Privileged access profiles (approvals, duration and permissions)

An access profile says who approves requests for an account, how long access lasts and what the person may do. Each account has one profile.

How do I create a profile?

Field	Notes
«Name»	Up to 128 characters
«Approvals required»	0 («No approval») to 3
«Approver groups»	Up to 16 groups; at least one when approvals are required
«A request waits for approval (minutes)»	5 minutes to 72 hours
«Default lease (minutes)» and «Maximum lease (minutes)»	Up to 24 hours
«One holder at a time»	Only one person holds the account at a time
«Allow recorded sessions»	Sessions through the terminal
«Allow revealing the credential»	Requires «Rotate the credential when it is checked in»
«Allow the clipboard in sessions» and «Allow SFTP»	Optional
«Alert rules»	Up to 32 lines `alert: pattern` or `terminate: pattern`

On the account, «Access profile» › pick the profile › «Save profile». The "no profile" option means nobody can request the account.

An approver never decides their own request.
With dual control on, creating, changing, deleting and assigning profiles waits for a second administrator.
Lowering a critical profile's quorum is possible only through an approved command.

«Ask for approval before each connection» is not served yet: a profile with this option refuses sessions. Keep it off.