- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Devolutions PAM
Your admins share domain and root passwords that never change. A PAM quote shouldn’t take a quarter to arrive — Devolutions PAM adds discovery, rotation, approved checkout and just-in-time rights to the Remote Desktop Manager your admins already use — at a published $50 per named user a month, with the vault self-hosted or in Devolutions Cloud.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Devolutions platform family
This page covers Devolutions PAM — the PAM package, including Devolutions Gateway and the Starter Pack. The rest:
Quick facts
30-second orientation- Product
- PAM module inside RDM, Devolutions Server and Cloud
- Maker
- Devolutions Inc. — private, founder-led, Québec
- Licence
- Per named user, unlimited devices, billed yearly
- Price
- $50/user/month ($600/year), list price in USD
- Small teams
- Starter Pack $25/user/month for five users or fewer
- Hosting
- Self-hosted Devolutions Server or Devolutions Cloud
- Recording
- Video via Gateway or RDM; not keystroke-indexed
- Analysts
- No Magic Quadrant; KuppingerCole 2026 Rated Vendor
- India
- No India region; self-host to keep the vault here
- In India via
- TechBag — INR/GST, sizing and support
Understand privileged access management before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is privileged access management?
PAM puts the accounts that can change everything — domain admins, root, database owners — in a vault, rotates them and records their use.
A shared admin password file vs Devolutions PAM — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A shared admin password file | Devolutions PAM |
|---|---|---|
| Where admin passwords live | A shared spreadsheet or team password file | A vault in Devolutions Server or Cloud |
| Changing a password | Rarely, by hand, when someone leaves | Scheduled rotation, pushed to dependent services |
| Getting privileged access | Ask a colleague for the password | Checkout with approval, ticket and MFA |
| Standing admin rights | Permanent membership of admin groups | JIT elevation for a set window in AD or Entra ID |
| Evidence of a session | Nothing kept | Video recordings through Gateway, with live view |
| What it is NOT | — | Not keystroke-indexed recording or a secrets platform |
The cheapest test is the 14-day free trial: run discovery against AD, rotate one account, and check which of your systems fall into the reset-only group.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Vault
Self-host Devolutions Server on your own hardware, or use Devolutions Cloud on Azure; the PAM module runs inside whichever workspace you pick.
Console
Administrators request, check out and launch privileged sessions from RDM on Windows, macOS or Linux, with credentials injected rather than typed.
Gateway
A Rust-built relay that reaches segmented networks without a VPN, opens web-based RDP and SSH sessions, and records them as video with live view.
Agent
Devolutions Cloud needs the Cloud Services agent inside your network to reach local systems; Devolutions Agent handles jump hosts and elevated tasks.
A vault you host or rent, checked out from Remote Desktop Manager — sessions brokered and recorded by Devolutions Gateway.
Nine capabilities. Vault, control, prove.
Devolutions PAM vaults, rotates and gates privileged accounts from inside Remote Desktop Manager, at a price you can read on a web page.
Find accounts, score the risk
Scans AD, Entra ID, SQL Server, local Windows and SSH accounts, and gives each account found a risk score from 1 to 10.
Rotate and propagate passwords
Scheduled rotation with heartbeat checks, and lifecycle policies that push a new password to the services depending on it.
Nine managed account types
AD, Entra ID, Windows local, SSH users and keys, SQL Server, PostgreSQL, MongoDB and AWS IAM; PowerShell adds custom ones.
Approval, ticket and MFA
A checkout can demand an approver, a ticket number and, since 2026.2, a fresh MFA prompt; access returns itself when time runs out.
Just-in-time group rights
JIT elevation adds a user to an AD or Entra ID group for a set window, then removes them; reusable JIT accounts came in 2026.3.
Sessions without a VPN
Gateway brokers RDP, SSH, VNC and PowerShell into segmented networks, and opens RDP or SSH in a browser for contractors.
Video recording, live view
Gateway records sessions as WebM video, SSH as asciicast, with live monitoring; RDM records embedded sessions at 1 frame a second.
Logs of every checkout
Each request, approval, checkout and rotation is logged in the vault, so reviewers see who held which account and for how long.
Basic application secrets
Scripts fetch credentials from Devolutions Server at runtime, with Ansible, Kubernetes and Terraform hooks; no dedicated secrets product.
Watch Devolutions PAM in action
PAM for small IT teams, a self-hosted deployment on Devolutions Server, MFA on checkout, and privileged remote access through Gateway. All from Devolutions’ official channel.
Your IT team is vulnerable without this | Devolutions PAM for small teams
What the PAM module does for a small IT team.
Deploy your own self-hosted PAM solution in under 30 minutes, only with Devolutions PAM
Standing up PAM on your own Devolutions Server.
