log directly in to a remote system, keeping your privileged accounts more secure.

This document covers the following topics:

Vault configuration

Enable the user permissions needed to start using BeyondTrust Vault.
User permissions

Discovery and import

Find privileged accounts and their endpoints, plus Windows service
accounts, and import them into Vault. Discovery

Add credentials manually

Manually add shared and personal generic accounts into Vault.
Vault accounts

SSH keys with a certificate authority

Issue unique, time-limited private keys per request so the user never
receives the key trusted by the endpoint.
SSH certificate authority

Credential grouping

Group Vault accounts logically and grant access to many accounts at once.
Vault account groups

Vault account policies

Define rotation and checkout settings once, then apply them to multiple
accounts. Vault account policies

Credential rotation

Rotate passwords manually or automatically after each use.
Rotate credentials

Check in and check out

Retrieve credentials for use outside a Secure Remote Access session.
Check out credentials

Credential injection

Inject credentials into a remote system directly from the console.
Credential injection

Reporting

Track credential activity, including use of shared credentials.
Activity and reporting

Vault with Entra ID Domain Services

Create an Entra ID service principal and manage Entra ID Domain Services
accounts. Use Vault with Entra ID