Skip to main content
Stephen_Lee_Sino
Apprentice
February 27, 2026
Question

BeyondTrust Report Capability

  • February 27, 2026
  • 1 reply
  • 74 views

Out shop is using BeyondTrust 25.2 and soon upgraded to 25.3  I find the current reporting and analysis is quite limited in terms of functionality.  I would like to see if you faced the same or any other circumventions.  I regarded my requirements quite elementary however, it turns out to my very big despair.

 

In fact, my intention is to produce a holistic entitlement report for review purpose.  Our interest is to export an excel like format with 

 

user id                            list of managed accounts                                       role (requestor/auditor/approver)

 

 

Now, I try to use smart rule details of password safe.   However, the structure of this is totally unacceptable as if you want to download.   100 Smart rules will need to download 200 times which is very time consuming

 

other next, is to associate by table join to group entitlement report as I don’t want reviewers to know which groups and in particular smart groups which are no meaning to them as well as they are not supposed to know what smart groups are for.

 

Your ideas are welcomed.  

 

 

      1 reply

      BeyondTrust Employee
      jchandler
      BeyondTrust Employee
      March 9, 2026

      Hello ​@Stephen_Lee_Sino  

      There is a report (Reports | Password Safe | Entitlement by User)
      This report does list each user and their role and the managed accounts they can access.
      If you filter by all Assets and All Groups you will have a list of all users in PasswordSafe. 

      If you want to export and do additional processing you can export to Excel or CSV. 
      It will export these fields (UserName,RoleName,AccountName,SystemName,Application,UserGroup,SmartRule,AccessPolicy,DedicatedInfo)

      Also we have an entitlements API endpoint if you prefer to automate the process. 

      https://docs.beyondtrust.com/bips/reference/get-api-public-v3-entitlements

      Here is a sample of one of the entitlements from the API call.

      GroupID                            : 5
      Name                               : PAM_Users
      SmartRuleId                        : 2001
      Title                              : All Managed Accounts
      SmartRuleType                      : Account
      AccessLevel                        : Read-Only
      RoleId                             : 1
      RoleName                           : Requestor
      DedicatedAccountPermissionOverride : Request Override
      DedicatedToAppUserID               : 3
      DedicatedToAppUserName             : user3
      IsAdministratorGroup               : 0
      UserID                             : 57
      UserName                           : user1@btsupport.int
      ManagedAccountId                   : 548
      AccountName                        : BTSupport.int\user3-admin
      RationalizedSystemName             : Integration (linked)
      ApplicationName                    : 
      AccessPolicyName                   : Default Auto-Approve Access Policy
      ManagedSystemID                    : 264
      ApplicationID 

      If you have any questions please let me know. 

       

      Regards,

      John

        Badge Earners

        Show all badges
        Terms & ConditionsAccessibility statement