# Cloud-native PAM platform, high-value pricing model

- Straightforward pricing
- No lock-ins
- Rapid time to value

## Pricing schedule for PAM360 Cloud

PAM360 Cloud is licensed per privileged user, counted by who signs up and uses it. Pick the slab that matches your count; billing follows the cycle you choose. A 500-user license covers 500 sign-ups from your organization.

Save up to 26%

| Number of users | Licensing fee (Billed monthly) | Licensing fee (Billed annually) |
|---|---|---|
| 10 | $200 | $1,800 |
| 25 | $500 | $4,500 |
| 50 | $1,000 | $9,000 |
| 100 | $1,997 | $17,970 |
| 250 | $4,543 | $40,440 |
| 500 | $7,791 | $70,416 |
| 1000 | $13,289 | $1,18,398 |
| 2000 | $22,287 | $1,96,386 |
| 2500 | $25,787 | $2,29,386 |

All prices are in USD. This is an indicative pricing. For complete pricing details and a custom quote, please contact our sales team.

### Important notes

1. **10 Application Gateways are bundled free with your license. For additional gateways, kindly [reach out to sales](https://www.manageengine.com/privileged-access-management/get-quote.html?pricingpage).**
2. For any requirement beyond 2,500 privileged users, please contact sales to have volume pricing built for the specific user count.
3. Any professional services (hands-on implementation, guided onboarding, architecture/scoping support, or training beyond what's bundled) are scoped and priced separately. Contact sales with the your environment details and requirements to get a personalized services quote.
4. If your user count falls between slabs or doesn't match any listed tier, contact us with your exact user count and pricing requirements, and we'll tailor the quote accordingly.
5. Onboarding & implementation are priced separately. For enterprise-scale deployments, please contact us at [sales@manageengine.com](mailto:sales@manageengine.com) for a customized quote. These deals are handled directly by us to account for volume discounts, deployment scope, and any bespoke terms.

## Unified PAM, out of the box

### Privileged account governance

- Automated privileged account discovery
- Centralized credential vaulting with AES-256 encryption
- Role-based and policy-based access controls
- Password rotation and life cycle management
- Access request and approval workflows
- Comprehensive audits and compliance-ready reports

### Least privilege access

- JIT privilege elevation
- Time-bound, purpose-specific access provisioning
- Trust score-based access controls
- Automatic privilege revocation upon session expiry
- Fine-grained delegation for Windows and Linux

### Privileged session management

- Secure remote connections via RDP, SSH, VNC, and SQL
- Real-time session shadowing and dual control
- Full session recording and video playback
- Keystroke logging and command capture
- Gateway-based access without direct endpoint exposure
- Audit trails for investigative reviews

## PAM360 On-Premises Vs Cloud

Feature comparison

### 1. Credential Storage & Management

| Feature | On-Premises | Cloud |
|---|---|---|
| Centralized, secure repository of privileged passwords | Yes | Yes |
| Auto discovery of IT assets and privileged accounts | Yes (Windows, Linux, VMware, AWS EC2, and Network devices) | Yes (Linux, Network Devices, VMware; Windows, Linux, SQL local account discovery) |
| Web-based access | Yes | Yes |
| Storing and managing shared accounts | Yes | Yes |
| Application-to-Application (A-to-A), Application-to-Database (A-to-DB) password management | Yes | Coming Soon |
| Windows service accounts password management | Yes | Yes |
| Options for A-to-A and A-to-DB password management | RESTful APIs and Command Line (SSH-CLI) | Coming Soon |
| Privileged account management for DevOps tools (CI/CD tools integration) | Yes (Jenkins, Ansible, Chef, Puppet) | Coming Soon |
| Privileged account management for RPA platforms | Yes (Automation Anywhere) | Coming Soon |
| Password encryption | AES-256, dual encryption at application and database levels. FIPS 140-2 compliant. | AES-256 |
| Password ownership | Yes | Yes |
| Selective sharing of passwords | Yes | Yes |
| Fine-grained, role-based permission to view/edit/manage passwords | Yes | Yes |
| Grouping resources / passwords bulk operation | Yes | Yes |
| Storing files, images, digital identities | Yes | Yes |

