Integrations
Audience: operator · Profile:
both· Read this when: you are connecting the dashboard to something you already run, and want that system's prerequisites and config keys.
One page per external system. Each covers what the integration does, what it needs from you before it will work, the config keys it reads, and how it fails.
Two groups worth telling apart. The BeyondTrust pages are the four layers the dashboard puts on top of anything it provisions — a route in, a vaulted credential, a just-in-time grant, and the endpoint agent. The platform pages are places infrastructure lives, or things that run work on it.
The Settings page is tabbed: Account (account details, security keys, the MCP
endpoint), Appearance, Integrations, Reference and Preview features.
Appearance, Integrations and Preview features are admin-only. Each tab has its own URL,
such as /settings#integrations or /settings#preview.
Settings → Integrations is tabbed again inside, along the same lines as these pages: BeyondTrust (Password Safe, PRA, EPM for Linux, Entitle), Hypervisors, Cloud services, Governance & cost, Platform (Remote Worker, Job Worker, Remote Agents, SSO, MCP Server) and POV (Skytap, POV cloud provider). A path such as Settings → Integrations → Entitle in these pages means: open the tab that holds it, then its Configure →. Each tab's badge counts the toggles switched on in it.
Giving a credential to something that is not a person is a folder of its own, not a
page here: workload-lab/ holds the four mechanisms — certificates,
SPIFFE, cluster tokens and short-lived cloud credentials — the Workload Credentials
product behind one of them, and the register of what actually consumes each. Start at the
Workload Lab hub if you have not picked a mechanism yet.
BeyondTrust
| Page | Read this when |
|---|---|
| BeyondTrust Integrations | you are wiring the dashboard into BeyondTrust and want to know which product does which job. |
| Privileged Remote Access | you want sessions onto provisioned resources brokered and recorded rather than routed. |
| Password Safe | you want credentials vaulted and rotated rather than stored by this dashboard. |
| Password Safe for databases | the credential you want vaulted belongs to a database: the shared model, then one page per cloud (AWS, Azure, GCP), under password-safe/. |
| Gateways | a resource sits in a private network and something has to broker a session into it. |
| Entitle | you want access to expire on its own instead of being revoked by someone remembering. |
| Entitle dashboard permissions | you want dashboard access without standing admins, or you need to tell the two mechanisms apart. |
| Entitle virtual applications | you registered Active Directory or an identity provider and want people to request its groups in Entitle by a clear name, under an approval tier. |
| Entitle persona bundles | you want people to request everything one job function needs on one cloud, or on-premises through Active Directory, in a single Entitle request instead of a handful of separate roles. |
| EPM for Linux | you are rolling Endpoint Privilege Management for Linux onto provisioned hosts. |
On-premises hypervisors
| Page | Read this when |
|---|---|
| Hyper-V | your VMs live on Hyper-V and you want them managed from here. |
| vSphere / ESXi | your VMs live on vSphere or a standalone ESXi host. |
| Proxmox VE | your VMs live on Proxmox VE. |
| Nutanix AHV | your VMs live on Nutanix AHV. |
| XCP-ng / XenServer | your VMs live on XCP-ng or XenServer. |
| VMware Workstation | you are running VMs on VMware Workstation on this machine. |
Anything the dashboard cannot route to is reached through an agent instead — see Remote Agents.
Runners, platforms and access
| Page | Read this when |
|---|---|
| Remote Worker | you are configuring the runner images that execute Config Management, k8s and promote jobs — six pages under ansible/. |
| Cloud Functions | you need a stable HTTPS endpoint external systems can call to act inside your network. |
| Rancher | you have more than a couple of clusters and want one place to see them. |
| Portainer | you already run Portainer and want the dashboard to drive it. |
| OIDC and single sign-on | you want SSO, Dex, Entra sign-in or Entra → Kubernetes federation, or the dashboard's own identity for the clouds. Its own section now, under oidc/. |
| MCP server | you want an AI client to drive the dashboard through its own API. |
The one POV-only integration, Skytap, lives with the rest of the POV material at profiles/pov/skytap.md: Settings refuses to enable it on an estate instance, so it is not a choice available here.