PAM Foundation
For engineers new to Idira (formerly CyberArk) who need to operate a deployment confidently.
PAM Foundation
Covers the core PAM components from first principles, with a working environment from day one. Ends with structured preparation for the Defender certification.
What you will be able to do
- Explain the Idira PAM architecture and how Vault, CPM, PVWA, PSM and PSMP fit together
- Build safes, platforms and policies that match an organisation's ownership model
- Onboard Windows, Unix and database accounts and get rotation working
- Broker and review recorded sessions through PSM and PSMP
- Operate the platform day to day: health, backups, users, troubleshooting
How the programme runs
Each day pairs concepts with hands-on work. Sessions run two to eight hours a day, scheduled in your time zone.
| Day | Focus | Topics |
|---|---|---|
| Day 1 | Platform architecture | Components, data flow, editions, Self-Hosted vs Privilege Cloud, security model |
| Day 2 | Vault & PVWA | Vault concepts, safes, users, groups, directory mapping, PVWA navigation and roles |
| Day 3 | Platforms & policies | Platform types, policy inheritance, exceptions, master policy, account properties |
| Day 4 | Windows & AD onboarding | Domain, local and service accounts; reconcile accounts; verifying and changing |
| Day 5 | Unix & database onboarding | SSH keys, sudo, root reconciliation, Oracle and SQL platforms |
| Day 6 | CPM operations | Rotation schedules, failures and reasons, plugin basics, troubleshooting logs |
| Day 7 | PSM sessions | Connection components, RDP and SSH isolation, recordings, live monitoring |
| Day 8 | PSMP & HTML5 | Native SSH proxy, key-based access, HTML5 Gateway, clientless access |
| Day 9 | Operations & backup | Health checks, PAReplicate, DR concepts, certificate and licence lifecycle |
| Day 10 | Practical & review | Blank-vault build, onboarding challenge, Defender preparation |
What the programme covers
Storage model, safe design, permissions and the security layers that make the vault what it is.
Discovery, bulk upload, onboarding rules and the practical failures that stall onboarding waves.
Platform configuration, rotation policy, reconciliation accounts and diagnosing failed rotations.
Session isolation, recording, connection components and universal connectors.
Access control, request and approval workflows, reporting and hardening.
Structured revision against the exam objectives, with practice scenarios.
Who, what you need, and how it is assessed
Who should attend
- Engineers new to Idira PAM
- Administrators inheriting a deployment
- Support staff who will handle PAM tickets
- Security analysts reviewing privileged sessions
Prerequisites
- Comfortable with Windows Server and Active Directory
- Basic Linux command line
- Familiarity with networking (ports, TLS, load balancers)
- No prior PAM experience required
Lab environment
- Dedicated environment per learner: Vault, PVWA, CPM, PSM, PSMP
- Windows, Linux and database targets to onboard
- Broken-state exercises from day 6 onward
- Live for the programme and two weeks after
Assessment & certification
- Daily hands-on checkpoints
- End-of-programme practical: build and onboard from a blank vault
- Defender exam preparation and question drills
Delivery formats
- Live instructor-led, remote or on-site
- 2 to 8 hours per day, scheduled in your time zone
- Open cohort per seat or private batch
Commercial
- Per seat or per corporate batch
- 10 days
- Syllabus and quote on request
Labs, not slides
Most Idira training teaches the interface. This teaches the model underneath it, because engineers who understand why the vault behaves as it does can troubleshoot problems the courseware never covered.
The lab
Every participant is provisioned an isolated environment containing a vault, a CPM, a PVWA, a PSM and a set of target systems. It stays live for the duration of the programme and two weeks afterwards. Break it deliberately — the failures are where the learning happens.
Ready to build the team you need?
Corporate batches are scoped to your deployment and scheduled in your time zone. Open cohorts run for individual engineers.
These principles guide every engagement
They define how we design, deliver and operate identity security for our customers.
Certified, not just familiar
Guardian-led, with CDE credentials across PAM, Privilege Cloud, EPM and Secrets Manager, kept current on every release.
Architect-led delivery
Design is reviewed and signed off before anything is built, so what goes live is what was agreed.
Written scope, fixed price
Deliverables, timeline and price in writing before work starts. No open-ended retainers.
Enablement built in
Your team is trained during delivery, so what we build does not depend on us to keep running.
Sound familiar?
The situations that start most of our engagements — in the words we hear them.
Need identity security you can trust?
Talk to a certified architect about protecting privileged access, identities and critical systems. The first call is technical, not a sales pitch.