good morning, I have a few questions about this. 

1. is the account logging into PWS an AD account?
2. is there a smart rule/group for this account?
3. how have you dedicated the accounts to each other. 

here are some thoughts 

To block admin users from viewing or accessing non-dedicated mapped/shared IDs in BeyondTrust Password Safe, you can use a combination of role-based access controls, Smart Rules, and Access Policies. Here's how to approach it:

Steps to Restrict Access to Shared or Non-Dedicated Accounts

1. Use Role-Based Access Groups

• Create specific roles for different user types (e.g., Admins, DBAs, Helpdesk).
• Assign minimal permissions to roles that should not access shared accounts.
• Ensure that only designated roles have access to Password Safe Account Management and Session Access features. [docs.beyondtrust.com]

2. Configure Smart Rules for Account Segmentation

• Use Smart Rules to categorize accounts:
  • Dedicated Accounts: Use naming conventions or metadata to tag these.
  • Shared Accounts: Tag separately using account attributes.
• Assign Smart Rules to Smart Groups, which can then be linked to specific user groups. [docs.beyondtrust.com]

3. Apply Access Policies

• Create Access Policies that define who can:
  • View account details.
  • Request password checkout.
  • Initiate sessions.
• Apply these policies to Smart Groups containing shared accounts, and exclude admin roles from these policies. [docs.beyondtrust.com]

4. Use Managed Account Aliasing (Optional)

• If needed, use Managed Account Aliasing to abstract shared account access, allowing only specific users to access them without revealing actual credentials. [beyondtrust.com]

Best Practices

• Audit regularly to ensure access controls are enforced.
• Avoid assigning Full Control to general admin roles unless absolutely necessary.
• Document account ownership and access justification for shared accounts.

I believe we can work with some smart rule filter and/or access policies to help with this.

Hi frank,

 thank you so much for reply. below are my comments 

1. for shared accounts we dont have any matching attributes to map hence we are using one to one mapping. i.e. creating smart rule with only show as smart group setting and then assigning it to group which has user who needs to access it. 

2.yes users login to password safe are using AD account using saml sso. form login is disabled for all

3.Apply these policies to Smart Groups containing shared accounts, and exclude admin roles from these policies.  can you please elaborate how can i exclude adminstrator group so that they dont see non dedicated account or shared id?

awaiting your response. thanks in advance

Regards 

Imran