MSP PAM Enablement
BUSINESS + TECHNICAL MODULE

Deliver PAM as a
Managed Service

with Delinea

A complete enablement guide for Managed Service Providers ready to package, price, and operate Privileged Access Management as a billable managed security service. Covers architecture, multi-tenancy, licensing, onboarding, and client reporting.

Modules
7
Est. Duration
3.5h
Level
L2–L3
Role
MSP
MOD 01

Delinea Platform Architecture for MSPs

Understand how the Delinea Platform is structured and why it was built for multi-tenant delivery

The Delinea Platform is a cloud-native, API-first Privileged Access Management suite that consolidates Secret Server, Privilege Manager, DevOps Secrets Vault, and Delinea Cloud under a unified control plane. For MSPs, the architecture choice between Cloud-hosted, self-hosted, and hybrid deployments directly determines your operational cost, scalability ceiling, and SLA capacity.

☁️

Delinea Cloud (SaaS)

Fastest path to multi-tenant delivery. Delinea manages infrastructure; you manage tenants. Best for MSPs onboarding 3+ clients per quarter. Auto-scaling included.

🖥️

Self-Hosted Secret Server

Maximum control and compliance isolation. Required for clients in regulated industries. Higher OpEx but enables dedicated infrastructure per client.

🔀

Hybrid Deployment

Cloud control plane with on-premises agents (Distributed Engine). Ideal for clients that can't move secrets off-premises but want cloud-managed workflows.

🔌

API-First Architecture

All Delinea capabilities are exposed via REST API. Enables PSA integration (ConnectWise, Autotask), SIEM forwarding, and automated client provisioning pipelines.

MSP Decision Point

For net-new MSP programs, Delinea Cloud is the recommended starting point. It eliminates infrastructure management overhead and allows you to charge per-seat without capital investment. Self-hosted becomes compelling when you have 1+ enterprise clients requiring dedicated instance isolation or sovereign data residency.

Core Platform Components

🔑 Secret Server — Credential Vault Core

Secret Server is the foundational vault component. It stores, rotates, and audits privileged credentials (passwords, SSH keys, certificates, API tokens). For MSPs it supports folder-based segregation by client, role-based access control (RBAC) per tenant, and Distributed Engine deployment to reach on-premises client networks without exposing vault endpoints.

  • Automated password rotation (scheduled or on-check-out)
  • RDP / SSH session launch from vault (zero-credential exposure)
  • Dependency management for service accounts
  • SIEM-ready audit logs per tenant folder
🛡️ Privilege Manager — Endpoint Privilege Control EPM

Privilege Manager enforces least-privilege on Windows and macOS endpoints. It removes local admin rights without breaking workflows using application control policies and just-in-time elevation. As an MSP this translates into a measurable attack-surface reduction metric you can report to clients monthly.

⚙️ DevOps Secrets Vault DSV

A lightweight, API-centric vault for CI/CD pipelines and cloud workloads. Integrates with GitHub Actions, Jenkins, Terraform, Kubernetes, and Azure DevOps. For MSPs with development-oriented clients this is a premium add-on that extends PAM to machine identities and DevOps toolchains.

MOD 02

Multi-Tenancy Model in Delinea

How to structure a single Delinea instance to serve multiple clients with full data isolation

Delinea's multi-tenancy for MSPs is primarily delivered through organizational hierarchy, folder structure, and RBAC policies within a shared Secret Server instance — or via dedicated instances per client when hard isolation is contractually required.

3
Isolation Models
Tenants per Instance
0
Cross-tenant Visibility

A single Secret Server or Delinea Cloud instance hosts all clients. Client isolation is enforced through the folder hierarchy and RBAC policies. This is the most cost-efficient model for MSPs with SMB clients.

📁 MSP Root
  📁 Client A — Acme Corp
    📁 Network Devices
    📁 Windows Servers
    📁 Cloud Accounts
  📁 Client B — Northwind Ltd
    📁 Domain Accounts
    📁 SaaS Credentials
  📁 Client C — Contoso Inc
Key Config

Set Inherit Permissions = OFF at each client root folder. Assign client-specific roles only to that folder subtree. Enable Folder Auditing independently per client for isolated reporting.

Each client gets their own Secret Server instance (cloud-hosted by Delinea or self-hosted by the MSP). Maximum isolation — no shared compute, storage, or session data. Recommended for enterprise, healthcare, finance, or government clients.

