Overview

Torii integrates with BeyondTrust (BeyondInsight / Password Safe) and syncs:

• You can constantly stay updated with application information from our Integrations Page >> Integration Capabilities button >> Integration Capabilities table.

Requirements

To connect this integration, we require the following:

Accounts & Permissions

• A BeyondTrust BeyondInsight / Password Safe instance (cloud or on-premises) and an administrator who can manage API registrations and users.
• An application user linked to an API registration, assigned to a group with the User Accounts Management permission: Read is enough to sync users, and Full control is required to use the Create User, Update User and Delete User actions in Torii.

Required keys

• Instance URL - the address of your BeyondTrust instance, for example https://example.ps.beyondtrustcloud.com
• Client ID - of the application user
• Client Secret - of the application user

How to Generate the Required Values

Step 1: Create an API registration

1. Sign in to the BeyondInsight console as an administrator.
2. From the left menu, click Configuration.
3. Under General, select API Registrations.
4. Click Create API Registration and select API Access Policy from the dropdown.
5. Enter a name and fill in the details, including the Access Token Duration.
6. Click Add Authentication Rule. If your registration uses IP rules, add the Torii IP addresses so Torii can reach the API (see the list of Torii IP addresses in the Torii documentation), then click Create Rule.
7. Click Create Registration.

Step 2: Create an application user

1. From the left menu, click Configuration.
2. Under Role Based Access, select User Management and open the Users tab.
3. Click Create New User and select Add an Application User.
4. Enter a username and, under API Access Policy, select the registration you created in Step 1.
5. Copy and save the Client ID and Client Secret.
6. Click Create User.

Step 3: Assign the user to a group with the required permission

1. In the Users grid, locate the application user.
2. Click the ellipsis icon > View User Details, then click Groups.
3. Select a group that has the User Accounts Management permission (Read to sync users, Full control to use the Create, Update and Delete User actions) and click Assign Group.

How to Connect the Integration

1. Go to the Integrations page in Torii.
2. Search for BeyondTrust and click Connect.
3. Enter the Instance URL, Client ID and Client Secret.
4. Click Connect.

Actions

• Create User - creates a new local BeyondInsight user from the Torii user's details, with an initial password.
• Update User - updates the first name, last name, email address or password of a BeyondInsight or Application user. Users managed in Active Directory, LDAP or Entra ID cannot be updated.
• Delete User - deletes a user. A user linked to Password Safe session recordings cannot be deleted; disable such users in the BeyondInsight console instead.

Q&A

Q: What should I enter in the "Account Name" field?

A: The Account Name field lets you connect multiple BeyondTrust accounts to Torii. The value can be anything you choose. It is only used to distinguish between your connected accounts. Make sure to use a unique Account Name for each account: connecting a different account with an Account Name that is already in use will overwrite the existing account's data, so choosing distinct names is your responsibility.

For any further questions, please contact Torii Support.