PAM360 MSP Edition - Getting Started

Overview

ManageEngine PAM360 is also available in MSP edition, which has been specially designed taking into consideration the requirements of the Managed Service Providers. If you are an MSP wishing to manage the administrative passwords of your clients separately from a single management console or offer password management services to them, you can leverage the MSP edition.

Passwords can be securely shared between MSP administrators and their respective customers, making sure that users only get access to the passwords they own or ones that are shared with them. The solution offers the flexibility to entrust the control of the password vault to the MSP administrator, the end user or both, as desired.

The MSP edition also follows the basic password entitlement model of PAM360 – that means, at any time, one will be able to view only the passwords that are owned and shared. As MSP admin, while you will be able to view the names of the organizations you manage, you will be able to view the data pertaining to all your customers only if you add their resources or if they share the resources with you. Your customers will be able to view the data belonging to their organization only.

MSP Edition – Getting Started

Pre-requisite

For testing the MSP edition, you need to deploy a separate machine. If you try to install the MSP edition in the same machine where PAM360 is running, it will uninstall the existing PAM360 instance.

Getting started

Download and install the ManageEngine_PAM360_MSP.exe.

Step 1: Add users to the MSP org

The MSP administration process starts with User Management. The first step is to add users to your MSP organization. You should designate one administrator as ‘Account Manager’ for each of your clients. Proceed with adding users.

Step 2: Add your client organizations

After adding users, you need to add your client organizations. Navigate to Admin >> Customize section and you will find an icon named “Organizations”. The organizations to be managed by the MSP should be registered with PAM360 here.

You can manually add the client organizations one-by-one or import all the organizations in bulk from a CSV file.

Manually adding organizations

Navigate to Admin >> Organizations

Click the button “Add Organization”

In the pop-up form that opens, specify a name for the organization being added.
Display Name:The name with which you wish to identify the organization being added.
- Only alphanumeric characters without empty spaces are allowed here.
- The name should be a single word.
- The name that you enter here will appear in the drop-down at the top right hand side of PAM360 GU.I
- In addition, the display name will appear in PAM360 login URL.
(For example, if you assign 'xyz' as the display name, the login URL for the organization will be https://:/xyz).
Account Manager: You can designate any administrator at your end (MSP) as the 'Account Manager' for the organization being added. As the name indicates, the account manager will be the point of contact for the organization being managed and will have privileges to add and manage resources on behalf of the organization. The Account Manager with the role 'Admin' in PAM360 will be able to manage the users of the organization too. You can designate only one account manager per organization being managed. The same administrator can be made the account manager for multiple client organizations.
Fill-in other details like Department, Location etc. as required

Import Organizations from CSV

You can import multiple organizations from a CSV file using the import wizard. The CSV should have entries regarding organization name, display name and other details in comma separated form. The entry for each organization should be in a new line. All the lines in the CSV file should be consistent and have the same number of fields. CSV files having extensions .txt and .csv are allowed.

To import organizations,

Navigate to Admin >> Organizations.
Click the button “Import Organizations”

In the pop-up form that opens, choose the file format.
Browse and select the CSV file containing the organizations.
Click “Next”

In the pop-up form that opens, you can choose which field in the CSV file maps to the corresponding attribute of the Organization.
Finally, click “Finish”The result of every line imported will be logged as an audit record.

The result of every line imported will be logged as an audit record.

Granting Manage Organization Privilege

Apart from designating an administrator as ‘Account Manager’, you have the option to grant ‘Manage Organization’ privilege to any other member of your MSP org. When you grant this permission to an administrator, he will have admin privileges on the client org. Similarly, if the permission is granted to a password administrator or to a password user, they will have the respective privileges.

For security reasons, PAM360 enforces approval process for managing an organization. That means, while any administrator at the MSP can initiate manage permission to a user, it has to be approved by some other administrator at the MSP org. One who initiates the request and the one for whom the request is being initiated cannot approve. A third administrator has to approve. This is to ensure that no administrator is able to acquire manage permission for himself or grant that privilege to anyone else without the approval of another admin. This essentially means that the MSP org should have a minimum of three administrators to carry out this process.

For example, assume the scenario when ‘Admin A’ wants to provide manage permission to ‘Admin B’ for the organization ‘ABC’. In this case, both Admin A (the proposer) and Admin B (the admin designate) cannot approve. Another admin, say, ‘Admin C’ will have to approve.

