Session Request Account

Question

Is there any form to use a Functional Account of a System to Request a Session?

Clint Coady · Accepted Answer

Hello, 
 Managed Accounts and User IDs are separate objects. You login and are assigned permission through a User ID and then you request a Managed Account. You could submit a request with the same credentials as the Functional Account, but it would need to be added separately as a User in TPAM. 
 There is no direct relationship between the Accounts that are being requested and the User credentials that are used to login.

tim westcott · Answer

Yes you can set the TPAM functional account to be available for release via a requestor permission BUT why would you...This is the account that is that by definition has the permissions assigned to it to allow other privileged passwords to be changed. I would strongly recommend that you do not configure TPAM to allow functional accounts to be released. I have never seen a use case where this has been configured at any of the TPAM deployments I have worked on and I can go back to when TPAM was just PAR and on release version 0.98... 
 All that said if you have a valid use case and still wish to allow the functional accounts to be release then it is a simple tick box with each functional account you setup. 
 This is found on the system connections tab where you define the functional account and connection details for the system rather than with the accounts. 
 From Admin guide: 
 .Allow Functional Account to be Requested for Password Release - If selected, requestors on this system can make a request to release the password for the functional account. If not selected, the functional account passwords are not available for release to a requestor and are only accessible to an ISA. 
 Hope this helps 
 Tim

Endpoint Privilege Management

Session Request Account