Exceptions are used as access deny lists in Access Control. Exceptions are created automatically when you block the user during a manual or automatic disconnect session.
Exceptions are used as access deny lists in Access Control. Exceptions are created automatically when you block the user during a manual or automatic disconnect session.
Blocking user access in versions earlier than Privileged Access Manager 4.0: Till Privileged Access Manager 4.0, any privileged access request processed by Access Control, Command Control, or Emergency Access, was evaluated against Blocked Users group first. If a user was part of Blocked Users group, then all the access was denied.
Blocking user access from Privileged Access Manager 4.1 and later: Exceptions are applicable only to Access Control. They are not considered while evaluating Command Control policies or Emergency Access requests. Any privileged access request processed by Command Control or Emergency Access, is evaluated against Blocked Users group.
Navigate to Access Control > Exceptions and click the Configuration icon on the right pane to set properties or exceptions.
Status: You can retain the enabled status of this option if you want the exceptions to be evaluated while processing the privileged access requests by Access Control. This option is enabled by default. Move the slider to the left if you want to disable this option.
Deny Access On: You can select any combination of Resources or Permissions.
Selecting All Resources implies that user access is denied on all resources.
Selecting Target Resource implies that user access is denied on the target resources only.
Selecting All Permissions implies that user access is denied for all permissions.
Selecting Target Permission implies that user access using the target permission is denied for the user with any permission.
Following are the possible combinations:
All Resources + All Permissions: This combination implies that all access for the user is denied.
All Resources + Target Permission: This combination implies that user access for the target permission is denied on all resources. Example: If the target permission is Direct RDP, then user access to any resource using Direct RDP is denied.
Target Resource + All Permission: This combination implies that access to the target resource is denied for the user using any permission.
Target Resource + Target Permission: This combination implies that user access using target permission to the target resource is denied.
Expire After: You can set the validity for the exception in minutes, hours, days, week, or never. The default value Never, implies the exception will be applicable indefinitely.
Delete After: You can set the deletion time for the exception after expiry. The exceptions will be purged from the server after the configured days of expiry. Only the expired exceptions will be deleted.