---
title: Private Group for Password Vault Account
slug: kronpam-reference-guide-3-9-0/private-group-for-password-vault-account
docTags: 
createdAt: 2026-05-11T12:27:10.251Z
---

In Kron PAM, users who do not have the **SAPM Group Manager** or **SAPM Group System Manager** role cannot normally create a Vault Group for themselves.

Users can be granted the authority to create a Private Group via the **“single.connect.sapm.authorization.create.own.group”** role definition in the Portal role definition screen. 

1.      Navigate to **Policy** > **Portal Definition.**

2.     Open the **Realm Definition** tab.

3.     Add the function group “**Vault Authorization To Create Own Group”** for the user group.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/ove77XEhHldFDgsPPz9pu_image.png" size="80" width="613" height="434" position="center" showCaption="false"}

When a user with this role opens the Vault screen, the “**Private Group**” will be listed under the section displaying **“Account Groups”**. Kron PAM will create a group name using **“User\_Name” **and list it under **“Private Group”.** 

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Yn-6Ym8Yf39hvtS1oVPlQ_image.png "Listed Private Vault for User")

Users cannot rename or delete this Private group, but can create sub-groups under this group and share them with other users by configuring permissions.