What is privileged access management?
Privileged access management (PAM) controls how administrator-level accounts and credentials are stored, requested, used and monitored. Privileged accounts include domain and cloud administrators, root on Linux servers, local Administrator accounts, database administrators, service accounts with broad rights, and emergency break-glass accounts. One stolen privileged credential can give an attacker the whole environment, so PAM aims to keep as few privileges standing as possible and to make every use of the rest approved, time-limited and recorded.
Do not confuse it with Linux PAM, Pluggable Authentication Modules, the framework that lets Linux and Unix services plug in authentication methods through files in /etc/pam.d/. Same acronym, different subject.
What a PAM system does
- Credential vaulting: privileged passwords and SSH keys live in an encrypted vault instead of spreadsheets, scripts or people's memories.
- Check-out and rotation: an administrator checks out a credential for a task, and the system changes the password when the session ends, so a copied password stops working.
- Just-in-time elevation: users hold no standing admin rights; they request a role for a set time with a justification, and the grant expires automatically.
- Approval workflows: sensitive requests need a second person to approve.
- Session brokering and recording: the PAM proxy opens the RDP or SSH session for the administrator, often without revealing the password, and records it for review.
- Discovery: scans find privileged and service accounts nobody registered.
- Ephemeral credentials: some tools issue short-lived accounts, certificates or tokens that exist only for one session.
Example: one elevation, start to finish
An Exchange administrator holds no admin rights day to day. To apply an approved change overnight, she requests the role through the PAM portal:
| Time | Event |
|---|---|
| 02:10 | dpatel-adm requests Exchange Administrator for 2 hours, citing change ticket CHG0041872; FIDO2 MFA completed |
| 02:11 | Request approved by the on-call manager |
| 02:11 to 04:11 | Admin session runs through the PAM proxy and is recorded |
| 04:11 | Role expires; the account is back to no admin rights |
An attacker who phishes that account the next day finds no admin rights, and activating the role would need another MFA check and an approver the attacker does not control. Every elevation that does happen is tied to a person, a reason and a time.
PAM vs. IAM, PIM and least privilege
- Identity and access management (IAM): the broader discipline of creating identities, authenticating them and granting access for everyone. PAM is the part focused on the most powerful accounts.
- Privileged identity management (PIM): often used for managing which identities hold privileged roles, with time-bound activation; Microsoft Entra Privileged Identity Management is an example. Vendors use PAM and PIM loosely and the features overlap.
- Least privilege: the principle. PAM is one way to enforce it for administrators.
- Jump server: a hardened host for administrative sessions. PAM tools often add vaulting, approval and recording on top of one.
Making PAM work
PAM fails when administrators keep side doors open. Give administrators separate admin accounts with no mailbox or web browsing, keep groups such as Domain Admins nearly empty, and protect the vault itself with phishing-resistant MFA and tightly limited administration. Keep a documented emergency access account in case the PAM system is down. Alert on additions to privileged groups that did not come through the PAM workflow; Windows logs event 4728 when a member is added to a security-enabled global group and 4732 for a local group. Make each machine's local Administrator password unique and rotated, for example with Windows LAPS.
Privileged access management on the CompTIA Security+ exam
PAM falls under SY0-801 objective 4.5, which covers running identity and access management day to day, and it also appears with secure remote administration under objective 3.2. Scenario wording such as "administrators should not know the passwords", "rotate credentials after each use", "record privileged sessions", "no standing admin rights" or "temporary elevation with approval" points to PAM, often with just-in-time permissions or password vaulting as the feature that fits. Distractors include a password manager for ordinary users, stricter password complexity, SSO and MFA alone, which all help but do not vault, time-limit or record privileged use. If a question mentions authentication modules on a Linux server, it means Pluggable Authentication Modules, not privileged access management.