Privileged Remote Access (PRA)

Privileged Remote Access (PRA) enables secure, clientless browser access to RDP and SSH applications with policy-based session governance and just-in-time credential injection.

Use PRA to:

• Provide administrators and third parties with controlled RDP/SSH access without a VPN client.
• Record privileged sessions for audit and compliance.
• Inject vaulted credentials so end users never see passwords or keys.

Prerequisites

• Netskope Private Access is enabled in your tenant.
• Target RDP and SSH applications are defined as private app segments in NPA.
• Real-time Protection (RTP) policies are configured to allow access to those private app segments.

How PRA Works

• RTP policies decide whether a user can access a private app segment (allow/deny).
• PRA policies apply session-level controls to sessions that are already allowed.
• PRA can:
  • Record or not record sessions for specific users/groups and apps/tags.
  • Inject credentials for specific users/groups and apps/tags.
• Both RTP and PRA policies are evaluated in their own policy lists.

Access decision: RTP policy
Session governance: PRA policy (session recording and credential injection)

Configure PRA Policies

1. Go to Policies > Private Access > Privileged Remote Access Control.
   
2. Create a PRA Policy

• Click New Policy. You are prompted to choose a policy type:
  • Session Governance: Governing privileged RDP/SSH sessions. Use this type to control whether sessions are recorded.
  • Credential Injection: Enable privileged RDP/SSH credential injection. Use this type to inject vaulted credentials into sessions.
• Under Criteria (all criteria sections are AND’ed together):
  • Source: Select the users or groups.
  • Destination: Select Private App Segments/tags.
• Under Action:
  • For a Session Governance policy: toggle Record Session on or off.
  • For a Credential Injection policy: select the Credential Object to inject.
• Under General:
  • Enter a Name and optional Description.
  • Set Policy Position to control evaluation order.
  • Set Status to Enabled.

Configure Credential Objects

Before you can configure credential injection in a PRA policy, you must create one or more credential objects. A credential object stores the privileged RDP or SSH credentials in the Netskope Vault so they can be automatically injected into sessions.

Create a Credential Object

1. Go to Policies > Profiles > Privileged Remote Access Control Credentials.
2. Click New Credential. A side panel opens with the following fields:
   • Credential Object Name (required): A descriptive name for this credential (for example, Windows Admin RDP or Linux Root SSH).
   • Description (optional): Additional context about the credential.
   • Vault: Select Netskope (default).
   • Type: Choose RDP or SSH:

   If RDP is selected:

   • • Username (required)
     • Password (required, masked with show/hide toggle)
     • Domain (optional)

   If SSH is selected, choose an authentication method:

   • • Password: Enter Username (required) and Password (required, masked).
     • Private Key: Enter Username (required), paste or upload the Private Key, and optionally enter a Passphrase.
3. Click Save. The credential object appears in the credentials listing table.

Edit a Credential Object

1. On the Privileged Remote Access Control Credentials page, locate the credential card.
2. Click the three-dot menu (⋮) on the card and select Edit.
3. Update the fields as needed and click Save.

Delete a Credential Object

1. Click the three-dot menu (⋮) on the credential card and select Delete.
2. Confirm the deletion.

Note: You cannot delete a credential object that is currently linked to a PRA policy. Remove the credential from any associated policies before deleting it.

Verify PRA Behavior

1. Use the configured access method (for example, Browser Access or Enterprise Browser) to launch the RDP/SSH app.
2. Verify the user successfully reaches the target app.
   • If recording is enabled, check for any recording indicator in the session UI.
   • If credential injection is enabled, verify the session establishes without the user manually entering credentials (when configured that way).
3. Validation
   • Go to Events > Network Events.
   • Filter for PRA-related events.
   • Open the event for the test session and confirm:
     • The action reflects the expected PRA policy.
     • A recording download is available when session recording is enabled (after processing completes).

FAQs

Does PRA policy replace existing RTP access policy?
No, RTP policies continue to control allow/deny decisions; PRA policies add session-level controls on top of already-allowed sessions.

Can I apply both recording and credential injection to the same app segment?

Yes, you can configure separate policies for the same app segment: one for session governance to enforce recording and another for credential injection.

Do users ever see the injected credentials?
No, credentials are not exposed to end users.