---
title: User Types for Remote Privileged Access Management
slug: kronpam-reference-guide-3-9-0/user-types-for-remote-privileged-access-management
docTags: 
createdAt: 2026-05-12T19:46:29.598Z
---

In the Kron PAM, the users are separated into **“only internal”**, **“external”, **and **“RPAM Enabled”** user types:

·         The **only internal **user type can use Web GUI and Desktop Client to access the KronPAM servers and use all features **except for Remote Privileged Access Management**.

·         The **external**) user type can **use Remote Privileged Access Management features** and ***solely* access device management on the Kron PAM Web GUI and Desktop Client** (though over-permissions are granted to this user type, the user still can only access device management on the Kron PAM Web GUI and Desktop Client),

·         The **RPAM Enabled** user type can use **both Remote Privileged Access Management **and** features** **on the Kron PAM Web GUI and Desktop Client** together. 



| **User Type** | **Web GUI & Desktop Client**     | **Remote Privileged Access Management** |
| ------------- | -------------------------------- | --------------------------------------- |
| only internal | Yes                              | No                                      |
| external      | Limited (device management only) | Yes                                     |
| RPAM Enabled  | Yes                              | Yes                                     |



Two Remote Privileged Access Management Boolean flags should be defined to handle user types. These flags are attached to user groups and users: 



·         The Boolean flag attached to the user group shows whether the members of the user group are **RPAM Enabled** or **only internal** user types altogether. This flag can be called **RPAM Enabled**, and if this flag is True, the members of the user group are **RPAM Enabled** user types, if this flag is False, the members of the user group are **only internal** user types. 

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/lKRXg4jMS7dKFL4BTndjL_image.png "Figure  –  RPAM Enabled Flag on the User Group")

·         The Boolean flag attached to the user shows whether the user is **only internal**, **RPAM Enabled **or **external** user type. This flag can be called ** RPAM Only**, and if this flag is True, the user is **external** user type and if this flag is False, the user is either** RPAM Enabled** or **only internal** depending on his/her group **RPAM Enabled**’s value.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Jn1meDxx1h7YW5s-4q-bM_image.png "Figure  –  Enable RPAM Only Flag on the User ")



![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/aSMTI_H8H7q-CkX2n8LSE_image.png "Figure  –  Enable/Disable RPAM Only Flag for all members of the User Group")

| PAM\&RPAM Flag | PAMLimited\&RPAM Flag | User Type        |
| -------------- | --------------------- | ---------------- |
| True           | True                  | PAMLimited\&RPAM |
| True           | False                 | PAM\&RPAM        |
| False          | True                  | PAMLimited\&RPAM |
| False          | False                 | PAMOnly          |