### 2. Remote Password Reset

| Feature | On-Premises | Cloud |
|---|---|---|
| Synchronizing passwords of remote resources | Yes | Yes |
| Deploying agents for remote password reset | Yes | Coming Soon |
| Agent-less remote password reset | Yes | Yes, supported via Application Gateway |
| Scheduled, automatic password rotation | Yes | Yes (limited expiry times in beta) |
| Verifying the integrity of passwords in target systems | Yes | Yes |
| Windows service account reset | Yes | Yes |
| Provision for triggering follow-up action after password reset | Yes | Coming Soon |
| Direct connection to remote resources via landing servers (jump servers) | Yes | Yes (via Application Gateway) |
| Native thick-client for RDP and SSH | Yes (PAM360 Remote Connect) | Coming Soon |

### 3. Supported Platforms for Remote Password Reset

| Feature | On-Premises | Cloud |
|---|---|---|
| Windows (local, domain, service accounts) | Yes | Yes |
| Linux, Mac, Solaris, HP Unix, IBM AIX, HP-UX | Yes | Yes |
| Databases (MS SQL, MySQL, Oracle DB, Sybase ASE) | Yes | Yes |
| Cisco devices and network devices | Yes | Yes |
| Directories (LDAP, Novell, Oracle OID, OpenLDAP) | Yes | Yes |
| Cloud environments (AWS, Azure, Google Apps, Salesforce) | Yes | Coming Soon |
| Custom password reset plugins | Yes | Yes |

### 4. Access Governance, JIT and Least Privilege Access

| Feature | On-Premises | Cloud |
|---|---|---|
| Password/SSH key request-release controls | Yes | Yes |
| Dual approval controls | Yes | Yes |
| Time-limited access to passwords | Yes | Yes |
| Just-in-time (JIT) privilege elevation for Windows local accounts | Yes | Yes |
| JIT elevation for Windows domain accounts | Yes | Yes |
| Application control, allow-listing and block-listing | Yes | Coming Soon |
| Command control | Yes | Coming Soon |
| Local admin rights management | Yes | Coming Soon |
| Child and spawning subprocess management | Yes | Coming Soon |
| Self-service privilege elevation | Yes | Coming Soon |
| Privilege elevation for Linux | Yes | Coming Soon |
| Exclusive access to passwords for users | Yes | Coming Soon |
| Notifications/Alerts on check-in, check-out of passwords | Yes | Coming Soon |
| Password/SSH key auto-reset after exclusive use ends | Yes | Coming Soon |
| Task automation | Yes | Coming Soon |
| JIT access via ephemeral roles and accounts | Yes | Coming Soon |
| Privilege elevation for end-user devices | Yes | Coming Soon |

### 5. Cloud Infrastructure Entitlements Management (CIEM)

| Feature | On-Premises | Cloud |
|---|---|---|
| Cloud entitlement discovery and management | Yes | Coming Soon |
| Monitoring cloud environments for excessive permissions, unused accounts, policy violations | Yes | Coming Soon |
| Least privilege access policies for cloud entities | Yes | Coming Soon |
| Shadow admin accounts management | Yes | Coming Soon |
| Real-time usage and risk monitoring | Yes | Coming Soon |
| Real-time mitigation insights | Yes | Coming Soon |

### 6. SSH Key & SSL Certificate Management

| Feature | On-Premises | Cloud |
|---|---|---|
| Automated SSH/SSL discovery | Yes | Coming Soon |
| Import of keys and certificates | Yes | Coming Soon |
| SSH key pair creation and user association | Yes | Coming Soon |
| SSH keys periodic rotation | Yes | Coming Soon |
| Certificate life cycle management (acquisition, deployment, auto renewal) | Yes | Coming Soon |
| Generate self-signed certificates | Yes | Coming Soon |
| Microsoft CA certificate signing | Yes | Coming Soon |
| Root-based certificate signing | Yes | Coming Soon |
| CSR process management | Yes | Coming Soon |
| SSL certificate deployment & validity tracking | Yes | Coming Soon |
| SSL certificate sharing | Yes | Coming Soon |
| SSL vulnerability scanning | Yes | Coming Soon |
| SSL certificate expiration alerts | Yes | Coming Soon |

