Hey folks, I've been diving deeper into Delinea's PAM setup for our team, and I keep circling back to the built-in ticketing system. We're currently using a separate, lightweight tool for access requests, but the idea of having it all integrated is super appealing.
I'm wondering if anyone here has actually put the native ticketing through its paces. In theory, it should streamline the whole request-approve-provision workflow, but I'm curious about the real-world experience.
Specifically, I'd love to know:
* How customizable is the request form? Can you easily add custom fields or logic (e.g., different fields for SSH key vs. database access)?
* What's the approval workflow like? Can you set up multi-stage approvals or dynamic approvers based on the request?
* Does it play nicely with notifications (Slack, Teams, email)?
* Any major limitations compared to a dedicated ticketing system?
We're heavy users of the secrets and session management parts, but I'm a bit skeptical about "jack-of-all-trades" features. I'd rather stick with our external tool if Delinea's version is just a basic checkbox feature.
Any hands-on experiences or comparisons would be super helpful before I try to sell my team on switching our process.
✌️
We've been using it for about a year to handle all our server access requests. It's definitely more than a basic checkbox, but you have to meet it on its terms.
On your first two points: the forms are customizable, but the logic is a bit rigid. You can add custom fields, but creating conditional logic like different fields for SSH versus database access will usually require some custom scripting via their API. Approval workflows are solid though; you can set up multi-stage approvals and assign approvers based on AD groups, which covers most dynamic needs.
It handles email notifications well and can post to a webhook, so Slack/Teams integration is doable. The main limitation is reporting - it's pretty bare bones compared to a dedicated system. If your current tool is simple and works, switching might only be worthwhile if the pain of context-switching between tools is high.
ship early, test often
Spot on about the approval workflows, they're surprisingly flexible. The AD group mapping saved us a ton of time setting up approvers for different server tiers.
You're right about the reporting being bare bones - we ended up piping the audit logs out to a Datadog dashboard for better visualization and retention. A bit of extra setup, but it gave us the insights we wanted.
The API scripting for conditional forms is the real gatekeeper. If your team's comfortable with that, you can make it sing. If not, that rigidity user1142 mentioned becomes a daily friction point.
Dashboards or it didn't happen.
That API scripting requirement is the classic vendor bait-and-switch. They advertise "customizable workflows" but what they actually sell is a dev project. If your team isn't already comfortable with their API, you're suddenly paying for extra dev hours or, more likely, living with a clunky process.
"Make it sing" is a bit generous. It's more like you can *eventually* get it to hum a recognizable tune after a week of fiddling with their documentation.
You mentioned Datadog for reporting - isn't that the real pattern here? The "integrated" solution ends up requiring a patchwork of external tools just to get basic functionality.
Trust but verify.