Privileged access, move by move.
Privileged accounts are where a breach turns expensive, so these moves get planned around one rule: no admin password sits in a script or a spreadsheet by the end. Vault migrations, PAM upgrades and secrets pulled out of pipelines.
- Centrify and Delinea Server Suite zones to modern server identitymodernization · delivered
- CyberArk PAM Self-Hosted to Privilege Cloud (Idira PAM SaaS)migration · delivered
- CyberArk PAM Self-Hosted version upgradesupgrade · delivered
- Delinea Secret Server on-premises to the Delinea Platformmigration · delivered
- Secrets in code, pipelines and config files to HashiCorp Vaultmodernization · delivered
Centrify and Delinea Server Suite zones to modern server identity
Told without the client's name or anything that could identify them.
A financial services firm's Unix and Windows engineering team had Centrify zones designed long before anyone on the team arrived. Child zones nobody could explain, UID and GID overrides that broke file ownership whenever a server moved, and dzdo roles that had grown one ticket at a time were all still in use. Cloud-built Linux hosts didn't fit the domain-joined model, and the Server Suite session audit fed SOX evidence. We exported zones, roles, dzdo rights and ID profiles, agreed one UID and GID per person and group, and chose a target per server group: Server Suite connected in place to the Delinea Platform, or native directory join with sudo rules as code. Servers moved in waves by application owner, with login, elevation, cron jobs and service accounts tested in a pilot first.
what the client got- One UID and GID per person and groupBefore a single server changed model, we mapped every conflicting override and fixed ownership on NFS shares and local disks. Now a move doesn't cost anyone access to their files or jobs.
- Elevation rights are code that gets reviewedWe rewrote dzdo rights as platform elevation policies or sudo rules, kept in version control. Elevation needs MFA where the target supports it. Rights nobody used during the review period were dropped.
- Each server group has a decided targetEvery group is recorded as connected Server Suite, native directory join or a later Platform Agent move, with a fallback where the plan relied on a preview feature.
All 5 in privileged access
Read any of them and you get the story, the before-and-after architecture, the plan phase by phase and the results.
Centrify and Delinea Server Suite zones to modern server identity
Untangling Centrify and Delinea Server Suite zones, UID maps and dzdo roles, and moving Linux and Windows servers to a server identity model you can run.
read the case studyCyberArk PAM Self-Hosted to Privilege Cloud (Idira PAM SaaS)
We move CyberArk PAM Self-Hosted vaults to Privilege Cloud, now sold as Idira Privileged Access Management. Rotation and sessions keep working.
read the case studyCyberArk PAM Self-Hosted version upgrades
Upgrading CyberArk PAM Self-Hosted from 13.x or 14.x to the 15.2 Long-Term Support release, in the documented component order with DR tested first.
read the case studyDelinea Secret Server on-premises to the Delinea Platform
Getting Secret Server off on-premises hosts and onto the Delinea Platform while templates, engines and integrations keep working.
read the case studySecrets in code, pipelines and config files to HashiCorp Vault
We track down passwords, API keys and tokens in repositories, CI variables and config files and move them into HashiCorp Vault, with short-lived credentials.
read the case studyNot sure which one fits?
Send us what you run and what's due. An engineer reads it and tells you where we'd start.
start an assessment →Risks that keep coming up
One risk from each of these moves, and the case study that shows how we handled it when it hit.
-
File ownership breaks ↗
A changed UID means a user locked out of their own files and jobs that fail. We fix ID mapping first, before touching agents.
-
Custom plugins that don't carry over ↗
Most of the cost sits in custom CPM plugins and PSM connection components. If the SaaS tenant doesn't support one, it needs a rebuild or a retirement decision before anyone sets a schedule.
-
Skipping intermediate steps ↗
Some version jumps need intermediate releases or prerequisites. The path is taken from CyberArk's upgrade documentation for your exact build, not assumed.
-
Moving a mess into the cloud ↗
Folder sprawl and dead secrets migrate just as easily as good ones. Cleanup before the export is cheaper than after.
-
Moving without rotating ↗
Copying a secret into Vault doesn't help if the old value still works from Git history. We rotate every one we move.
Platforms and services across these moves
Ordered by how often they appear in this area's case studies.
01Can we drop Active Directory for Linux login?
On some hosts. The Platform Agent from Delinea skips the domain join, but it's still private preview. Native options put Linux directly into Active Directory instead. It comes down to where the servers run and what evidence your auditors expect.
02Is Privilege Cloud the same product as Idira PAM?
In practice, yes. Palo Alto Networks' migration page now calls the SaaS offering Idira Privileged Access Management, part of the Idira Identity Security Platform. Older CyberArk community articles still say Privilege Cloud. Look at the product name on your quote so the licenses and features line up.
03Should we upgrade or move to SaaS?
It depends on hosting rules, the number of custom plugins and connection components, and how much vault upkeep costs your team today. We compare both. If SaaS is likely within a year, a second self-hosted upgrade may not be worth it.
04Do you replace Delinea Professional Services?
No, Delinea runs its own migration packages. We handle the work around them, like cleanup, engine placement, integration testing and team readiness, or the whole program if you'd rather have one team.
05Do we need Vault Enterprise?
Only if you need namespaces, replication or Agentic IAM. Community Edition covers a lot of migrations, so we work out what you really need before anyone talks licences.
More case studies by area
The same approach, applied to other parts of the estate.
6fefae5a - 01Delinea blog: Why Server Suite customers are moving to the Delinea Platform (Aug 2026)delinea.com ↗
- 02Delinea docs: Privilege Control for Servers with Platform Agent (private preview)docs.delinea.com ↗
- 03Palo Alto Networks: Completes acquisition of CyberArk (11 Feb 2026)paloaltonetworks.com ↗
- 04Palo Alto Networks press release: Introducing Idira (12 May 2026)paloaltonetworks.com ↗
- 05Palo Alto Networks: Idira PAM SaaS migration (four phases)paloaltonetworks.com ↗
- 06Idira Docs: End-of-life policy for self-hosted productsdocs.cyberark.com ↗
- 07CyberArk Community: Preparing for your Privilege Cloud migration Jump Startcommunity.cyberark.com ↗
- 0851sec (secondary): CyberArk PAM Self-Hosted v15 resources and release noticeblog.51sec.org ↗
Facing one of these moves?
Tell us what you're on now and where you need to be. We'll come back with how we'd run the move.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it