Delinea Secret Server, plus the runtime controls StrongDM brought.
We implement and upgrade Delinea Secret Server, connect it to the Delinea Platform, and set up the runtime authorization that came with Delinea's StrongDM acquisition, for admins and AI agents alike.
Runtime authorization on the Delinea Platform, 30 Jul 2026
Winter (Q1) 2026 release
Remote Password Pre-Validation GA for Secret Server
release watch
StrongDM acquisition completed05 Mar 2026
Runtime authorization for AI agents30 Jul 2026
connects with
in short·15-second read
We implement Delinea privileged access: Secret Server, Privilege Manager and the Delinea Platform.
Secrets get onboarded, rotation and session recording are configured, and standing admin rights are removed. Since Delinea completed its StrongDM acquisition in March 2026, we also set up runtime authorization, which checks AI agent actions inside a session before they run and injects credentials just in time.
you probably need this if
Secret Server folders grew one team at a time and now the permissions differ in every branch.
A rotation failed halfway and left a service running with the old credential.
Your AI agents are hitting production databases with long-lived credentials sitting in config files.
terms on this pageService accountdefinitionA non-human account that software signs in with. Shared ones tend to pick up years of extra permissions.explained in a field note →
05 Mar 2026StrongDM acquisition completed Adds just-in-time runtime authorization to the Delinea Platform, aimed at human and non-human identities including AI agents. source ↗
30 Jul 2026Runtime authorization for AI agents On the Delinea Platform now. A policy per tool call can allow, block or escalate an action to a human. Audit records are kept at action level. source ↗
today · Oct 22, 2026
no date yetWinter (Q1) 2026 releaseTwo pieces went GA. Remote Password Pre-Validation in Secret Server, and Non-Human Identity support for Microsoft Entra.source ↗
the story · delinea estate
From the first call to a setup your own team can run.
Here's what usually prompts a call about your Delinea estate, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · delinea estate3 open
openSecret Server folders grew one team at a time and now the permissions differ in every branch.
recurringA rotation failed halfway and left a service running with the old credential.
blockedYour AI agents are hitting production databases with long-lived credentials sitting in config files.
exposure
Secret Server implementation and…Delinea Platform adoptionSession recording and remote…Privilege ManagerRuntime authorization for AI…Service account governance
startrehearsehandover
Secret Server review
Folder and policy redesign
Platform connection
Runtime authorization pilot
Rollout and handover
we are here
ready to hand over
When heartbeat fails now, it's worth looking at.
The agents no longer hold the Postgres password or the SSH key.
Secret template and folder design with permission inheritance rules
Distributed engine placement plan for each network site
chapter 01 · where it hurts
Why teams reach out
Secret Server folders grew one team at a time and now the permissions differ in every branch.
A rotation failed halfway and left a service running with the old credential.
Your AI agents are hitting production databases with long-lived credentials sitting in config files.
chapter 02 · what we change
How we solve it
Secret Server implementation and upgrades
Delinea Platform adoption
Session recording and remote access
Privilege Manager
Runtime authorization for AI agents
Service account governance
chapter 03 · how it runs
Our approach
Secret Server review
Folder and policy redesign
Platform connection
Runtime authorization pilot
Rollout and handover
chapter 04 · where you end up
What changes
When heartbeat fails now, it's worth looking at.
The agents no longer hold the Postgres password or the SSH key.
Secret template and folder design with permission inheritance rules
Distributed engine placement plan for each network site
what we do
Our Delinea work
6 kinds of Delinea work, each run by engineers who have done it on live tenants.
Folders, secret templates, rotation and heartbeat configured, with distributed engines placed where they can reach the target systems.
Secret Server instances connected to the Delinea Platform, with identity providers and access policies consolidated in one place.
Proxied RDP and SSH sessions recorded, with launchers configured for the tools your admins actually use.
Local admin rights removed from workstations, with elevation policies built from observed usage.
Agent connections to databases, SSH hosts, Kubernetes clusters and cloud consoles authorized per action, with credentials injected for the task and revoked when it ends.
Service accounts discovered, owners assigned, and rotation turned on in stages so nothing breaks overnight.
capability 01 / 06in production
Secret Server implementation and upgrades
Folders, secret templates, rotation and heartbeat configured, with distributed engines placed where they can reach the target systems.
Agent connections to databases, SSH hosts, Kubernetes clusters and cloud consoles authorized per action, with credentials injected for the task and revoked when it ends.
We pieced these together from Delinea situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
Heartbeat failing on a third of secrets, so nobody trusts rotation
composite · not a client story
Beforethe situation
One distributed engine site serves three data centers for a Secret Server that's just been connected to the Delinea Platform. About a third of secrets fail heartbeat. Admins still keep password copies in a shared spreadsheet.
What we dothe work
We sort heartbeat failures by cause, such as blocked firewall paths, wrong templates and retired hosts. Engines go into each site, and dead secrets are deactivated. Then Remote Password Pre-Validation is switched on, so rotation stops before it changes a password in some places but not others.
Afterwhere you end up
When heartbeat fails now, it's worth looking at. Nobody babysits rotation any more, and the shared spreadsheet has a date on which it gets deleted.
case file 02
Coding agents holding a standing database admin password
composite · not a client story
Beforethe situation
An engineering group gave its AI coding agents a read-write Postgres account and a shared SSH key so they could run migrations and debug staging. Those credentials never rotate, and nobody can say which agent ran which command.