### 7. Authentication

| Feature | On-Premises | Cloud |
|---|---|---|
| AD/LDAP authentication | Yes | Not applicable for cloud |
| RADIUS server authentication | Yes | Not applicable for cloud |
| Azure AD / Entra ID | Yes | Yes (import from Entra ID supported) |
| Native authentication by application | Yes | Yes |
| Smart card / PKI / certificate authentication | Yes | Coming Soon |
| SAML authentication | Yes (Okta, AD FS, OneLogin, Azure AD SSO) | Coming Soon |
| Two-factor authentication | Yes | Yes |
| Options for two-factor authentication | PhoneFactor, RSA SecurID, Google Authenticator, RADIUS, Email OTP, Duo, YubiKey, Microsoft Authenticator, Okta Verify | Zoho OneAuth, third-party authenticator apps, passkeys and security keys |
| Automated policy enforcement | Yes | Coming Soon |
| AI-governed risk remediation policies | Yes | Coming Soon |

### 8. User Management

| Feature | On-Premises | Cloud |
|---|---|---|
| Importing users from AD/LDAP | Yes | Yes (import from AD, Entra ID) |
| User groups for bulk operations | Yes | Yes |
| Role-based access restrictions | Yes | Yes |
| Custom role creation | Yes | Yes |
| Optional super-admin with access to all managed passwords (break-glass) | Yes | Yes |
| Denying creation of super-admin accounts more than one | Yes | Yes (option removed in cloud) |
| User lock | Yes | Yes |
| Transfer user accountabilities | Yes | Yes |
| Transfer resource ownership | Yes | Yes |
| IP restriction | Yes | Yes |

### 9. Password Event Notifications

| Feature | On-Premises | Cloud |
|---|---|---|
| Notifications on password retrieval, reset, expiry, ownership change, etc. | Yes | Yes (Email requires account verification) |

### 10. Password Policies & Compliance

| Feature | On-Premises | Cloud |
|---|---|---|
| Pre-built password policies of varying strengths | Yes | Yes |
| Provision for creating custom policies | Yes | Yes |
| Enforcing usage of strong passwords, standard practices | Yes | Yes |
| Checking password for compliance to standards | Yes | Yes |

### 11. Audit & Reports

| Feature | On-Premises | Cloud |
|---|---|---|
| Logging all access to passwords — who, what, when | Yes | Yes |
| Complete record of all password, key, and certificate management operations | Yes | Yes |
| Complete record of all user activities | Yes | Yes (user login audit not available in beta) |
| Reports on password inventory, policy compliance, password expiry | Yes | Yes (canned, custom, compliance, query reports) |
| Out-of-the-box compliance reports (PCI-DSS, ISO/IEC-27001, NERC-CIP, GDPR) | Yes | Yes |
| Report scheduling | Yes | Yes |
| Sending reports by email | Yes | Yes |
| Generating reports in PDF | Yes | Yes |
| Custom reports | Yes | Yes |
| Query reports | Yes | Yes |

### 12. Backup, Disaster Recovery & High Availability

| Feature | On-Premises | Cloud |
|---|---|---|
| Scheduled backup of database | Yes | Not applicable (managed by Zoho) |
| Live backup through data replication | Yes | Not applicable (managed by Zoho) |
| Application Gateway server | Yes | Yes |
| Tools for disaster recovery | Yes | Not applicable (managed by Zoho) |
| Uninterrupted access to data (high availability) | Yes | Yes (managed by Zoho) |
| Fail-over service | Yes | Not applicable (managed by Zoho) |
| Multiple application server instances | Yes | Not applicable (managed by Zoho) |

### 13. Security Aspects

| Feature | On-Premises | Cloud |
|---|---|---|
| Encryption key hiding | Yes | Yes |
| Session protection | SSL | SSL |
| Data transmission | HTTPS | HTTPS |
| Data storage encryption | AES-256 | AES-256 |
| Dual encryption | Yes (AES-256 at application and database levels) | Yes |
| Provision to prevent cross-site scripting | Yes | Yes |
| FIPS 140-2 compliant mode | Yes | Coming Soon |
| Monitoring failed login attempts | Yes | Yes |
| Termination of inactive user sessions | Yes | Yes |

