Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
case studies · privileged access

Privileged access, move by move.

Privileged accounts are where a breach turns expensive, so these moves get planned around one rule: no admin password sits in a script or a spreadsheet by the end. Vault migrations, PAM upgrades and secrets pulled out of pipelines.

5 case studies2 modernizations2 migrations1 upgrade8 platforms
See all 5 Plan a similar move
case-studies / privileged-access5 moves
  1. Centrify alternatives, and how we untangle Server Suite zonesmodernization · delivered
  2. CyberArk PAM Self-Hosted to Privilege Cloud (Idira PAM SaaS)migration · delivered
  3. CyberArk PAM Self-Hosted version upgradesupgrade · delivered
  4. Delinea Secret Server on-premises to the Delinea Platformmigration · delivered
  5. Secrets in code, pipelines and config files to HashiCorp Vaultmodernization · delivered
featured case study

Centrify alternatives, and how we untangle Server Suite zones

Told without the client's name or anything that could identify them.

what happened

A financial services firm's Unix and Windows engineering team had Centrify zones designed long before anyone on the team arrived. Child zones nobody could explain, UID and GID overrides that broke file ownership whenever a server moved, and dzdo roles that had grown one ticket at a time were all still in use. Cloud-built Linux hosts didn't fit the domain-joined model, and the Server Suite session audit fed SOX evidence. We exported zones, roles, dzdo rights and ID profiles, agreed one UID and GID per person and group, and chose a target per server group: Server Suite connected in place to the Delinea Platform, or native directory join with sudo rules as code. Servers moved in waves by application owner, with login, elevation, cron jobs and service accounts tested in a pilot first.

what the client got
  • One UID and GID per person and groupBefore a single server changed model, we mapped every conflicting override and fixed ownership on NFS shares and local disks. Now a move doesn't cost anyone access to their files or jobs.
  • Elevation rights are code that gets reviewedWe rewrote dzdo rights as platform elevation policies or sudo rules, kept in version control. Elevation needs MFA where the target supports it. Rights nobody used during the review period were dropped.
  • Each server group has a decided targetEach group's target is written down: connected Server Suite, native directory join or a later Platform Agent move. Where the plan relied on a preview feature, there's a fallback.
Read the full case study
after / centrify-zones-modernization delivered
beforeCentrify / Delinea Server Suite zones afterDelinea Platform server PAM or native directory join
01 · IDENTITY 02 · CONTROL 03 · SERVERS 04 · EVIDENCE Active Directory: rationalized UID · GID Active Directory rationalized UID · GID Entra ID: cloud-first hosts Entra ID cloud-first hosts Delinea Platform: elevation · session audit Delinea Platform elevation · sessionaudit Sudo rules as code: version control Sudo rules as code version control Connected Server Suite hosts: kept in place Connected ServerSuite hosts kept in place Natively joined hosts: Linux · Windows Natively joinedhosts Linux · Windows NFS shares: fixed ownership NFS shares fixed ownership Session recordings: SOX · PCI evidence Session recordings SOX · PCI evidence
01 · IDENTITY02 · CONTROL03 · SERVERS04 · EVIDENCE Active Directory: rationalized UID · GID ActiveDirectory rationalized UID ·GID Entra ID: cloud-first hosts Entra ID cloud-first hosts Delinea Platform: elevation · session audit DelineaPlatform elevation ·session audit Sudo rules as code: version control Sudo rules ascode version control Connected Server Suite hosts: kept in place ConnectedServer Suitehosts kept in place Natively joined hosts: Linux · Windows Nativelyjoined hosts Linux · Windows NFS shares: fixed ownership NFS shares fixed ownership Session recordings: SOX · PCI evidence Session recordings SOX · PCI evidence © Cohash · cohash.com
every case study

All 5 in privileged access

Read any of them and you get the story, the before-and-after architecture, the plan phase by phase and the results.

modernization Privileged access

Centrify alternatives, and how we untangle Server Suite zones

Untangling Centrify and Delinea Server Suite zones, UID maps and dzdo roles, and moving Linux and Windows servers to a server identity model you can run.

