Account Checkout
The Account Checkout page lets you temporarily check out privileged or scope fitted accounts with time‑limited access to credentials. This enables secure management of scope fitted administrative accounts.
Overview
Account Checkout lists the privileged accounts you’re allowed to use. These are typically scope fitted admin identities or service accounts that require strict handling. When you check out an account, the system reveals credentials for a limited time and records the entire action in the audit trail.
Account Cards
Each card summarizes the account name, its availability, the managing connector (for example, “SLB AD” or “SLB Entra”), and when the password was last rotated. Credentials are never visible until you complete a checkout—before that, you’ll see a clear prompt indicating that a checkout is required to reveal the password.
Account types
Depending on your environment, accounts may come from Active Directory, Entra ID, or other connectors such as GitHub or Atlassian.
For Entra ID accounts, the card also displays the User Principal Name (UPN) so you can identify the exact sign-in identity.
Checking out an account
To check out an account, select Request on the card to open the checkout dialog. Choose how long you need access and provide a concise justification. Checkouts need no approval. When you submit, GrantFlow starts the checkout right away and records it in the audit log. The duration cannot exceed the cap set by the account's policy.
After checkout
The checkout first shows as pending while GrantFlow enables the account in the directory. Once it is active, you can reveal and copy the password, unless the account's policy only allows automatic sign-in to browser sessions. While you hold the account, nobody else can check it out.
Password Manager Export
After revealing a password, you can export it directly to your password manager. Click the Export button in the credential display to copy the credentials in a format compatible with common password managers. This avoids manual copying and reduces the risk of clipboard exposure.
INFO
Export formats credentials as a one-time-use package. The exported data is not stored by GrantFlow and should be imported into your password manager immediately.
Linked accounts
The page lists only the accounts that an administrator has linked to you, and you can check out only those. If you need an account that isn't listed, ask your administrator to link it to you. When an account no longer exists in its directory, its card shows a warning and checkout is unavailable until an administrator removes the link. Administrators manage links as described in Managed Accounts.
Password rotation
Automatic rotation
Your administrator assigns each account a password policy, and the policy decides when GrantFlow rotates the password. Account Policies describes every policy setting. Scheduled rotations run only inside the policy's rotation window, for example 21:00 to 04:00 on weekdays. The window is read in the time zone the policy names, so an overnight window in Europe/Vienna opens at 21:00 Vienna time, also across daylight saving changes. A policy without a time zone uses UTC.
GrantFlow rotates ahead of the window: if a password would expire before the window next opens, it is rotated in the current window instead. This keeps a password from expiring in the gap between two windows, even after an off-schedule rotation such as one that follows a session.
A policy can also rotate the password when you check the account in after GrantFlow injected the password into a remote session. GrantFlow also rotates a password after an administrator resolves a failed check-in for an account that was disabled in the directory by hand.
Expired passwords
Some policies refuse checkout once the password is older than the policy's maximum age, and a password GrantFlow has never rotated counts as expired. Such an expired password no longer blocks you. When you check out the account, GrantFlow rotates the password first, outside the policy's window, and then completes your checkout with the new password. You need no administrator for this, and any user linked to the account can start it. If another rotation of the account is already running, your checkout waits for that one instead of starting a second.
The rotation makes the checkout take longer. The dialog keeps its buttons disabled and tells you that the rotation can take up to a minute and a half. Every such rotation is recorded in the audit trail and attributed to you.
Manual rotation
Administrators can also trigger manual rotations from the Admin section, via API, or during security events.
Best practices
When to use account checkout
Use checkout for scope fitted administrative identities, service accounts that occasionally require human action, emergency access scenarios, or when compliance demands segregation of duties.
Duration guidelines
Request only the time you truly need—many teams keep these windows short (often one to four hours), and the account's policy may cap the duration.
Security considerations
Never paste credentials into tickets or chat tools. If you must store them temporarily, use an approved password manager and only for as long as necessary. Rotate immediately if you suspect exposure, check in the account when you’re finished (or allow it to expire), and document what you did and why in the justification. Never share checked‑out credentials.
Account status
Each card shows the state of your own checkout of the account:
- Available: you have no open checkout of the account, and you can request one.
- Pending: GrantFlow is enabling the account in the directory. You can cancel the checkout, but you cannot reveal the password yet.
- Active: the checkout is open, and you can use the account until the checkout ends.
- Overdue: the checkout has passed its end time, but the account has not been checked in yet.
- Checking in…: GrantFlow is disabling the account in the directory.
- Failed: the account could not be enabled for your checkout, so you never received access. The card explains why, and you can retry or dismiss it.
- Check-in failed: GrantFlow could not disable the account after your checkout, so it may still be enabled. You can retry the check-in, but you cannot dismiss the card. An administrator can also resolve it.
A card marked Deleted belongs to an account that no longer exists in its directory, and you cannot check it out. Cards show only your own checkouts. When someone else holds the account, it still shows as Available to you, but your checkout is refused with "account already checked out".
Live updates
The page updates automatically so availability, your active checkouts, and rotation status changes stay in sync without manual refresh.
Page actions
Refresh
Use Refresh to manually reload the account list if you suspect your view is out of date.
Troubleshooting
Account not available
If an account appears unavailable, it may already be checked out by someone else, undergoing a password rotation, or subject to a temporary administrative restriction. Check the Activity Log for recent changes.
Checkout refused because of the password
If the checkout answers "The account's password is being rotated. Try again in a moment.", the rotation of an expired password is still running. Wait a moment and check out again.
If it answers "account disabled due to expired password, or unassigned password policy", GrantFlow could not rotate the password for you. For example, the account's connector may be disabled, or the directory may have rejected the new password. Contact your administrator.
Cannot see expected accounts
If you don’t see an expected account, you may not have permission or the account may be assigned to a different group. Contact your administrator to verify your assignments.
Password not revealed after checkout
If the password doesn't appear right away, the checkout is probably still pending while GrantFlow enables the account in the directory. Wait a moment and refresh the page. If the checkout fails, the card shows the failure.
Integration with My Roles
Checked‑out accounts can be used with role activations. First check out the account, then request a role from My Roles and choose the checked‑out identity in the Acting as field. The activation will apply to that account instead of your personal user, enabling secure elevation for scope fitted identities.
FAQ
Can I share a checked‑out password with a teammate? No. If someone else needs access, they must perform their own checkout per policy.
What happens if I forget to check in? The checkout ends automatically at the set time. If GrantFlow injected the password into a session during the checkout, the account's policy may rotate the password when the checkout ends.
Can I extend a checkout? No. A checkout cannot be extended, and you cannot start a second checkout of an account while you still hold it. If you need more time, request a new checkout once the current one has been checked in.