Vault and credential rotation

In this tutorial, we store a privileged account's credential in the vault, and set the password to change on its own. Credentials live in a write-only vault. On the target, open the account and choose Set credential. Paste the secret and save: it's never shown again. Every change creates a new version. Each version is encrypted with an organisation key, protected by the key management service.

Nobody sees the password, except someone with an approved checkout on a profile that allows it. For rotation, open PAM, Rotation, and choose Add policy. Set the frequency, the length and the character classes. The console shows the approximate strength. You can also limit rotation to windows, for example early Monday morning. Then, on the target's accounts, choose Rotation, assign the policy and confirm the connector.

The change asks for a recent passkey confirmation. With dual control, it waits for a second administrator. The password changes on the target itself, through the appliance: on schedule, when access is returned, after a reveal or emergency access, or on demand, with Rotate now. Under Rotation jobs, you see each rotation with its reason and state. A failure is retried at growing intervals; after six attempts, it needs attention, and you can choose Retry.

A rotation creates a pending version, which only becomes current once the target confirms it. That way, the stored credential is always the one that works. And that's it: credentials sealed in the vault, and passwords that change on their own. More help in the knowledge base.