Delinea Secret Server on-premises to the Delinea Platform
Cohash moves on-premises Delinea Secret Server to Secret Server on the Delinea Platform. We clean up folders, templates and dead secrets first, place distributed engines where they can reach targets, run Delinea's staged export with your account team, and test heartbeat, rotation and every API integration before cut-over. Then we turn on platform features such as runtime authorization only where they're licensed and tested.
- 01Inventory and cleanup
- 02Engines and network
- 03Staged export and migration
- 04Integration and launcher testing
- 05Validation and cut-over
The story
Told without the client's name or anything that could identify them.
A healthcare group's infrastructure team ran Secret Server on-premises on a version past Delinea's one-year support window, hosted on SQL Server and IIS servers that needed upgrades of their own. Heartbeat failed on enough secrets that nobody trusted rotation, and linking the instance to the Delinea Platform had added only Remote Access. We cleaned up folders, templates and dead secrets first, placed distributed engines per network segment and worked through Delinea's staged export with its Professional Services team, starting with a pilot folder. Every API caller, launcher and sign-in path was retested before the on-premises instance went read-only and was scheduled for shutdown.
why it was urgentEach on-premises Secret Server release gets one year of support, so staying on-premises means an upgrade every year. Linking an on-premises instance to the Delinea Platform changes less than you'd hope. You get Remote Access, and the platform does no lifecycle management for it. Delinea now runs a five-phase migration program for on-premises customers.
- openYour Secret Server version is past Delinea's one-year support window.
- recurringHeartbeat fails on a large share of secrets and nobody trusts rotation.
- blockedThe link to the Delinea Platform got you Remote Access and nothing else you wanted.
- openBesides Secret Server itself, its SQL Server and IIS hosts are due for their own upgrades.
The estate, before and after
Before: Secret Server on-premises with failing heartbeat
Admins and scripts used an on-premises Secret Server that needed an upgrade every year and ran on its own SQL Server and IIS hosts. Heartbeat and rotation weren't reliable, and the platform link added only Remote Access.
Read the diagram as text
- Admins and users → Secret Server on-premises: launch sessions
- Scripts and apps → Secret Server on-premises: API, local account
- Secret Server on-premises → SQL Server and IIS hosts: runs on
- Secret Server on-premises → Delinea Platform link: Remote Access
- Secret Server on-premises → Windows and Linux servers: heartbeat often fails
- Secret Server on-premises → Databases and network devices: rotation
After: Secret Server on the Delinea Platform
Admins come in through the identity provider, scripts through platform identities. Heartbeat and rotation run from distributed engines in each network segment, reaching every target from there.
Read the diagram as text
- Admins and users → Okta or Entra ID: sign in
- Okta or Entra ID → Secret Server on Delinea Platform: SSO
- Scripts and apps → Secret Server on Delinea Platform: API, platform identity
- Secret Server on Delinea Platform → Distributed engines: heartbeat and rotation
- Distributed engines → Windows and Linux servers: heartbeat · rotation
- Distributed engines → Databases and network devices: pre-validated rotation
How we run it, phase by phase.
5 phases take you from Secret Server on-premises to Secret Server on the Delinea Platform. Each one ends with something you can check before the next starts. As you scroll, the blocks show the estate moving across.
- phase 01
Inventory and cleanup
Run the system inventory report Delinea uses for sizing. Deactivate secrets for retired hosts, fix broken templates and agree a folder and permission model before anything moves.
- phase 02
Engines and network
Place distributed engines per network segment and get firewall approvals so every target is reachable for heartbeat and rotation from the platform.
- phase 03
Staged export and migration
Go through the staged export with Delinea Professional Services, mapping secrets, templates, folders, launchers and permissions. A pilot folder goes first.
- phase 04
Integration and launcher testing
Retest every system that calls the Secret Server API, plus RDP and SSH launchers and session recording. Scripts that hold a local Secret Server account are moved to platform identities.
- phase 05
Validation and cut-over
Run user acceptance by team, compare heartbeat results old against new, then make the on-premises instance read-only and schedule its shutdown.
