When privilege is permanent, so is the risk
As an IT environment grows, administrator rights spread. The systems team accesses servers, the network team firewalls, the development team databases, and an external supplier the ERP server. Add service passwords embedded in applications, certificates about to expire and local admin rights forgotten on users’ computers. When each of these is managed with a separate tool, no one sees the whole picture.
ManageEngine PAM360 is an enterprise privileged access management (PAM) solution that brings all privileged access together on a single platform. It covers the capabilities of Password Manager Pro and Access Manager Plus, and adds new ones on top.
What does PAM360 do?
Discovers accounts and vaults them
It scans the network to discover privileged accounts on servers, network devices and databases, and stores them in an AES-256 encrypted vault. Passwords are rotated automatically at intervals you define.
Grants privileges only as far as needed
With just-in-time privileges, elevated rights are assigned to a domain account only for the duration of the task; when the time is up they are revoked and the password is reset. Endpoint privilege management removes unnecessary local admin rights from user computers, and applications are controlled with allow and block lists.
Monitors and records sessions
RDP, SSH and similar connections are opened through an encrypted gateway without requiring an agent. Sessions are recorded as video, and can be watched live and terminated when necessary. AI-assisted behavioural analytics highlights unusual privileged activity.
Manages machine identities too
It discovers and rotates SSH keys and tracks the lifecycle of SSL/TLS certificates. Through APIs, applications and DevOps tools retrieve passwords from the vault instead of embedding them in code. Cloud infrastructure entitlement management, which monitors excessive permissions in cloud environments, is also part of the platform.
PAM360 with Unna
PAM360 is for organisations with multiple IT teams, external service providers, cloud workloads and audit obligations. If all you need is a password vault, we will recommend a lighter product.
- We listen first. Together we build an inventory of your privileged accounts, service accounts, SSH keys and certificates.
- We plan together. We design which team accesses which system with which approval, and which accounts move to just-in-time privileges.
- We roll it out step by step. We enable the vault and session recording first, then automatic password rotation, and endpoint privilege management last. We test every step on non-critical systems.
- We stay by your side. We review access reports with you regularly and verify that access for departing employees and completed projects has been closed.
Part of the whole
- On the identity and access management page, we compare three ManageEngine products.
- If you only need a password vault, Password Manager Pro may be a better fit; if you only need recorded remote access, Access Manager Plus.
- ADManager Plus manages the lifecycle of user accounts, while PAM360 manages the use of the most critical accounts.
- With Firewall Analyzer, we assess network-side logs together with PAM360 session records.
- In a disaster recovery plan, the PAM360 vault must also be accessible at the backup site; we make this part of the plan.
Frequently asked questions
Can we migrate from Password Manager Pro to PAM360?
Yes. ManageEngine provides a migration path for this. The records in the vault are transferred, and new features are enabled as needed.
Do we need to install an agent on user computers?
Not for remote sessions. Some features, such as endpoint privilege management, do require an agent on the relevant devices.
What does it provide for audits?
It provides logs and ready-made reports showing who accessed which system, when and with which approval. In ISO 27001 and KVKK (Turkey’s Personal Data Protection Law No. 6698) compliance work, it forms concrete evidence of access control.
