IdentityMesh Vault · Enterprise plan
Privileged checkout, rotation, and tamper-evident audit — built into the identity platform you already deploy for synchronization. No second vendor. No second agent. No second contract.
Checkout, rotation, and the audit chain — on the same platform that already syncs your identities.
CyberArk and Delinea sell a standalone vault that you then integrate with your identity stack. IdentityMesh Vault is built into it instead. Identity data decides who may ask: requests are judged against the same mesh objects and group memberships the connectors already imported. Credential material is a separate concern. It is encrypted at rest in the secret store, released one checkout at a time, and kept out of the identity records themselves. Knowing who someone is never unlocks what they hold.
One deployment.One audit chain.One operations model.
| Criterion | IdentityMesh Vault | CyberArk PAM | Delinea Secret Server |
|---|---|---|---|
| Deployment | Module of the identity platform you already run | Standalone platform (Vault + CPM + PSM + PVWA) | Standalone Secret Server, on-prem or Cloud |
| Time to stand up | Days | Months, with dedicated admin | Faster than CyberArk, still a separate rollout |
| Licensing | Included with IdentityMesh | Per privileged account + per-module add-ons | Per user, tiered; Cloud Platinum sold at premium |
| Typical cost / user / year | Included | ~$600–$1,400 | ~$45–$110 Server; Cloud materially higher |
| Rotation | Per-target setters for AD (LDAPS), SQL logins, and Entra ID (Graph); owner-provided or blind nomination; per-policy schedule with failure backoff | CPM plug-ins per platform | Discovery + remote password changers per platform |
| Using a checked-out credential | Reveal once, hand on as a one-time link, or hand it to IdentityMesh Connect, a launcher on the operator's PC that signs Remote Desktop in as the account so the operator never sees the password. No session recording | PSM proxies and records the session | Secret Server launchers; session recording as an add-on |
| Secret store | The secret store you already configured: DPAPI, Azure Key Vault, or HashiCorp Vault | Proprietary Vault appliance | Encrypted DB with HSM options |
| Audit | Extends the append-only audit hash chain shared with sync and admin events | Session recording + SIEM export | Event subscriptions + SIEM export |
| Roles | Existing Viewer / Operator / Admin get scoped Vault permissions | Multiple product roles across modules | Distinct roles per Secret Server function |
Competitor pricing reflects publicly published benchmarks. Contact us to model your specific quote.
IT & identity
Your CyberArk quote asks for a vault appliance, CPM, PSM, PVWA, and a dedicated admin. IdentityMesh Vault ships as a module of the sync engine you already own. Nominate an account, check it out, roll it back in — same UI, same roles, same install.
Migration
You already picked IdentityMesh to retire Microsoft Identity Manager. Adding CyberArk or Delinea on top puts you back into the two-product operations you were trying to escape. Vault ships in the same MSI and audits into the same hash chain.
Security & risk
Vault events extend the append-only audit hash chain, so no earlier event can be altered without detection. One active checkout is enforced by policy and by the database itself. A missing source account locks the record instead of silently de-vaulting on transient import failure.
Vault uses the same secret store as the rest of the product: DPAPI, Azure Key Vault, or HashiCorp Vault, depending on your deployment. There is no second key configuration to manage.
Rotation is delegated to a password setter for the connector type: Active Directory over LDAPS, a SQL Server login over its own connection (ALTER LOGIN), an Entra ID user over Graph (User-PasswordProfile.ReadWrite.All). SQL and Entra setters are new in this release. A connector type with no setter is refused at nomination rather than half-supported. The new password is written to the secret store under a pending reference before it touches the target, so a crash mid-rotation never loses a live credential.
OwnerProvidedBlindRotation
Policy and a database constraint enforce a single active session per account, and concurrency checks protect against duplicate requests and client retries. A credential is revealed strictly once: a second view is refused. New in this release, the requester can instead mint a one-time credential link and hand it to whatever actually needs the password. The recipient redeems it once, with no portal account, and the token travels in the request body so no log ever captures it. Also new, Connect: for accounts an administrator has listed target hosts for, the account is handed to IdentityMesh Connect, a launcher on the operator's PC. It redeems the check-out, signs Remote Desktop in as the account, and removes the credential when the session ends or the check-out expires. The operator picks the host and never sees the password.
A Vault scope binds accounts to mesh groups. Who may request an account is derived from group membership the mesh already holds, imported from AD or built by Composer rules, instead of a hand-maintained safe. New in this release, accounts in no scope are refused to everyone until an administrator adds them to one (Vault:UnscopedAccountsOpen=true restores the old open behaviour during a rollout), and vault.admin does not bypass the rule on checkout. A Composer rule that exists only to gate the vault shows a Vault only badge; one that also provisions the group shows Provisioning.
A missing source account blocks new checkouts and preserves its audit history. A transient import or replication failure cannot cause a vaulted account to silently disappear. New in this release, a source-missing sweep moves the account to SourceMissing, returns it to Active if the directory object reappears, and archives it only after the policy’s grace period. A pass that would archive more than a configurable cap archives nothing and logs an error, because that many at once usually means a narrowed import scope, not a wave of leavers.
Vault seeds vault.audit.read for the existing Viewer role rather than adding a new Auditor role. Admin and Operator receive broader Vault permissions.
Vault audit events sit alongside admin and object audit events in the same append-only hash chain, so one verification run covers all of them and no earlier event can be altered without detection.
Marketing pages that claim everything are worth nothing. Here is the current scope, honestly.
If session recording is a hard requirement, pair Vault with a session-recording tool of choice or stay with your current PAM for that workload. We would rather be clear than complete.
Setting keys, sweep behaviour, rotation prerequisites and a rollout checklist for the features marked new in this release are in the Vault operations runbook.
Send us your CyberArk or Delinea quote. We'll map each line item to what's already included in IdentityMesh Vault — and be honest about what isn't.
Pricing benchmarks: Vendr and Vendor Benchmark 2026 (CyberArk, Delinea). Deployment complexity: Comparisec and StrongDM comparisons. Gartner Peer Insights review counts as of 2026.