What the client got
What changed for the client once the work was done. Described, not scored: we don't publish client figures.
- result 01
No more yearly on-premises upgrades
Secret Server now runs on the Delinea Platform, and the old on-premises instance with its SQL Server and IIS hosts is read-only and due to be shut down.
- result 02
Heartbeat and rotation reach every target
Distributed engines sit in each network segment with approved firewall rules. Before cut-over we compared heartbeat results old against new.
- result 03
Only live secrets moved
We deactivated secrets for retired hosts, fixed broken templates and agreed a folder and permission model, then started the staged export.
- result 04
Every API caller is known and re-pointed
We found the callers in web server and API logs and re-pointed and tested each one. Scripts that had local Secret Server accounts now use platform identities.
- result 05
Rotation checks dependencies first
We enabled and tested Remote Password Pre-Validation per secret type. A secret with dependencies no longer gets changed in some places and left in others.
Risks we plan for
-
Moving a mess into the cloud
Folder sprawl and dead secrets migrate just as easily as good ones. Cleanup before the export is cheaper than after.
-
Partial rotation
Secrets with dependencies can get changed in some places and not in others. We enable Remote Password Pre-Validation, GA in the Winter 2026 release, and test it for each secret type.
-
API consumers that break quietly
Scripts still call the old on-premises URL and fail in the middle of the night. We mine web server and API logs for callers before cut-over.
-
Identity source surprises
On the platform, local Secret Server accounts and directory connections behave differently. Test how admins, users and service accounts sign in before go-live.
Where AI helps, and where it needs guardrails
Delinea completed its StrongDM acquisition in March 2026 and in July made runtime authorization for AI agents available on the platform, checking each agent action before it runs and injecting credentials just in time. We pilot it on one agent and one database first. Agents should never read secrets out of Secret Server into their own context. They get task-scoped credentials, and anything that writes to production escalates to a person.
forward deployed engineers →What you're left with
We write these for your setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
- inventory01
Inventory report with cleanup decisions per folder and template
yours to keep - document02
Distributed engine placement and firewall request list
yours to keep - inventory03
Migration mapping for secrets, templates, launchers and permissions
yours to keep - tests04
API consumer list with a re-pointing test for each
yours to keep - report05
Heartbeat comparison report, on-premises against platform
yours to keep
Platforms and services on this move
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
01Can we keep some secrets on-premises?
Ask Delinea about Resilient Secrets. Its migration program lists it as an add-on if you hold the entitlement. Where a regulator requires secrets to stay inside your network, we design around that first.
02How long does the move take?
Delinea says it depends on environment size and complexity. In our planning the number of secrets matters less than the API integrations, launchers and network segments.
03Do you replace Delinea Professional Services?
No, Delinea runs its own migration packages. We handle the work around them, like cleanup, engine placement, integration testing and team readiness, or the whole program if you'd rather have one team.
Often on the same roadmap
On-premises Active Directory to cloud-first Microsoft Entra ID
We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.
read the case studyAD FS federation to Entra ID authentication
Converting federated domains from AD FS to Entra ID cloud authentication, moving relying parties app by app and retiring the AD FS farm.
read the case studyAuth0 Rules and Hooks to Actions before end of life
Rewriting Auth0 Rules and Hooks as Actions before their 18 November 2026 end of life, with token claims compared before and after each change.
read the case study7ca0b829 - 01Delinea: Secret Server On-Premise Migration Programdelinea.com ↗
- 02Delinea docs: Connecting Secret Server to the Delinea Platform (on-premises limited to Remote Access)docs.delinea.com ↗
- 03Delinea docs: Secret Server supported for one year after releasedocs.delinea.com ↗
- 04Delinea docs: Winter (Q1) 2026 release notesdocs.delinea.com ↗
- 05Delinea: StrongDM acquisition completed (5 Mar 2026)delinea.com ↗
- 06iTWire: Delinea runtime authorisation for AI agents (30 Jul 2026)itwire.com ↗
Planning this move?
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it