Privileged access management (PAM)

A PAM platform is typically built from several cooperating components. A credential vault stores passwords and keys of privileged accounts, releases them through check-out and check-in with approval, and rotates them automatically after each use or on a schedule. A session manager, usually a jump host or protocol proxy for RDP, SSH and database connections, injects the credential so the administrator never sees it, and records video, keystrokes or commands for review. Just-in-time elevation grants a role only for a bounded period after approval or justification; Microsoft's variant for Entra ID and Azure roles is Privileged Identity Management, which requires Entra ID P2. Endpoint privilege management removes local administrator rights from users and elevates specific applications instead, while Windows LAPS gives each machine's local administrator a unique, rotated password. Discovery scans find privileged and service accounts that nobody onboarded.

The goal the market now talks about is zero standing privilege: no human holds permanent administrative rights, and every elevation is requested, time-bound, attributable and logged. Around it sit architectural controls. Microsoft's Enterprise Access Model, successor to the Active Directory tier 0/1/2 model, separates control-plane assets such as domain controllers, identity providers and PAM servers from management and workload planes, and requires administrators to work from privileged access workstations so their credentials are never exposed on ordinary endpoints.

Several standards map directly to PAM functions. NIST SP 800-53 Rev. 5 covers privileged accounts in AC-2(7) and AC-6(5), and logging of privileged functions in AC-6(9); ISO/IEC 27001:2022 Annex A 8.2 addresses privileged access rights; CIS Controls v8.1 requires dedicated administrator accounts (Safeguard 5.4) and MFA for all administrative access (6.5); and NIS2 Article 21(2) lists access control policies in point (i) and multi-factor or continuous authentication in point (j). NIST SP 1800-18 is a practice guide showing a reference PAM build for the financial sector.

The value of PAM depends on coverage and review. Typical gaps are administrators who keep a standing account outside the vault "for emergencies", service accounts and API keys never onboarded, session recordings nobody watches, and approval workflows that approve everything. The PAM platform itself is a control-plane asset: compromise of the vault or its admin console hands over every secret it holds, so it needs the same protection as a domain controller. Recordings can capture personal data and must be covered by retention rules and data protection review. PAM is a specialised part of access management; identity governance handles who should have which role in the first place, and PAM handles how the most powerful of those roles are used.