Secrets Manager
External backend activeConfigure where the dashboard stores credentials and API tokens. Migrating moves secrets from the encrypted database to an external provider — no restart required.
Active Secrets Backend
Choose where new secrets are stored. Changing this setting does not move existing secrets — use Migrate Secrets below to move them.
Defaults to your configured AWS region if blank.
Secrets will be named <prefix>/<key>.
Uses the Azure service principal configured in Setup → Azure.
Defaults to your configured GCP project if blank.
Secrets will be named <prefix>-<key>.
Defaults to your BeyondTrust Password Safe host if blank.
Secrets will be stored as <folder>/<key>.
Numeric User ID only, not a username — ps-cli's -o flag silently fails (exits 0, no secret created) when given a string.
Find it in BeyondInsight under Configuration → Role Based Access → User Management, or copy the OwnerId from any existing secret in the target folder.
Secrets not changed in this many days are surfaced on the dashboard's “Needs attention” panel. External-vault references use the backend's own last-rotated date; database secrets use their last-saved time. 0 disables the check.
Secret Registry
All credentials managed by the dashboard and their current location.
| Secret | Backend | Reference | Status |
|---|---|---|---|
| Database AWS SM Azure KV GCP SM BT Safe | Configured Not set |
Browse & Edit
Full CRUD on any backend. Every secret value is JSON — the editor enforces it on save.
ps-cli supports full CRUD on Safes & Folders. Deletes require the container to be empty.
| Name | Updated | Actions |
|---|---|---|
Name is immutable. Delete and recreate to rename.
Migrate Secrets
Move all database-stored secrets to an external backend in one step. A dry run previews what would be migrated without making changes. Secrets already on a different external backend are left untouched.
- ✓
Skipped:
Errors:
-
✗
Confirm Migration
This will read every database-stored secret in plaintext, write it to , and replace the database value with a reference. This cannot be automatically undone.
Run a Dry Run first to verify which secrets will be migrated.