Frequently Asked Questions

Find answers to common questions about PAM-Pro's architecture, deployment limits, and compliance boundaries.

What accounts can PAM-Pro vault?

PAM-Pro can vault the password of any account that exists in Microsoft Entra ID - including Global Administrator accounts, service accounts, break-glass accounts, and any other privileged identity. It is entirely up to the customer to decide which accounts they vault within their customer-specific Azure Key Vault.

Huntoso does not hold or have persistent access to your keys - the customer has their own Key Vault but it sits in the provider tenant. Key Vaults that sit in the customer tenant are an add-on feature coming soon.

The cryptographic boundary depends on your tier:

• Standard SaaS / On-Premise: FIPS 140-2 Level 1 - software-protected keys in Azure Key Vault (Standard tier).
• HSM Add-on: FIPS 140-3 Level 3 - hardware-protected keys in Azure Key Vault (Premium / Managed HSM tier) with full tamper-resistance and physical key isolation.

What counts as a billable account?

Huntoso PAM-Pro charges exclusively for managed Entra ID user accounts that you have promoted to managed status for automated credential rotation, JIT elevation, and access governance.

The following items do not count against your licensed account limit and are not charged:

• Vaulted Secrets: Credentials stored in PAM-Pro modules such as SSH keys, web passwords, and custom credential templates.
• Unpromoted Discovered Accounts: Accounts enumerated during automated directory discovery that remain unmanaged.
• Unrotated Hybrid Accounts: On-premises synced accounts where Active Directory Password Writeback is disabled. PAM-Pro holds and audits these accounts without counting them against your billable seat total.

What if Entra ID experiences an outage?

Every aspect of PAM-Pro is built on Entra ID modern authentication mechanisms. Be it the SSO authentication for your user into the SaaS web platform, the password rotation mechanism from Huntoso compute nodes to your customer-specific (HSM) backed Key Vault, or the workload identity federation authentication mechanism that resets passwords in your customer tenant. When Entra ID experiences an outage, the product will also experience disruption. The depth and breadth of this Microsoft Service provider outage scopes the effect of the PAM-Pro outage.

What happens when a Just-In-Time session expires?

At TTL expiration, the automation engine immediately fires a revocation workflow. The target user is removed from the privileged Entra ID group and all active authentication tokens are invalidated across Microsoft 365 services. The event is logged to the WORM audit trail with a tamper-evident hash.

Do we need Entra ID P2 licenses?

No. Standard P1 covers all core PAM-Pro functionality including JIT access, rotation, and audit logging. However, the Risk-Based Credential Rotation feature and Identity Protection signal integration require Entra ID P2 (or Microsoft 365 E5 / Business Premium). Environments without P2 will bypass risk analytics but retain full governance capability.

Is PAM-Pro available in EU data regions?

No. PAM-Pro is currently deployed in United States Azure regions only. EU data residency is not available at this time.