PAM Advanced
For engineers already running PAM who need to extend and troubleshoot it.
PAM Advanced
Development, resilience and root cause work. Assumes working knowledge of the core components and moves straight into the parts of the platform teams usually avoid.
What you will be able to do
- Design HA and DR topologies and run a real failover
- Write and harden CPM plugins and PSM connection components
- Integrate PTA, SIEM and ITSM into the privileged access flow
- Diagnose and fix the failures that generate most production tickets
- Plan and execute a version upgrade with rollback
How the programme runs
Each day pairs concepts with hands-on work. Sessions run two to eight hours a day, scheduled in your time zone.
| Day | Focus | Topics |
|---|---|---|
| Day 1 | Architecture at scale | HA, DR, satellite vaults, load balancing, network segmentation, hardening |
| Day 2 | DR & recovery | DR vault, PAReplicate, failover and failback runbook, restore tests |
| Day 3 | Advanced CPM | Dual-account rotation, dependencies, service account patterns, plugin framework |
| Day 4 | CPM plugin development | Terminal and web plugins, process files, testing, packaging |
| Day 5 | Advanced PSM | Universal connector, custom connection components, AppLocker, recordings at scale |
| Day 6 | PSMP & HTML5 deep dive | Key management, MFA caching, gateway tuning, troubleshooting |
| Day 7 | PTA | Detections, Kerberos attack indicators, auto-response, tuning noise |
| Day 8 | Integrations | SIEM (Splunk, Sentinel), ServiceNow ticket validation, MFA providers, REST and PACLI |
| Day 9 | Troubleshooting clinic | Logs, traces, common errors (PSMCE, CPM failures, PVWA auth), escalation packs |
| Day 10 | Upgrades | Pre-checks, sequence, rollback, post-upgrade validation |
| Day 11 | Migration concepts | Self-Hosted to Privilege Cloud: connectors, Secure Tunnel, waves, evidence |
| Day 12 | Practical & review | Break-fix marathon, plugin submission, Sentry preparation |
What the programme covers
Plugin anatomy, process files, prompt files and debugging a rotation that fails silently.
Building and registering custom connection components for applications with no supported connector.
Central Credential Provider deployment, client certificate authentication and application allow-lists.
Cluster design, disaster recovery vaults, replication monitoring and failover testing.
Reading vault, CPM, PVWA and PSM logs to find the actual cause rather than the symptom.
Structured revision against the exam objectives, with practice scenarios.
Who, what you need, and how it is assessed
Who should attend
- Administrators running a live deployment
- Engineers who own upgrades and integrations
- Consultants delivering PAM for clients
- Sentry candidates
Prerequisites
- PAM Foundation or 6+ months hands-on with Idira PAM
- Scripting familiarity (PowerShell or Python)
- Understanding of Kerberos, LDAP and TLS
Lab environment
- Multi-component environment with DR vault and second PSM
- Deliberately broken states each module: expired certs, failed reconcile, stuck sessions
- Plugin development workstation with sample targets
- Live for the programme and two weeks after
Assessment & certification
- Root-cause exercises graded on method, not just fix
- Plugin build and test against an unsupported target
- Sentry exam preparation
Delivery formats
- Live instructor-led, remote or on-site
- 2 to 8 hours per day, scheduled in your time zone
- Private batch recommended; mirrored on your topology on request
Commercial
- Per seat or per corporate batch
- 12 days
- Syllabus and quote on request
Labs, not slides
The advanced programme is built around failures. Each module starts from a broken environment, and participants diagnose it before being shown the fix.
Prerequisites
Completion of PAM Foundation or equivalent production experience. Participants should be comfortable onboarding accounts and configuring platforms unaided before starting.
Ready to build the team you need?
Corporate batches are scoped to your deployment and scheduled in your time zone. Open cohorts run for individual engineers.
These principles guide every engagement
They define how we design, deliver and operate identity security for our customers.
Certified, not just familiar
Guardian-led, with CDE credentials across PAM, Privilege Cloud, EPM and Secrets Manager, kept current on every release.
Architect-led delivery
Design is reviewed and signed off before anything is built, so what goes live is what was agreed.
Written scope, fixed price
Deliverables, timeline and price in writing before work starts. No open-ended retainers.
Enablement built in
Your team is trained during delivery, so what we build does not depend on us to keep running.
Sound familiar?
The situations that start most of our engagements — in the words we hear them.
Need identity security you can trust?
Talk to a certified architect about protecting privileged access, identities and critical systems. The first call is technical, not a sales pitch.