To grant manage permission for an organization,

Log in to your MSP account and navigate to the "Users" tab.
Click the ‘User Actions' icon against the desired user and select 'Manage Organization’ from the dropdown.

In the pop-up form that opens, select the required client organization and move it to right.
Select the name of the approver.
Click ‘Save’. The user will gain manage privilege once the approval is done.

Alternatively, you can also grant manage permission from 'Organizations' page by clicking the 'Actions' icon against the desired organization and selecting 'Manage Organization' from the dropdown.

MSPOrg – The default org

By default, one organization named “MSPOrg” will be available. This default org is basically your organization (MSP’s organization). The passwords that you add here will pertain to your own organization and not that of your clients.

Password Management for Client Organizations

Once the organization is added, you will see the list of organizations being managed by you (i.e for which you have manage permission or for which you are the account manager) on the top band of the PAM360 GUI “Select Organization”.

Select the required organization and proceed with resource addition. You can then share the passwords with your clients. On the other hand, if you are providing Password Management Service, you will ask your client to add passwords themselves.

How to access any specific client org?

You can access your MSP org as usual by accessing the URL https://<PAM360-Host-Name>:7272/. You can select the required client organization from the top band of the PAM360 GUI.

How do your clients access PAM360?

After creating an organization, you clients can connect to their organization and view/manage passwords by typing the URL as explained below:

https://<Host Name:<port>/<Name of the org>

For instance, assume that the name of the organization of your client is ‘abc’ and PAM360 is running on the host “pam360host”, then the URL to connect to an organization will be: https://pam360host:7272/abc

For information on how to perform various password management features, refer to the respective sections of the help documentation.

How to delete a client organization?

You can be eligible to delete a client organization in PAM360 only if you are an MSPOrg administrator. Additionally, you should also have any of the following privileges:

Be the Account Manager of the client organization you want to delete.
Hold "Manage Organization" permission for the client organization you want to delete.

To delete an organization,

Navigate to Admin >> Organizations.

Locate the client organization that you want to delete, click on Actions icons beside it, and select Delete Organization from the drop down menu.

Click OK to confirm deletion. Note that deleting a client organization will also delete all resources and users added under it.


