Managed Accounts
A managed account is a privileged Active Directory or Entra ID account whose password GrantFlow rotates and hands out through checkout. GrantFlow enables the account in the directory when a checkout starts and disables it again at check-in. Users can check out only the accounts you have linked to them.
You work with managed accounts under Account Management, which has four pages:
- Account Policies: the password and checkout rules described in Account Policies.
- Accounts: the accounts GrantFlow manages, with their policy and rotation history.
- Linked Accounts: which users may check out which accounts.
- Link Map: an overview of all links, grouped by account or by user.
Adding an account
On the Accounts page, select Create Account. Search the directory by name, UPN, or sAMAccountName, and select Make Account next to the user you want to manage. Users that already have a managed account do not appear in the results.
A new account has no policy. Assign one right away, because GrantFlow neither rotates nor checks the password of an account without a policy.
Account cards
The page header counts the accounts in total, enabled, disabled, with a policy, and without one. You can search accounts by name or system and filter them by connector or policy.
Each card shows the account name, its connector, and an Enabled or Disabled badge. It also shows the UPN, the account ID, Password Last Rotated, and the assigned policy with its checkout cap. Password Last Rotated shows Never until GrantFlow rotates the password for the first time. A card with a red border and a Deleted in directory badge belongs to an account whose directory object no longer exists. Remove such accounts, because GrantFlow can neither rotate nor check them out.
INFO
An account can show Disabled after a checkout was refused because its password had expired. The badge does not block later checkouts. Account Policies explains the expiry behavior.
Assigning a policy
Select Assign Policy on a card, or select the card itself. Pick a policy under Select Policy. The dialog shows the policy's request cap and description. Select Save Assignment to apply it. To remove the policy from the account, choose No policy. Manage Policies opens the Account Policies page.
GrantFlow treats a password it has never rotated as expired. After you assign a policy with Auto Rollover to a new account, the next scheduled pass rotates the password in the policy's window. If the policy refuses checkout on expiry and a user checks the account out first, GrantFlow rotates the password at checkout instead.
Rotating a password
Select Rotate Password on a card and confirm to rotate the password now, regardless of the policy's window. GrantFlow records the rotation with the reason Manual. A manual rotation is refused while the account is checked out, while another rotation of it is running, when the account has no policy, and when its directory object is deleted.
Select Rotation History to see the last rotations of the account in the Password Rotation History dialog. Each entry shows the date, the reason, who rotated the password, and the status. The status is one of Scheduled, In Progress, Success, Failed, Rolled Back, or Cancelled. You can Cancel a rotation that is still scheduled. Account Policies explains each rotation reason.
Linking accounts to users
A user can check out an account only when it is linked to them. On the Linked Accounts page, search for the user by name, email, or username, and select the user. The dialog lists Available Accounts on one side and Linked Accounts on the other. Select Link to link an account to the user, or Unlink to remove a link. Every link and unlink is recorded in the audit log as account_link.create or account_link.delete.
The Link Map page shows every link, grouped either by account or by user. Use it to review who may check out a sensitive account, and to remove one or several links at once.
Deleting an account
Select Delete Account on a card and confirm. Deleting an account also removes its user links, checkout history, and role assignments. Activation history and the audit trail are kept.
GrantFlow refuses the delete while work in progress still references the account, such as an active checkout, a pending request, a live grant, or a scheduled rotation. The page then lists what blocks the delete, so you can resolve it first.