read the case study
migration Privileged access

CyberArk PAM Self-Hosted to Privilege Cloud (Idira PAM SaaS)

We move CyberArk PAM Self-Hosted vaults to Privilege Cloud, now sold as Idira Privileged Access Management. Rotation and sessions keep working.

read the case study
upgrade Privileged access

CyberArk PAM Self-Hosted version upgrades

Upgrading CyberArk PAM Self-Hosted from 13.x or 14.x to the 15.2 Long-Term Support release, in the documented component order with DR tested first.

read the case study
migration Privileged access

Delinea Secret Server on-premises to the Delinea Platform

Getting Secret Server off on-premises hosts and onto the Delinea Platform while templates, engines and integrations keep working.

read the case study
modernization Privileged access

Secrets in code, pipelines and config files to HashiCorp Vault

We track down passwords, API keys and tokens in repositories, CI variables and config files and move them into HashiCorp Vault, with short-lived credentials.

read the case study

Not sure which one fits?

Send us what you run and what's due. An engineer reads it and tells you where we'd start.

start an assessment →
what goes wrong

Risks that keep coming up

One risk from each of these moves, and the case study that shows how we handled it when it hit.

  1. File ownership breaks

    A changed UID means a user locked out of their own files and jobs that fail. We fix ID mapping first, before touching agents.

  2. Custom plugins that don't carry over

    Most of the cost sits in custom CPM plugins and PSM connection components. If the SaaS tenant doesn't support one, it needs a rebuild or a retirement decision before anyone sets a schedule.

  3. Skipping intermediate steps

    Some version jumps need intermediate releases or prerequisites. The path is taken from CyberArk's upgrade documentation for your exact build, not assumed.

  4. Moving a mess into the cloud

    Folder sprawl and dead secrets migrate just as easily as good ones. Cleanup before the export is cheaper than after.

  5. Moving without rotating

    Copying a secret into Vault doesn't help if the old value still works from Git history. We rotate every one we move.

what's involved

Platforms and services across these moves

Ordered by how often they appear in this area's case studies.

privileged access platforms
Privileged access Microsoft Entra IDOktaCyberArkDelineaSailPointServiceNowHashiCorp VaultTerraform
services

Services we used

01What happens to UIDs if we leave Centrify for SSSD?

They can change, and that's where file ownership breaks. By default SSSD generates UIDs and GIDs from each user's AD SID and ignores any uidNumber and gidNumber held in AD. If AD already holds the IDs you want, join with automatic ID mapping turned off, then check a test user with getent passwd before any wave starts.

02Is Privilege Cloud the same product as Idira PAM?

In practice, yes. Palo Alto Networks' migration page now calls the SaaS offering Idira Privileged Access Management, part of the Idira Identity Security Platform. Older CyberArk community articles still say Privilege Cloud. Look at the product name on your quote so the licenses and features line up.

03Should we upgrade or move to SaaS?

It depends on hosting rules, the number of custom plugins and connection components, and how much vault upkeep costs your team today. We compare both. If SaaS is likely within a year, a second self-hosted upgrade may not be worth it.

04Do you replace Delinea Professional Services?

No, Delinea runs its own migration packages. We handle the work around them, like cleanup, engine placement, integration testing and team readiness, or the whole program if you'd rather have one team.

05Do we need Vault Enterprise?

Only if you need namespaces, replication or Agentic IAM. Community Edition covers a lot of migrations, so we work out what you really need before anyone talks licences.

other areas

More case studies by area

The same approach, applied to other parts of the estate.

you are herePrivileged access case studies
fact-checked Checked against vendor and official documentation last checked 2026-10-20 content fingerprint 6fefae5a
  1. 01Book a 30-minute working sessionsenior engineer
  2. 02Talk to an engineer about your setupreply within 24 hours
  3. 03See how similar projects wentcase studies
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Facing one of these moves?

Tell us what you're on now and where you need to be. We'll come back with how we'd run the move.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it