  • Zero risk of cross-client data exposure
  • Per-client version control and maintenance windows
  • Independent backup and DR schedule
  • Higher licensing and infrastructure cost — pass-through billing recommended

MSP manages a shared cloud instance for SMB clients while running dedicated instances for enterprise accounts that require contractual isolation. Use a consistent naming convention and CMDB tagging to manage instance sprawl.

Operational Risk

Hybrid models increase operational complexity. Document your instance registry and enforce a templated onboarding process to prevent configuration drift between client environments.

RBAC Architecture for Multi-Tenancy

Delinea's role system allows you to create client-scoped roles with precisely bounded permissions. The recommended MSP pattern uses four standard roles per client tenant:

Role Name Assigned To Key Permissions Client Visibility
MSP_Admin_{ClientID} MSP Engineer Full CRUD on client folder, manage policies MSP Only
Client_SecretViewer Client IT Lead View own secrets, no cross-folder access Client Portal
Client_Operator Client Admin Check out credentials, launch sessions Client Portal
MSP_ReadOnly_Audit MSP Compliance Read all logs, generate reports, no secret access Audit Only
MOD 03

Segregating Client Secrets & Sessions

Technical controls to ensure zero cross-client visibility for secrets, sessions, and audit trails

Secret and session segregation is both a contractual obligation and a security control. In a shared Delinea instance, you must ensure that Client A can never view, access, or reference anything belonging to Client B — including audit logs, session recordings, and secret metadata.

Secret segregation relies on Delinea's Folder Permission Model. Configure these controls for every client tenant at provisioning time:

Create dedicated root folder per client with unique ID prefix
e.g. /CLIENTS/ACM001-AcmeCorp — enforces namespace separation
Disable "Inherit Permissions" on all client root folders
Prevents permission bleed from parent or sibling folders
Assign only client-scoped roles to the client folder tree
No shared group policies that span multiple client folders
Enable Secret Access Request approval workflows per client
Client approvers see only their own access requests
Configure Secret Templates per client for consistent categorization
Use naming convention: [ClientID]-[Type]-[Hostname]
Enable field-level encryption for sensitive secret fields
Passwords, private keys, and API tokens encrypted at rest per tenant

Session recording data must be stored and accessed in a client-isolated manner. Delinea stores session recordings as encrypted artifacts associated with the originating secret — which is itself folder-scoped.

Configure separate Session Recording storage paths per client
Use dedicated storage bucket or share: /recordings/ClientID/
Enable Session Recording on all privileged secret types
RDP, SSH, and web launchers — record with keylogging enabled for high-risk accounts
Set session recording retention per client SLA
Minimum 90 days for standard; 1 year for compliance-tier clients
Restrict session playback to client-scoped roles only
MSP Admins can view all; client users see only their own sessions

Audit logs in Delinea are scoped to the objects (secrets, folders, users) they relate to. MSPs can filter and export per-client audit data using folder-based filters and the REST API.

REST API · Audit Export # Pull all audit events for a specific client folder GET /api/v1/secret-audit/search ?folderId=1042 # Client A root folder ID &startDate=2025-01-01 &endDate=2025-01-31 &take=500 Authorization: Bearer {MSP_Service_Token} # Response includes: userId, action, secretId, ipAddress, timestamp
Automation Tip

Schedule a nightly audit export job via the Delinea REST API for each client tenant. Pipe results to your PSA or SIEM (e.g. Splunk, Sentinel) tagged with client_id for isolated dashboards and alerting.

MOD 04

MSP Licensing Considerations

Delinea's MSP licensing model, cost structures, and margin optimization strategies

Delinea offers a dedicated MSP Partner Program with licensing structures designed for multi-client managed delivery. Understanding the difference between user-based, node-based, and bundled licensing is critical to building a profitable service margin.

👤

User-Based Licensing

Licensed per privileged user (anyone who checks out a secret or launches a session). Best margin model for SMB clients where user count is predictable. Pool licenses across clients on shared instances.

🖥️

Node/Endpoint Licensing

Privilege Manager licenses per managed endpoint. Scales with client endpoint count, not user count. Predictable for infrastructure-heavy clients.

📦

MSP Aggregate Licensing

Delinea can offer an aggregate license pool for MSP partners — purchase a block of seats and distribute across clients. Typically unlocks 20-40% volume discount.

💰

Pass-Through vs. Bundled Billing

You can pass license costs directly to clients at markup, or bundle licensing into flat-fee service tiers. Bundled tiers increase predictability; pass-through maintains flexibility.

