Devolutions PAM

Devolutions PAM is a privileged access management module that is added to Remote Desktop Manager (RDM), Devolutions Server (self-hosted) or Devolutions Cloud (fully managed). It is intended to remove standing privileges by controlling how privileged credentials are checked out and used. Capabilities described by the vendor: - Just-in-time elevation: access is granted for the time needed and then revoked automatically. - MFA-gated checkout: step-up authentication is required before a credential is released. - Privileged account discovery: scans Active Directory, Entra ID, SSH, SQL Server and local Windows accounts, and the release notes mention MongoDB discovery and rotation. - Automatic password rotation on a schedule, with changes propagated to dependent services. - Live session monitoring and recording, with ticket numbers tied to each checkout. - Account risk scoring (1 to 10) during discovery, and lifecycle policies that tier rotation, review and approval rules. - Checkout approval workflows with custom access duration and approvers, extendable checkouts, and time-boxed access to PAM accounts. Deployment options: - Add the PAM module to an existing RDM, Devolutions Server or Devolutions Cloud license, so existing vaults, users and permissions carry over. - Buy PAM together with RDM backed by Devolutions Server or Devolutions Cloud. Devolutions Cloud is stated to be SOC 2 Type II and ISO 27001 certified and supports SSO and MFA with Microsoft Entra ID, Okta and others. Devolutions Server supports Active Directory and Microsoft Entra ID integration. A free start option is offered, with a license added later.