Setup
Privileged Access Manager
Configure the Create Privileged Account Process
4 min
the create privileged account process enables end users to request and create privileged accounts with the appropriate approvals, governance, and business rules automatically enforced configure privileged account parameters to successfully create a privileged account using the privileged account manager, several parameters must first be configured open activate studio and navigate to resources > privileged accounts select the account type you want to configure, for example generic account locate the userou parameter and set the organisational unit (ou) where this type of account will be created this process is similar to how the members parameter was configured previously if the account type allows an exchange mailbox to be created, create a new string parameter named exchangeserver and set its value as follows on premises exchange use the name of a server already configured under resources > exchange servers office 365 set the value to office365 for full instructions on configuring exchange servers in activate, refer to the exchange configuration article on the activate support portal you can also set the exchangeserver parameter at the root of resources > privileged accounts parameters configured at the root level are inherited by all account types unless specifically overridden test creating a privileged account once configuration is complete, test creating a privileged account log in to the activate web portal as a service desk user select privileged accounts from the home page and choose the generic account type click the create account button on the ribbon bar if the create account option is not visible, check the security rights for the privileged accounts resource ensure that the system role / service desk users role has create permissions on the privileged accounts node in activate studio complete the required fields name description mail enabled manager owners click next to continue onboarding options the onboarding options page displays the login name and email address that will be generated it also lists any default services (service catalogue items), distribution lists, or shared folders automatically assigned based on the account’s associated role you can also select additional options for the new account, such as extra services, distribution lists, or shared folders activate can also suggest access based on a department role or another user profile confirm and submit review the summary of the create account job, then click submit by default, the create account task does not require approval and executes immediately approval steps can be added if required verify the account once the job has completed, use active directory users and computers (or another suitable tool) to verify that the new account has been successfully created in active directory