I'm currently evaluating Delinea Secret Server for our team, and a common scenario has come up that I'm not entirely sure how to handle. We often need to bring in external contractors or consultants for short-term projects, and they require access to specific credentials—like a database login or an API key for a staging environment.
I understand the principle of least privilege, but I'm trying to figure out the practical workflow in Secret Server. My main questions are:
* **What's the best way to create an account for them?** Should I create a personal account for each contractor, or is there a "guest" or "external user" role type I should use?
* **How do I scope the access?** I assume I wouldn't just add them to an existing folder. Do I create a separate folder for the project, move the required secrets there, and grant access only to that folder? How does that work with inheritance?
* **What happens after the project?** Is there a clean, automated way to disable their access and audit what they did, without deleting the user account entirely (for audit trail purposes)?
I'm also curious how this compares to other platforms like 1Password Business or Azure Key Vault in terms of external sharing overhead. In some systems, it feels like you're creating a full user, which seems heavy for a 3-week engagement.
Any best practices or pitfalls you've encountered would be really helpful. I'm trying to map out the process before we commit to a rollout.