PAM360 MSP Edition - Getting Started Overview ManageEngine PAM360 is also available in MSP edition, which has been specially designed taking into consideration the requirements of the Managed Service Providers. If you are an MSP wishing to manage the administrative passwords of your clients separately from a single management console or offer password management services to them, you can leverage the MSP edition. Passwords can be securely shared between MSP administrators and their respective customers, making sure that users only get access to the passwords they own or ones that are shared with them. The solution offers the flexibility to entrust the control of the password vault to the MSP administrator, the end user or both, as desired. The MSP edition also follows the basic password entitlement model of PAM360 – that means, at any time, one will be able to view only the passwords that are owned and shared. As MSP admin, while you will be able to view the names of the organizations you manage, you will be able to view the data pertaining to all your customers only if you add their resources or if they share the resources with you. Your customers will be able to view the data belonging to their organization only. MSP Edition – Getting Started Pre-requisite For testing the MSP edition, you need to deploy a separate machine. If you try to install the MSP edition in the same machine where PAM360 is running, it will uninstall the existing PAM360 instance. Getting started Download and install the ManageEngine_PAM360_MSP.exe. Step 1: Add users to the MSP org The MSP administration process starts with User Management. The first step is to add users to your MSP organization. You should designate one administrator as ‘Account Manager’ for each of your clients. Proceed with adding users. Step 2: Add your client organizations After adding users, you need to add your client organizations. Navigate to Admin >> Customize section and you will find an icon named “Organizations”. The organizations to be managed by the MSP should be registered with PAM360 here. You can manually add the client organizations one-by-one or import all the organizations in bulk from a CSV file. Manually adding organizations Navigate to Admin >> Organizations Click the button “Add Organization” In the pop-up form that opens, specify a name for the organization being added. Display Name:The name with which you wish to identify the organization being added. Only alphanumeric characters without empty spaces are allowed here. The name should be a single word. The name that you enter here will appear in the drop-down at the top right hand side of PAM360 GU.I In addition, the display name will appear in PAM360 login URL. (For example, if you assign 'xyz' as the display name, the login URL for the organization will be https://:/xyz). Account Manager: You can designate any administrator at your end (MSP) as the 'Account Manager' for the organization being added. As the name indicates, the account manager will be the point of contact for the organization being managed and will have privileges to add and manage resources on behalf of the organization. The Account Manager with the role 'Admin' in PAM360 will be able to manage the users of the organization too. You can designate only one account manager per organization being managed. The same administrator can be made the account manager for multiple client organizations. Fill-in other details like Department, Location etc. as required Import Organizations from CSV You can import multiple organizations from a CSV file using the import wizard. The CSV should have entries regarding organization name, display name and other details in comma separated form. The entry for each organization should be in a new line. All the lines in the CSV file should be consistent and have the same number of fields. CSV files having extensions .txt and .csv are allowed. To import organizations, Navigate to Admin >> Organizations. Click the button “Import Organizations” In the pop-up form that opens, choose the file format. Browse and select the CSV file containing the organizations. Click “Next” In the pop-up form that opens, you can choose which field in the CSV file maps to the corresponding attribute of the Organization. Finally, click “Finish”The result of every line imported will be logged as an audit record. The result of every line imported will be logged as an audit record. Granting Manage Organization Privilege Apart from designating an administrator as ‘Account Manager’, you have the option to grant ‘Manage Organization’ privilege to any other member of your MSP org. When you grant this permission to an administrator, he will have admin privileges on the client org. Similarly, if the permission is granted to a password administrator or to a password user, they will have the respective privileges. For security reasons, PAM360 enforces approval process for managing an organization. That means, while any administrator at the MSP can initiate manage permission to a user, it has to be approved by some other administrator at the MSP org. One who initiates the request and the one for whom the request is being initiated cannot approve. A third administrator has to approve. This is to ensure that no administrator is able to acquire manage permission for himself or grant that privilege to anyone else without the approval of another admin. This essentially means that the MSP org should have a minimum of three administrators to carry out this process. For example, assume the scenario when ‘Admin A’ wants to provide manage permission to ‘Admin B’ for the organization ‘ABC’. In this case, both Admin A (the proposer) and Admin B (the admin designate) cannot approve. Another admin, say, ‘Admin C’ will have to approve. To grant manage permission for an organization, Log in to your MSP account and navigate to the "Users" tab. Click the ‘User Actions' icon against the desired user and select 'Manage Organization’ from the dropdown. In the pop-up form that opens, select the required client organization and move it to right. Select the name of the approver. Click ‘Save’. The user will gain manage privilege once the approval is done. Alternatively, you can also grant manage permission from 'Organizations' page by clicking the 'Actions' icon against the desired organization and selecting 'Manage Organization' from the dropdown. MSPOrg – The default org By default, one organization named “MSPOrg” will be available. This default org is basically your organization (MSP’s organization). The passwords that you add here will pertain to your own organization and not that of your clients. Password Management for Client Organizations Once the organization is added, you will see the list of organizations being managed by you (i.e for which you have manage permission or for which you are the account manager) on the top band of the PAM360 GUI “Select Organization”. Select the required organization and proceed with resource addition. You can then share the passwords with your clients. On the other hand, if you are providing Password Management Service, you will ask your client to add passwords themselves. How to access any specific client org? You can access your MSP org as usual by accessing the URL https://<PAM360-Host-Name>:7272/. You can select the required client organization from the top band of the PAM360 GUI. How do your clients access PAM360? After creating an organization, you clients can connect to their organization and view/manage passwords by typing the URL as explained below: https://<Host Name:<port>/<Name of the org> For instance, assume that the name of the organization of your client is ‘abc’ and PAM360 is running on the host “pam360host”, then the URL to connect to an organization will be: https://pam360host:7272/abc For information on how to perform various password management features, refer to the respective sections of the help documentation. How to delete a client organization? You can be eligible to delete a client organization in PAM360 only if you are an MSPOrg administrator. Additionally, you should also have any of the following privileges: Be the Account Manager of the client organization you want to delete. Hold "Manage Organization" permission for the client organization you want to delete. To delete an organization, Navigate to Admin >> Organizations. Locate the client organization that you want to delete, click on Actions icons beside it, and select Delete Organization from the drop down menu. Click OK to confirm deletion. Note that deleting a client organization will also delete all resources and users added under it.