MFA on PAM Checkout: Prove it's really you when accessing sensitive privileged account
Adding an MFA prompt to privileged checkout.
Webinar - Privileged remote access: The blind spot in PAM
Gateway and PAM for brokered remote access.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Privileged passwords still sit in shared files. Devolutions PAM vaults them at a published price.
Here’s what genuinely sets it apart — and exactly where it stops.
The only published PAM price here
CyberArk, Delinea, Keeper and Securden quote every deal, and BeyondTrust’s public figure comes from a US government schedule. Devolutions lists PAM at $50 per named user a month, billed yearly — $600 a year — and teams of five or fewer can take the $25 Starter Pack.
PAM inside the tool admins already open
Devolutions calls PAM a module, not a separate purchase: it lives inside Remote Desktop Manager and the vault. The $50 package includes RDM, Devolutions Server or Cloud, and Gateway, so the console, the vault and the session broker arrive together.
Self-hosted without a separate SKU
Every package includes Devolutions Server, so the vault can run on your own servers — the route to keeping it in India — with no second licence. Devolutions Cloud on Azure is the SaaS alternative, covered by Devolutions’ SOC 2 Type II report.
Where it stops
No Magic Quadrant placement; KuppingerCole’s 2026 compass lists it only as a Rated Vendor. No PAM customer or scale is published. Cisco, MySQL and Oracle accounts are reset-only. Recording is video, not keystroke-indexed. No India cloud region and no rupee price.
The numbers behind the platform
What your Devolutions PAM rollout looks like
Count admins and accounts
List every named user who checks out privileged accounts and every account type — the user count sets the price, the types set the fit.
Pick the workspace
Choose self-hosted Devolutions Server or Devolutions Cloud; if Cloud, plan where the Cloud Services agent runs inside your network.
Run the 14-day trial
Run discovery against AD and a few servers, review the 1–10 risk scores, then rotate one domain admin account and one SQL login.
Switch on the controls
Set approval and MFA on checkout, turn on JIT elevation for admin groups, and route contractor sessions through Gateway with recording.
Close the gaps
Decide how Cisco, MySQL and Oracle reset-only accounts are handled, set recording retention, and confirm you are past Server 2025.3.16.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We already ran RDM for every admin. Moving to the PAM package meant domain admin passwords now rotate after each checkout.”
“Finance approved it from the pricing page alone. Four admins on the Starter Pack cost less than one quote cycle elsewhere.”
“Our Oracle accounts only get a password reset, not full management, so the DBAs still keep a separate runbook for those.”
“Auditors asked to search what an admin typed. Gateway gives us video of the session, so we scrub through it by hand.”
“We self-host Devolutions Server in our Pune rack, which settled the storage question our board kept raising.”
“JIT elevation drops people into the Entra ID admin group for an hour, then out again. Standing admin rights are gone.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the privileged access management market — tap any vendor to see why it sits where it does.
TechBag Privileged Access Grid
Execution strength vs product vision — the classic market map, minus the paywall.
$50 per named user a month; KuppingerCole 2026 Rated Vendor.
Price Transparency × PAM Depth
The grid nobody publishes — how much of the price you can see before talking to sales vs how deep the vault, recording and account coverage go.
Published $50/user/month; video-only recording, three reset-only types.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Devolutions PAM vs the privileged access field
Set against Securden Unified PAM, KeeperPAM, Delinea Secret Server, BeyondTrust Password Safe and CyberArk (Palo Alto Networks) — on deployment, accounts covered, price, recording, analyst standing and India.
