# Accesses

> Create a privileged access integration and decide in each access which group reaches which machines, as which account, what it may run and which factors apply.

URL: https://docs.ironchip.com/en/pam/administracion/accesos/

An access says who reaches which machines and under what conditions. This page explains how to create accesses. It is for whoever administers privileged access.

Privileged accesses are configured like those of any other Ironchip application: in **Integrations**, on an integration of type **Privileged access**. Each access brings together:

| What                         | Where it is defined                                                                                            |
| ---------------------------- | -------------------------------------------------------------------------------------------------------------- |
| Who                          | A directory group                                                                                              |
| Which account they arrive as | Each machine's own account or a fixed account                                                                  |
| Which machines               | [Target policies](https://docs.ironchip.com/en/pam/administracion/politicas/#target-policies)                                           |
| What they can run            | [Control policies](https://docs.ironchip.com/en/pam/administracion/politicas/#control-policies)                                         |
| How they prove who they are  | The access's factors: device, safe zone, and [approval](https://docs.ironchip.com/en/pam/administracion/aprobadores/) if you require it |

## Before you start

- The [target policies](https://docs.ironchip.com/en/pam/administracion/politicas/#target-policies) with the machines.
- If you want approval, an [approval policy](https://docs.ironchip.com/en/pam/administracion/aprobadores/).
- Permissions to create applications and accesses, and **PAM targets, sites and agents** with Write.

## Create the integration

1. Go to **Integrations** and click **New application**.
2. Under **Brokered remote access**, choose **Privileged access**.
3. Enter the name (for example, `Infrastructure`) and, optionally, an icon.
4. Click **Add**.

The integration groups accesses: it does not name any machine. In the **Integrations** list it appears with the type **PAM**.

## Add an access

1. In **Integrations**, find the integration and click **Add** in the **Add access** column.
2. **Select a group**: choose the group of people.
3. **Account on the machines**: choose which account they arrive as.
   - **Each machine's own account · the one its target signs in as**: each machine's own account. This is the default.
   - **A specific account, on every machine**: enter the account in **Account**, for example `dba`. Each machine needs that account added in its **Accounts** tab; a machine that does not have it refuses the connection. See [Accounts](https://docs.ironchip.com/en/pam/administracion/cuentas/).

   [Image: Account on the machines step of the access, with each machine's own account or a fixed account]

4. **What they reach**: select one or more target policies.
5. **What they can do**: select the control policies. **All allowed** comes selected in new accesses. If you select several, they are checked in the order you select them.
6. **Select authentication policies**: choose the factors. Each row combines factors with **AND** and the rows are combined with **OR**. For example, `Company device AND Office safe zone` or `Company device AND Production approval`. To require approval, add an approval policy as one more factor.
7. **Review**: check the summary and save.

The factors apply to every machine in the access. If some machines need different factors from others, create another access.

To change an access, open it from the integration's page with **Configure access**.

## Permanent or on-request access

- **With no approval policy** in any factor combination, the access is **permanent**: the people in the group see it in **PAM > My access**, under **Yours whenever you need it**, and connect whenever they want. They are still asked for the factors when they connect.
- **With an approval policy** in any combination, the access is **on request**: the person requests a window in **Request access** with a reason, and someone approves it. See [Request access](https://docs.ironchip.com/en/pam/usuarios/solicitar-acceso/).

In both cases, each connection is decided when it is made: the broker holds it until Ironchip checks that the person has an open window or permanent access, that their address is allowed and that they confirm the access's factors. See [Approval](https://docs.ironchip.com/en/pam/conceptos/aprobacion/).

## More information

- [Applications](https://docs.ironchip.com/en/identidad/administracion/aplicaciones/): how integrations and accesses are managed in general.
- [Safe zones](https://docs.ironchip.com/en/identidad/conceptos/zonas-seguras/) and [Authentication policies](https://docs.ironchip.com/en/identidad/conceptos/politicas/).