Contractor and Vendor Access

Organizations can use membership types in the Verify Privileged Identity Platform to manage user entitlements between limited Vendor User capabilities and full-featured IT User capabilities in Verify Privilege Vault. The following table shows the differences between these two types of entitlements.

Verify Privileged Identity Platform users are automatically granted IT User entitlements unless their membership type is explicitly set to “Vendor”.

Capability	Vendor User	IT User
View secrets	✔ (Passwords are invisible)	✔
Launch secrets	✔ (PRA)	✔
Request access to secrets	✔	✔
Approve access to secrets		✔
Share secrets		✔
Create and manage secret and folder lifecycle		✔
View secret and user audit logs for owned secrets		✔
Use Verify Privilege Vault Remote to login to Verify Privilege Vault		✔
Use the Verify Privilege Vault SDK and API		✔
Configure security features for a secret		✔
Configure password rotation		✔
All administrative functions in Verify Privilege Vault		✔
Create/Manage Integrations, Workflows, Pipelines, Discovery, Sites. Distributed Engines, HA/DR, etc.		✔

Customers who have purchased PRA concurrent user licenses are entitled to Vendor User capabilities automatically. Learn more about PRA Understanding PRA Entitlements .

Entitlements are enforced even if a user is granted RBAC permissions for related actions.

Prerequisites

If you are using Verify Privilege Vault On-Premise with the Verify Privileged Identity Platform, see Connecting to Verify Privilege Vault On-Premises for the currently supported version.

Local Users

Customers can use their Verify Privileged Identity Platform local directory to onboard third-party users who need short-term access. Customers can also use the local directory when they do not want to add third-party users to their own identity sources. For details, see Adding a Local User Account.

Bulk Import of Vendors

Verify Privileged Identity Platform provides a bulk import capability for organizations that deal with large numbers of third-party users and need an efficient way to manage access to Verify Privilege Vault entitlements. To use bulk import, you prepare a file with user data, format it according to the system's requirements, and upload it.

For more detailed information about importing vendors in bulk, see Bulk Importing Local Users.

Active Directory

Tenant administrators can manage third-party vendor entitlements through Active Directory. For more information, see Managing Vendor Entitlements with Active Directory.

Federated Vendors

Tenant administrators must create a custom attribute in the identity provider (IdP) and map it to a PlatformUserMembershipType claim in the Verify Privileged Identity Platform. Claims for users must have a value of either Vendor or Employee.

For more information about managing third parties from a federated identity source using SAML or OIDC, see Managing Vendor Entitlements with Federation.