| Dimension | Devolutions PAM | Securden Unified PAM | KeeperPAM | Delinea Secret Server | BeyondTrust Password Safe | CyberArk (Palo Alto Networks) |
|---|---|---|---|---|---|---|
| What it is | PAM module, sold as tier | Vault, JIT and sessions | Vault plus a gateway | Delinea’s PAM vault | BeyondTrust’s vault | The reference PAM vault |
| Deployment | Self-hosted or SaaS | On-prem or SaaS | SaaS vault, own gateway | On-prem or cloud | Appliance or cloud | Two SKUs: self or SaaS |
| Accounts covered | Broad; three reset-only | Servers, DBs, network | Protocols incl. K8s, DBs | Large changer library | Servers, cloud, DevOps | Widest platform reach |
| Pricing model | Per named user | Per PAM user, quoted | Sales quote | Per user, in packs | Per managed asset | Per privileged user |
| Published entry price | $50/user/month, yearly | Quote only | Quote only | Quote only | ~$157/asset/yr (GSA) | Reported $1,800–12,000 |
| Included vs add-on | RDM, vault, Gateway in | EPM, vendor access extra | Recording and JIT extra | Editions and support | Premium SKU for more | Secrets sold separately |
| Scale and standing | No MQ; KC Rated Vendor | No MQ; unproven at scale | In MQ; KC Product Leader | MQ Leader; KC Overall | MQ Leader, seventh time | MQ Leader, ~9k customers |
| Recording and security | Video only; one critical | Video plus keystrokes | Searchable text logs | Session monitoring | Single-tenant, SOC 2 | Isolated sessions (PSM) |
| Integrations | Reads rival vaults | CI/CD SDKs, Key Vault | SIEM stream, secrets CLI | API; DevOps vault apart | IdP, SIEM, ServiceNow | Broadest ecosystem |
| Governance and SSO | Approvals, MFA, JIT | Request-release, Entra | SSO in base; JIT extra | AD sync needs a licence | JIT brokered access | Governance on-platform |
| India storage region | Self-host only in India | On-prem; SaaS unstated | No India region | No India; on-prem works | Central and South India | India data centre |
| Support | 48 h standard, 4 h paid | Phone lines listed | Tiers not published | Support bought per user | Not published | Inside the quote |
| Lock-in and exit | Yearly; reads rivals | Cancel for a refund | SaaS-only vault | Check migration terms | Videos can’t be exported | Deep, so slow to leave |
| Best fit | Teams already on RDM | Mid-market, one quote | Cloud-first Keeper users | Rated Leader, own choice | Few admins, many assets | Large, regulated estates |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Devolutions PAM if…
- ✓Your admins already live in Remote Desktop Manager and you want PAM inside the same console
- ✓You need a PAM price you can budget from a web page — $50 per named user a month, or $25 on the Starter Pack for five or fewer
- ✓The vault must stay on your own servers — Devolutions Server comes in every package at no extra charge
Compare alternatives if…
- ✓The cloud vault itself must be hosted in India — BeyondTrust Password Safe Cloud offers Azure Central India, and CyberArk runs an India data centre
- ✓Auditors want keystroke- or command-searchable recordings — Securden and KeeperPAM document them
- ✓Your board wants an analyst-rated Leader — Delinea, BeyondTrust and CyberArk each hold a Gartner PAM Leader placement
Do not expect…
- ✓A Gartner Magic Quadrant placement or a published PAM customer reference
- ✓Full management of network, MySQL or Oracle accounts — those are reset-only
- ✓A rupee price, an India cloud region or a dedicated secrets-management product
Devolutions PAM is one of 29 privileged access management products TechBag carries. The Privileged Access Management guide narrows them to a shortlist and shows the reasoning. →
What does managing privileged passwords by hand cost you?
Drag the sliders (privileged accounts you manage; admin-hour cost). Estimates model admin time spent changing passwords by hand, tracking down who holds a shared credential and assembling audit evidence, at an assumed 1.5 hours per privileged account a year, with 70% of it removed by rotation, checkout and logging. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Published, in USD per named user and billed yearly: the Privileged access management package is $50 a month ($600 a year) and includes Remote Desktop Manager, Devolutions Server or Devolutions Cloud, and Gateway. Teams of five or fewer can take the Starter Pack at $25 a month, which moves to full price above five users. Enterprise from 100 users is quoted. These are list prices, not first-year promotions, and there is no INR price. TechBag counts your named users first, then quotes in INR with GST.
Starter Pack
Best for IT teams of five or fewer
- $25 per user a month, billed yearly
- All four packages, Cloud or Server
- Full price once you pass five users
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Privileged access management
Best for teams past five admins
- $50 per named user a month, billed yearly
- RDM, the vault and Gateway included
- Enterprise from 100 users is quoted
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
How many named users will check out privileged accounts? Each needs a licence; five or fewer can use the Starter Pack.
Do you run Cisco, MySQL or Oracle accounts that need full rotation? Devolutions treats all three as reset-only.
Must auditors search sessions by keystroke or command? Devolutions records video only, so confirm it meets the requirement.
Will you self-host Devolutions Server or use Devolutions Cloud, and can a Cloud Services agent run inside your network?
Must the vault be stored in India? Devolutions Cloud has no India region, so that means running Devolutions Server here.
Does your board require an analyst placement or a named PAM reference? Devolutions has neither published today.
Is every Devolutions Server on 2025.3.16 or later, closing the critical Entra ID sign-in bypass CVE-2026-3224?
Will finance accept a USD invoice, or must it come in INR with GST through a partner?
Questions buyers ask
Ready to evaluate Devolutions PAM?
Count your named admins and the account types they manage first, or let a TechBag advisor scope a trial that rotates one domain admin and records one Gateway session.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.