Access Request policies play a crucial role in managing resource access within an organization. In EmpowerID, they serve as the foundation for guiding the approval and fulfillment processes for user access requests. By defining the required approvals, conditions, and entitlements, Access Request policies help administrators control who can access specific resources and under what circumstances. In the context of PSM, Access Request policies are essential for regulating user access to computer credentials related to servers and other machines configured for RDP or SSH sessions. They ensure that only authorized users can access privileged credentials, thereby reducing the risk of unauthorized access or misuse of sensitive information.In EmpowerID, Access Request policies are essential crucial for managing resource access by and guiding the approval and fulfillment processes for user access requests. They are particularly important for These policies are pivotal in Privileged Session Management (PSM), where they regulate users' regulating access to computer credentials related to for servers or other machines set up for devices used in RDP or SSH sessions. Additionally, Access Request policies establish They determine whether such sessions fall under are subject to a privileged session policy, which governs aspects such as controls session recording, live session monitoring, and the maximum number of limits on concurrent sessions allowed on for a specific computer.
...
. Additionally, Access Request policies include settings to update Windows Services and IIS App Pools when passwords are reset, which is important when credentials linked to these services require password updates after check-outs and check-ins. Furthermore, these policies facilitate the automated rotation of passwords on a scheduled basis, enhancing security and compliance.
| Tip |
|---|
Approval Policies for Privileged SessionsAdministrators |
use Access Request policies to |
implement Approval Policies, ensuring that an approved user authorizes privileged session access requests |
before initiation. By default, |
access to computer credentials |
is controlled by the Owner Approval policy, |
requiring the owner |
's approval before a user initiates a session. However, organizations can choose other approval flows as desired. |
...
Access Request Policies for Computer Credentials
EmpowerID provides offers several pre-configured Access Request policies tailored for computer credentials, each featuring its own PSM-specific settings:
...
with specific settings for Privileged Session Management. By leveraging these pre-built Access Request policies and configuring them according to your organization's security requirements, administrators can effectively manage privileged sessions and ensure secure access to critical resources. Regularly reviewing and updating these policies will help maintain compliance with relevant regulations and internal policies and enhance overall security.
You can view these policies by navigating to Low Code/No Code Workflow > Access Request Policies and searching for “Computer.”
Policy Name | Applicability | MFA Requirement | Password Reset Policy |
|---|---|---|---|
Computer Creds - Allow Multi-Check-Out - No Password Reset |
...
Suitable for multiple RDP or SSH |
...
sessions without a password reset. | No | No |
Computer Creds - No Multi-Check-Out - Password Reset |
This policy is applicable for computer credentials initiating an RDP or SSH session where multiple sessions aren't permitted, and you want EmpowerID to reset the account password when the user checks in the credentials.
...
Ideal for single-session environments where a password reset is required post-session. | No | Yes |
MFA - Computer Creds - Allow Multi-Check-Out - No Password Reset |
...
For environments requiring multi-factor authentication, allowing multiple sessions |
...
...
. | Yes | No |
General Settings for Access Request Policies
The table below outlines the general settings available for Access Request policies in EmpowerID:
Setting | Description |
|---|---|
Name/Display Name | Identifies the policy within the system and in the UI. |
Description | Provides a brief overview of the policy's purpose and scope. |
Allow Activation (Skip Business Request) | Specifies whether Business Requests are generated for access requests. If selected, the system does not route requests through Approval policies. |
Approval Policy | Specifies the Approval policy linked to the Access Request policy. Approval policies determine who can approve access requests and how many approvals are required before access is granted, etc. The drault Access Request policies for computer credentials are configured with the Owner Approval Approval policy. |
Fulfillment Delay (HRS) | Specifies the number of hours the system should wait to fulfill approved requests |
Is Shipping Data | For internal EmpowerID use only |
Enable Just in Time Account Provisioning | Enables dynamic account provisioning on the target computer at session start. This only applies when an account store is created for the computer in question. For details on how to create an account store for a Windows server, see the Local Windows Servers Connector topic in this guide. |
Selectable in UI | Allows the policy to be selected from the EmpowerID Web Interface. |
Time and MFA Restrictions
These settings define temporal access boundaries and additional security layers:
Setting | Description |
|---|---|
Time Restrict Access | Enables time-based access restrictions with configurable durations. |
MFA Required for Access Request | Imposes a minimum Level of Assurance for login based on user location (local or remote). |
Shared Credential Settings
These settings are used to define if credentials are available to users in the IAM Shop and password reset options:
Setting | Description |
|---|---|
Publish in IAM Shop | Determines if credentials are visible for user selection in the IAM Shop. |
Allow Multi Check Out | Permits multiple users to concurrently check out the credentials. |
Reset Password On Check In | Enforces a password reset when a user completes their session and disconnects from the computer |
Update Windows Services On Password Reset | Updates the password for Windows services when a user completes their session and disconnects from the computer. |
Update IIS App Pools On Password Reset | Specifies whether EmpowerID should update IIS App Pool passwords after a user completes their session and disconnects from the computer |
PSM Computer Settings
Setting | Description |
|---|---|
Privileged Session Policy | Specifies whether privileged session policy applies when users connect to the computer. If selected, additional settings are used to determine the maximum number of concurrent sessions are allowed, whether sessions are to be recorded and whether administrators can view current sessions in real time. |
Password Rotation Settings
These settings enable administrators to configure automatic password resets for credentials within EmpowerID, enhancing security through regular updates. The settings allow for precise control over when and how often these resets occur.
Setting | Description |
|---|---|
Schedule Password Reset Enabled | Toggle this setting to enable or disable scheduled password resets. |
Password Reset Schedule – Start Date | Defines the date when the password resets will start. |
Password Reset Schedule – End Date | Defines the date when the password resets will end, if applicable. |
Interval | Determines the frequency of the password resets. Options include 'Once', 'Hourly', 'Minute', 'Daily', 'Weekly', 'Monthly', or 'Run Indefinitely'. |
| Insert excerpt | ||||||
|---|---|---|---|---|---|---|
| ||||||
| Insert excerpt | IL:External Stylesheet | IL:External Stylesheet | nopanel | true
| Macrosuite divider macro | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|