Secrets Manager
External backend activeConfigure where the dashboard stores credentials and API tokens. Migrating moves secrets from the encrypted database to an external provider — no restart required.
Active Secrets Backend
Choose where new secrets are stored. Changing this setting does not move existing secrets — use the Migrate tab to move them.
Defaults to your configured AWS region if blank.
Secrets will be named <prefix>/<key>.
Uses the Azure service principal configured in Setup → Azure.
Defaults to your configured GCP project if blank.
Secrets will be named <prefix>-<key>.
Defaults to your BeyondTrust Password Safe host if blank.
Secrets will be stored as <folder>/<key>.
Numeric User ID only, not a username — ps-cli's -o flag silently fails (exits 0, no secret created) when given a string.
Find it in BeyondInsight under Configuration → Role Based Access → User Management, or copy the OwnerId from any existing secret in the target folder.
New secrets are written as <folder>/<key>.
Existing references keep the folder they were written under.
The site, the API version and the auth mode live in Settings → Integrations → BeyondTrust → Workload Credentials. On workload-identity (entra) auth this backend holds no bootstrap credential of its own, so every database secret — including the Personal Access Token — can be migrated into it.
Secrets not changed in this many days are surfaced on the dashboard's “Needs attention” panel. External-vault references use the backend's own last-rotated date; database secrets use their last-saved time. 0 disables the check.
Where a Windows build's generated administrator password is written. Automatic uses Password Safe when it is configured (ps-cli client + a numeric Secret Owner above), else the backend selected here if it is external, else the cloud's own vault. It is never kept in the dashboard database — with nothing external configured, Windows builds are refused.
Secret Registry
All credentials managed by the dashboard and their current location.
| Secret | Backend | Reference | Status |
|---|---|---|---|
| Database AWS SM Azure KV GCP SM BT Safe Workload Creds | Configured Not set |
Browse & Edit
Full CRUD on any backend. Every secret value is JSON — the editor enforces it on save.
ps-cli supports full CRUD on Safes & Folders. Deletes require the container to be empty.
| Name | Updated | Actions |
|---|---|---|
Name is immutable. Delete and recreate to rename.
Migrate Secrets
Move all database-stored secrets to an external backend in one step. A dry run previews what would be migrated without making changes. Secrets already on a different external backend are left untouched.
- ✓
Skipped:
Errors:
-
✗
Confirm Migration
This will read every database-stored secret in plaintext, write it to , and replace the database value with a reference. This cannot be automatically undone.
Run a Dry Run first to verify which secrets will be migrated.