PAM Architecture

PAM architecture defines how privileged access management components are deployed, integrated, and scaled across the enterprise. A well-designed PAM architecture balances security (least privilege, segmentation) with operational requirements (availability, performance, user experience).

This page covers the key architectural patterns, decisions, and integration points for enterprise PAM deployments.

PAM Deployment Models

Tier 1: Basic Credential Vaulting

The simplest PAM architecture — a central vault stores privileged credentials, and administrators check them out on demand.

Admin ──→ Vault (credential checkout) ──→ Target System

Best for: Small organisations (< 500 employees), basic compliance requirements. Limitations: No session monitoring, no JIT, no proxy.

Tier 2: Vault + Session Proxy

Adds a session proxy through which all privileged sessions are routed, recorded, and monitored.

Admin ──→ Vault (credential checkout) ──→ Session Proxy ──→ Target System
                                              │
                                         Recording
                                         Monitoring

Best for: Mid-size organisations (500-5000 employees), SOX/PCI compliance. Limitations: No JIT, limited automation.

Tier 3: Full PAM Platform

Integrates vaulting, session management, JIT access, discovery, and governance into a unified platform.

Admin ──→ PAM Portal (request access) ──→ Approval Workflow ──→ JIT Elevation ──→ Session Proxy ──→ Target
          │                                │                    │                    │
          Vault                            Approval              AD group            Recording
          (credential storage)              Engine               membership           Engine

Best for: Large enterprises (5000+ employees), regulated industries, hybrid cloud.

Tier 4: Zero Standing Privileges

No user has permanent privileged access. All privilege is ephemeral, JIT-approved, and automatically expires.

Admin ──→ JIT Request ──→ Approval ──→ Temporary Elevation ──→ Time-bound Session ──→ Auto-De-escalation
          (no standing          (workflow)    (15 min-4 hours)    (monitored)              (privilege
           privs)                                                                          removed)

Best for: Mature security programs, Zero Trust architectures, high-risk environments.

PAM Tiering Model (Microsoft Enterprise Access Model)

Microsoft defines a tiering model for privileged access that is widely adopted:

Tiering rule: Administrators in Tier 0 can manage Tier 0, Tier 1, and Tier 2. Administrators in Tier 1 can only manage Tier 1 and Tier 2. Administrators in Tier 2 can only manage Tier 2.

    flowchart TD
    subgraph Tier0["Tier 0 — Identity Systems"]
        AD[Active Directory]
        AAD[Azure AD]
        CA[Certificate Authority]
    end
    subgraph Tier1["Tier 1 — Server Infrastructure"]
        HyperV[Hypervisors]
        SQL[Database Servers]
        FS[File Servers]
    end
    subgraph Tier2["Tier 2 — User Workstations"]
        WK[Workstations]
        APP[Line-of-Business Apps]
    end
    T0Admin[Admin] -->|Can manage| Tier0
    T0Admin -->|Can manage| Tier1
    T0Admin -->|Can manage| Tier2
    T1Admin[Admin] -->|Can manage| Tier1
    T1Admin -->|Can manage| Tier2
    T2Admin[Admin] -->|Can manage| Tier2
  

High Availability Architecture

Vault HA Deployment

                   ┌─────────────────────┐
                   │  Load Balancer      │
                   │  (VIP / DNS)        │
                   └──────┬──────────────┘
                          │
          ┌───────────────┼───────────────┐
          │               │               │
    ┌─────┴─────┐   ┌─────┴─────┐   ┌─────┴─────┐
    │ Vault     │   │ Vault     │   │ Vault     │
    │ Node 1    │   │ Node 2    │   │ Node 3    │
    │ (Primary) │   │ (Replica) │   │ (Replica) │
    └─────┬─────┘   └─────┬─────┘   └─────┬─────┘
          │               │               │
          └───────────────┼───────────────┘
                          │
                    ┌─────┴─────┐
                    │  Database │
                    │ (HA/DR)   │
                    └───────────┘

HA requirements:

• Minimum 3 vault nodes for production
• Active-passive or active-active configuration
• Database cluster (SQL Server Always On, PostgreSQL Patroni)
• Geographic redundancy for DR (active in primary region, passive in secondary)
• Automatic failover with RTO < 5 minutes, RPO < 1 minute

Integration Patterns

IAM Integration

SIEM Integration

ITSM Integration

Architecture Decision Framework

PAM Sizing Guidelines

Key Takeaways

• PAM architecture spans four maturity tiers: basic vaulting → vault + proxy → full platform → zero standing privileges
• The Microsoft Enterprise Access Model tiers systems (Tier 0: identity, Tier 1: infrastructure, Tier 2: workstations) — administrators in a higher tier can manage lower tiers but not vice versa
• High-availability architecture requires 3+ vault nodes, clustered database, and geographic redundancy with RTO < 5 minutes
• PAM integrates with IAM (identity sync, SSO, RBAC), SIEM (log forwarding, alerts, recordings), and ITSM (ticket validation, auto-approval, session updates)
• Architecture decisions (on-prem vs cloud vs hybrid) balance compliance, operational overhead, latency, and coverage — cloud-first is recommended for most enterprises
• PAM sizing depends on managed accounts, concurrent sessions, and storage requirements — scale from embedded database (small) to geo-distributed cluster (enterprise)