Licensing Considerations Checklist

Register as a Delinea MSP Partner to access partner pricing and NFR licenses
NFR (Not For Resale) licenses allow your team to train and demo without production cost
Negotiate aggregate license pool with your Delinea Channel Manager
Commit to a minimum seat count in exchange for per-unit discount — model breakeven at 3 clients
Understand license consumption: Active Users vs. Named Users
Delinea Cloud typically bills on active (concurrent) users — favorable for clients with shift-based ops
Include licensing overage terms in client contracts
Define what happens when a client exceeds their licensed user count mid-term
Map each client to a license tier (Essential / Advanced / Elite)
Aligns to your service catalog tiers defined in Module 06
Critical Reminder

Never share a single Delinea license key across legally distinct client entities if your MSP agreement requires tenant-level license accountability. Verify your agreement with Delinea's legal team before pooling licenses across clients with individual compliance obligations.

MOD 05

Standardized PAM Onboarding Process

A repeatable, documented runbook for onboarding new clients to your PAM managed service

Consistency is the foundation of a scalable MSP practice. A standardized onboarding process reduces time-to-value for clients, minimizes engineer variability, and enables you to delegate onboarding tasks to junior staff. The goal is a sub-5-day full onboarding for SMB clients with under 500 endpoints.

D1
Discovery
Asset inventory & stakeholder mapping
D2
Provisioning
Tenant creation & RBAC setup
D3
Integration
AD sync, agents, RMM hooks
D4
Vault Population
Import secrets, set rotation
D5
Handover
Training, SLA activation, reporting

Objective: Collect all data needed to configure the tenant without revisiting the client.

Complete MSP PAM Discovery Questionnaire (send 48h before kick-off)
Document Active Directory domains, OUs, and service account list
Identify privileged account inventory: local admins, domain admins, shared accounts
Map compliance requirements (HIPAA, PCI-DSS, SOC 2, ISO 27001)
Identify SIEM / ticketing system integration targets
Confirm network topology — does a Distributed Engine need firewall rules?

Objective: Create the tenant in Delinea, configure folder structure, and set up RBAC.

Create client root folder using naming convention /CLIENTS/{ClientID}-{Name}
Create 4 standard RBAC roles scoped to client folder (see Module 02)
Create MSP service account for this client with API access for automation
Configure Secret Templates for identified credential types
Set up audit logging and link to client log pipeline

Objective: Connect Delinea to the client's environment for live discovery and access.

Deploy Distributed Engine on client network (if hybrid/on-prem)
Configure Active Directory synchronization (groups, OUs, service accounts)
Run Discovery Scanner to identify unmanaged privileged accounts
Configure RMM integration (ConnectWise Automate / Datto / N-able) if applicable
Test session launch (RDP + SSH) and verify recording is captured

Objective: Populate the vault with initial credentials and configure rotation schedules.

Import discovered accounts using bulk import (CSV or AD sync)
Set password rotation policy: complexity + rotation frequency per account type
Configure service account dependency mapping before enabling rotation
Enable Check-out / Check-in with auto-rotation for domain admin accounts
Verify session recording storage path and retention policy is set

Objective: Transition client to steady-state managed service and activate SLA.

Deliver client admin training (90-min session: portal navigation, secret access, reporting)
Hand over Client Portal credentials with MFA enforced
Configure and send first monthly report (use template in Module 07)
Document all onboarding decisions in client runbook (stored in your PSA)
Schedule 30-day check-in and quarterly business review (QBR)
MOD 06

Service Catalog & Billable Tiers

Packaging Delinea capabilities into structured, sellable managed security service offerings

The most successful MSP PAM programs use a 3-tier service model: an Essential foundational tier, an Advanced operational tier, and an Elite compliance/enterprise tier. Each tier builds on the previous and maps directly to Delinea features and license SKUs, making upsell conversations concrete and outcome-driven.

Essential
Foundation · SMB
Advanced
Operations · Mid-Market
Elite
Compliance · Enterprise
Capability / Feature Essential Advanced Elite
Privileged Credential Vaulting (Secret Server) ✓ Included ✓ Included ✓ Included
Automated Password Rotation ✓ Included ✓ Included ✓ Included
Session Launch (RDP/SSH via launcher) ✓ Included ✓ Included ✓ Included
Session Recording & Playback — Not Included ✓ Included ✓ Included
Active Directory Discovery & Import — Not Included ✓ Included ✓ Included
Access Request & Approval Workflows — Not Included ✓ Included ✓ Included
Endpoint Privilege Management (PM Agent) — Not Included ✓ Included ✓ Included
SIEM Integration (Syslog / API forwarding) — Not Included Add-On ✓ Included
Compliance Reporting (SOC2 / HIPAA / PCI) — Not Included Add-On ✓ Included
DevOps Secrets Vault (DSV) — Not Included — Not Included ✓ Included
Dedicated Instance (Hard Tenant Isolation) — Not Included — Not Included ✓ Included
Monthly Executive Security Report — Not Included ✓ Included ✓ Included
Quarterly Business Review (QBR) — Not Included — Not Included ✓ Included
Suggested Price / User / Month $18 – $25 $35 – $55 $65 – $95+
Minimum Seat Count 10 users 20 users 50 users
Upsell Strategy

Lead clients on Essential for the first 3 months to establish baseline value (rotation events, secrets vaulted). Use the Month-3 QBR to present session recording ROI data and compliance risk scores — these drive 70%+ of Advanced upgrades organically.