### 14. Tools & Integrations

| Feature | On-Premises | Cloud |
|---|---|---|
| Importing passwords | Yes | Yes |
| Importing passwords from KeePass | Yes | Coming Soon |
| Ticketing system integration | Yes (ServiceNow, ServiceDesk Plus, JIRA) | Yes (ServiceDesk Plus On-Demand, ServiceNow, JIRA) |
| Integration with SIEM tools | Yes (Log360, Splunk, ArcSight, Syslog) | Yes (Loggly,Datadog,Sematext,Coralogix,Microsoft Sentinel) |
| HSM integration | Yes (SafeNet, Entrust nShield) | Coming Soon |
| Secure offline access | Yes | Yes |
| Exporting passwords in various formats | Yes | Yes |
| Password generator | Yes | Yes |
| Password history | Yes | Yes |
| Separate personal password management | Yes | Not applicable for cloud. |
| Client customization | Yes | Coming Soon |
| Mobile support & native apps | Yes (Android, iOS, Windows) | Coming Soon |
| Browser extensions | Yes (Chrome, Firefox, Edge) | Coming Soon |
| Cloud storage integration | Yes (Dropbox, Box, Amazon S3) | Yes (Box, Dropbox, Amazon S3) |
| API support | Yes (RESTful APIs) | Coming Soon |

### 15. Privileged Session Management

| Feature | On-Premises | Cloud |
|---|---|---|
| Direct connection to target systems via HTML5 browser sessions | Yes (RDP, VNC, SSH, SQL) | Yes |
| Remote sessions from iPad & tablet devices | Yes | — |
| Options for automatic connection (RDP, VNC, SSH, SQL) | Yes | Yes, for RDP, SSH and VNC |
| Launch remote sessions without disclosing credentials | Yes | Yes |
| RemoteApp support | Yes | Yes |
| Native desktop client (thick client) | Yes (PAM360 Remote Connect) | Coming Soon |
| Command controls | Yes | Yes |
| Bidirectional file transfer | Yes | Coming Soon |
| Privileged session recording & playback | Yes | Coming Soon |
| AI-based session summarization | Yes (via OpenAI integration) | Coming Soon |
| Session events and keystroke logging | Yes | Coming Soon |
| Session shadowing / dual controls | Yes | Yes |
| Session termination upon suspicious activity | Yes | Yes |
| Privileged user behavior analytics | Yes (via Analytics Plus) | Coming Soon |

### 16. Multi Tenancy

| Feature | On-Premises | Cloud |
|---|---|---|
| Multi-tenant architecture | Yes | No |

### 17. Platform Support, Licensing & Deployment

| Feature | On-Premises | Cloud |
|---|---|---|
| Supported platforms for server installation | Windows & Linux (also on AWS, Azure, Hyper V, VMware ESXi, BMC) | Not applicable (Cloud, managed by Zoho) |
| Cloud-ready | Yes (AWS, Azure, VMware ESXi, Hyper V) | Native cloud |
| Licensing model | Based on number of administrator roles. Annual Subscription & Perpetual licensing available. | Based on number of privileged users. Annual and monthly Subscription models. |
| Deployment model | Self-hosted, Public cloud image (AWS, Azure), self-hosted PAM over the WAN | Native Cloud only (delivered by Zoho's cloud infrastructure) |

## We’re with you every step of the way

From faster deployment to smooth implementation, our experts help your team get up to speed quickly.

### Online

| Number of sessions | Training only | Onboarding, implementation, and training |
|---|---|---|
| Online Basic: 4 hours | $995 | $2,495 |
| Online Standard: 8 hours | $1,495 | $3,495 |
| Online Advanced: 12 hours | $1,995 | $4,495 |

### Onsite

| Number of sessions | Onboarding, implementation, and training |
|---|---|
| Onsite Basic: 2 days | $4,999 |
| Onsite Standard : 3 days | $6,999 |
| Onsite Advanced: 5 days | $9,999 |

### Note

1. All onsite implementations include professional training for up to 5 participants.
2. Basic services include installation, basic setup and configuration.
3. Standard services includes installation, basic setup, product configuration, and out-of--the-box integrations.
4. Advanced services include scoping, architecture design, installation, product configuration, API and integration assistance.