What we dothe work
We route agent connections through Delinea's runtime authorization and inject short-lived credentials per task. Policies per action allow, block or escalate each request to a person, and anything writing to production gets escalated. Session records go to the SIEM.
Afterwhere you end up
The agents no longer hold the Postgres password or the SSH key. A migration against production waits for a person to approve it, and the SIEM shows which agent ran each command for which task.
We don't start a step until the last one has produced something you can check.
step 01
Secret Server review
We go through folder structure, permissions, secret templates, rotation and heartbeat failures, and where the distributed engines sit. Then we put the fixes in order.
step 02
Folder and policy redesign
We agree a folder and role model with your teams and move secrets into it. Heartbeat has to run clean before rotation is turned on, template by template.
step 03
Platform connection
We connect Secret Server to the Delinea Platform and consolidate identity providers, so access policies are set in one place.
step 04
Runtime authorization pilot
We pilot with one agent or admin group and one target, a database or a Kubernetes cluster, through runtime authorization. Then we check per-action policy, the just-in-time credentials and what ends up in the audit records.
step 05
Rollout and handover
We add the rest of the systems in waves and roll out Privilege Manager policies group by group, then leave the runbooks with your team.
ai on delinea
Where AI fits on Delinea, and where it needs guardrails.
Delinea bought StrongDM in March 2026 and in July shipped runtime authorization for AI agents on the Delinea Platform. Each tool call can be allowed, blocked or escalated to a human, with action-level audit records. For engineering teams this replaces long-lived database and SSH credentials held by agents with per-action checks.
AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
Delineadoes the work
Delinea's product docs don't list an MCP server. An MIT-licensed server for the Secret Server and Platform APIs is published under the DelineaXPM GitHub organization and keeps secret values out of model context. Put it behind your identity provider with TLS, scoped accounts and approval for writes.
Runtime authorization for AI agents
Each agent tool call against a database, SSH host, Kubernetes cluster or cloud console goes through policy. We start small (one agent group, one target), write allow, block and escalate rules, and widen coverage after the audit records look right.
Non-Human Identity support for Microsoft Entra
The Winter 2026 release made Entra non-human identity support GA. So we can bring service principals and agent identities from Entra into Delinea, and their secrets get owners and rotation.
Secrets out of agent configuration
Agents often carry passwords in their config files. We move those into Secret Server and give the agents short-lived access. Leak a config and there's nothing reusable in it.
How Delinea brokers access for admins and AI agents
Recorded sessions are launched by admins from Secret Server, while distributed engines in each network rotate and heartbeat the credentials. For AI agents, runtime authorization on the Delinea Platform checks every action and injects short-lived credentials for databases, clusters and cloud consoles.
These are working documents, written against your configuration, so your team can run them without us.
design01
Secret template and folder design with permission inheritance rules
yours to keep
plan02
Distributed engine placement plan for each network site
yours to keep
report03
Heartbeat and rotation failure report with fixes ranked by risk
yours to keep
guide04
Privilege Manager policies built from observed elevation requests
yours to keep
guide05
Runtime authorization policy per agent, with allow, block and escalate rules
yours to keep
talent and delivery · delinea
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Put these to anyone bidding on your Delinea work. The ones who've done it answer differently from the ones who've read about it.
Q1
Where will distributed engines sit so every target is reachable for heartbeat and rotation?
If an engine can't reach a target, heartbeat fails quietly. Engine placement per network segment is what separates rotation that works from rotation someone eventually turns off.
Q2
Now that StrongDM is part of the Delinea Platform, which of its features does our contract actually include?
The acquisition closed in March 2026. If the design is going to depend on runtime authorization, first confirm you've actually bought it. It may not have come with the platform.
Q3
How do you keep rotation from changing a password in some places and not the rest?
Half-finished rotation is the classic failure for secrets with dependencies. Remote Password Pre-Validation checks every linked system before anything changes. Someone still has to enable it and test it per secret type.
Q4
When an agent's action is escalated to a person, who answers at night?
Escalation only works if someone is on call to approve. Otherwise agents stall, and teams quietly widen the policies to keep work moving.
Q5
If Secret Server stays on-premises, who patches it and on what schedule?
On-premises keeps credentials inside your network, but upgrades become your team's problem. Someone has to own that trade, with a patch schedule written down.
01What did the StrongDM acquisition change?
Delinea completed it on 5 March 2026. The deal brought just-in-time runtime authorization, which evaluates access when an action is requested, so there are no standing rights. In July 2026 Delinea made runtime authorization for AI agents available on the Delinea Platform.
02Should we run Secret Server on-premises or in the cloud?
It depends on hosting rules, how many distributed engines you need, and who will patch the servers. The cloud version removes upgrade work. On-premises still makes sense where credentials must stay inside your network.
03What does Remote Password Pre-Validation do?
It went generally available in Delinea's Winter 2026 release. Before a rotation starts, it checks the health and connectivity of each system tied to the secret, and if any check fails the rotation stops. You don't end up with a password changed in some places but not others.
04Do you also work with CyberArk and BeyondTrust?
Yes. If you're choosing between them, we compare against your systems, hosting rules and team.
05Can you migrate us to Secret Server from another vault?
Usually. We export secrets and folder structures from the old tool, map them to Secret Server templates and permissions, and test heartbeat on each secret type before cutting over. Integrations that call the old tool's API need rework, so we inventory those first.
services
Related services
Projects on Delinea usually end up touching one of these, so they're worth a look.
