Skip to main content
An account template sets the rules for connecting to the accounts that use it, such as the maximum session length and whether access needs approval. It also sets which gateway the accounts connect through and where Infisical stores their session recordings. Every account uses one template, and the template’s account type must match the account’s type. When you change a template, the change applies to every account that uses it.

​
Default templates

Infisical creates a template for each account type when your organization first opens PAM. The default templates have no policies turned on, so sessions on their accounts last up to one hour, and Infisical stores the recordings in its internal database. Windows and Windows AD accounts need recordings stored in AWS S3, so before anyone can launch sessions on them, change the default Windows templates to use external storage. If an account type has no template, such as a type added after your organization started using PAM, the Account Templates page shows a message. Select Add default templates in the message to create the missing templates.

​
Create a template

Create your own template when some accounts need different rules, such as production databases that need approval before anyone connects.
1
Go to Privileged Access Management > Account Templates and select Create Template.
2
Enter a Name, choose the account Type, and optionally enter a Description, then select Create Template.
3
On the template’s General tab, set the policies and system settings that the accounts need.
4
Select Save Changes.
To use the template, choose it when you add an account.

​
Policies

Allow Auto-Approval and Allow Break-Glass only work together with Require Approval. If you turn off Require Approval, Infisical also turns off Allow Break-Glass. Machine identities and AI agents can’t complete an MFA challenge, so they can’t connect to accounts whose template has Require MFA on. If an agent needs an account, use Require Approval instead.

​
System settings

You can override the gateway for one account on the account’s Advanced tab. For Windows and Windows AD accounts, you can also override the recording bucket there.
The General tab also has settings for credential rotation and credential health checks, for account types that support them.