Add-On Services (Billable Separately)

PAM Health Assessment

One-time 3-day engagement to audit a client's existing PAM posture, identify credential sprawl, and deliver a prioritized remediation roadmap. Suggested: $3,500 – $6,000

Compliance Evidence Package

Quarterly extraction and formatting of PAM audit evidence mapped to specific compliance frameworks. Suggested: $500 – $1,200/quarter

Emergency Secret Rotation

Rapid response credential rotation for breach events or suspected credential compromise. Suggested: $750 – $2,000/event

DevOps Pipeline Integration

Scoping and implementation of DSV integration into CI/CD pipelines. Suggested: $2,000 – $5,000/engagement

MOD 07

Client Reporting Template

A standardized monthly executive report structure for managed PAM service delivery

Consistent, branded client reports are a key retention tool for MSP PAM programs. They quantify your value, surface risk trends, and create natural upsell touchpoints. The template below reflects a monthly cadence report for clients on the Advanced or Elite tier.

Delivery Tip

Send the report on the 1st business day of the month covering the prior month. Include a 3-sentence executive summary at the top written in plain language — your primary audience is often a non-technical business owner, not the IT team.

PAM Monthly Security Report
Client: Acme Corp  ·  Tier: Advanced
REPORTING PERIOD
January 2025
247
Secrets Managed
1,842
Sessions Launched
98.7%
↑ 0.3%
Rotation Success Rate
3
Alerts Triggered
Secret Rotation Summary
ACCOUNT TYPE
TOTAL
ROTATED
STATUS
Domain Administrator Accounts
12
12
● ALL OK
Local Administrator Accounts
89
88
⚠ 1 FAILED
Service Accounts
34
34
● ALL OK
Network Device Credentials
56
56
● ALL OK
Cloud & SaaS Accounts
56
56
● ALL OK
Privileged Access Activity
METRIC
THIS MONTH
PREV MONTH
TREND
Unique Users Accessing Vault
41
38
↑ +7.9%
After-Hours Access Events
14
9
↑ +55.6%
Access Denied Events
7
11
↓ -36.4%
Avg Session Duration (min)
22.4
24.1
↓ Improved
Security Alerts & Exceptions
⚠ Rotation failure: SVC-SQLPROD01 (dependency mismatch)
Jan 12
Remediated
● CLOSED
After-hours domain admin access (user: j.smith@acme.com)
Jan 19
Reviewed
● APPROVED
5 unmanaged local admin accounts discovered via Discovery Scan
Jan 28
Pending
⚠ ACTION REQ
MSP Recommendations

1.  Onboard 5 unmanaged local admin accounts discovered Jan 28 to bring total under management. Estimated 1-hour effort. Recommend scheduling this week.

2.  After-hours access trending up 55%. Consider enabling Access Request workflows for domain admin accounts to require business justification. Available on your current tier.

3.  Upgrade to Elite tier recommended for session recording of all RDP sessions (currently recording only domain admin sessions) to meet your upcoming SOC 2 audit scope.

Template Customization

Generate the KPI data automatically using the Delinea REST API export + your PSA's reporting engine. Map Secret Count, Session Count, and Rotation Success/Failure directly from API response fields. After-hours analysis requires a post-processing step on the audit log timestamps against business hours defined per client timezone.

Automation · Monthly KPI Pull # Monthly report data collection — run on 1st of each month secrets_total = GET /api/v1/secrets?folderId={clientFolderId}&count=true sessions_month = GET /api/v1/sessions?startDate={firstDay}&endDate={lastDay}&folderId={id} rotation_events = GET /api/v1/secret-audit?action="AutoChange"&folderId={id} alerts = GET /api/v1/events?severity=["warn","critical"]&folderId={id} # Compile into report object, push to PSA or report PDF generator report = compile(secrets_total, sessions_month, rotation_events, alerts) deliver_to_client(report, format="pdf", recipient=client.primaryContact)