How does a true PAM work?

A Privileged Access Management (PAM) solution helps to secure and control privileged access to critical software and assets. Credentials and specific levels of access to various applications are provided through the PAM.

Usually, organizations implement PAM only for authorization and de-authorization of access to the apps. For instance, let’s say a new employee needs access to Gmail, Jira, and your CRM. Typically, organizations only provide access when the employee joins, and revoke it when he or she leaves. This can be done by a simple Identity and Access Management (IAM) solution – however, a PAM can do much more. (Quick side note: Akku serves both PAM and IAM needs.)

Here are some of the key functions that a PAM solution generally serves.

1. Assigning specific rights and access privileges

On each SaaS platform, what rights does each employee have? For example, take the CRM. Can they add and delete workflows? Is an individual user to be a super-administrator? Do they need to be allowed only to create contacts, but disallowed from editing or deleting?

Access may also be changed for the employee as they grow within the organization. When the employee is promoted, they may get additional responsibilities. For instance, a sales executive may not be allowed to edit contacts, but once promoted as a sales manager, this permission may become necessary.

You need not go to the CRM to make these changes – you can do so directly from your PAM platform. An IAM and PAM tool (like Akku) will allow you to manage changes to access permissions such as these from a single dashboard, with a single click.

2. Deprovisioning access

The day an employee leaves an organization, the IT team usually uses their generic IAM to revoke access to all SaaS apps (Gmail and Freshdesk, for example).

However, by doing this, only the IAM gateway to the app is deactivated: the license on the application itself remains. That means that the subscription charges continue on, as well, unless you go to the SaaS platform and delete the license there.

A true PAM directly deletes the license on Gmail or Freshdesk as well. It also follows the same exit procedure as that of the app itself. For instance, Gmail allows you to back-up email data to an email account of your choice before deleting the account. A professional IAM and PAM tool like Akku does the same, following the same laid-down process of the application.

By directly deleting the license on the application platform itself, you can be sure that you won’t waste money on subscription charges due to human error. This kind of automation is essential for enterprise-level customers. As they have a huge number of licenses, it is impossible to manually track the licenses in use and those no longer required. As a result, enterprises may realize that such a costly error has occurred only after subscription fees have built up!

The PAM also prompts you when you’re not using a license, upon which you can delete the license through the PAM.

Akku is a customizable IAM and PAM solution with user-friendly features that can be configured based on your specific requirements. Our team is well equipped to help you implement PAM at your organization and get the most out of it. Let’s talk.
Contact us