> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# PAM account discovery

> Find accounts on your systems and import them into PAM.

Discovery scans your systems for accounts, such as Active Directory users or PostgreSQL roles, so you can import the ones you want to manage as PAM [accounts](https://infisical.com/docs/documentation/platform/pam/accounts/overview.md). You need the [Product Admin role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md#product-membership) to use Discovery.

To set up a discovery source, follow the guide for the system you want to scan:

> [card] [Active Directory](https://infisical.com/docs/documentation/platform/pam/discovery/active-directory.md)
>
> Scan an Active Directory environment for domain and local Windows accounts.

> [card] [Linux/Unix](https://infisical.com/docs/documentation/platform/pam/discovery/unix.md)
>
> Scan Linux and Unix hosts over SSH for local accounts and import them into PAM.

> [card] [PostgreSQL](https://infisical.com/docs/documentation/platform/pam/discovery/postgres.md)
>
> Scan PostgreSQL instances for login roles and import them into PAM.

> [card] [Microsoft SQL Server](https://infisical.com/docs/documentation/platform/pam/discovery/mssql.md)
>
> Scan Microsoft SQL Server instances for SQL logins and import them into PAM.

## How discovery works

1. You create a discovery source, which names the systems to scan, the PAM accounts to sign in with, and the [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) to connect through
2. Infisical scans the source on demand or on a schedule, and adds the accounts it finds to the source's staged accounts
3. You select the staged accounts to import, and pick a [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md) and an [account template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md) for them
4. Infisical creates a PAM account for each staged account you imported

Discovery finds each account's username but not its password, so you can't use an imported account until it has a credential. You can enter the credential on each account after the import. If the account type supports [credential rotation](https://infisical.com/docs/documentation/platform/pam/credential-rotation/overview.md), you can instead have Infisical set a new password on the account during the import.

## Staged accounts

A staged account is an account that a scan found and that you haven't imported yet. To see a source's staged accounts, go to **Privileged Access Management** > **Discovery**, select the source, and open its **Staged Accounts** tab.

When you scan a source again, Infisical updates its staged accounts instead of adding duplicates, and doesn't stage an account you already imported. If a scan no longer finds a staged account, Infisical removes it, except on [Unix sources](#unix-sources).

## Stale accounts

If a scan no longer finds an account that you imported, Infisical lists the account on the source's **Stale Accounts** tab and marks it as stale on the **Accounts** page. A stale account keeps working, including sessions and rotation. Check whether the account still exists on the target, and delete the PAM account if it doesn't.

For Windows, PostgreSQL, and Microsoft SQL Server sources, Infisical only removes staged accounts and marks accounts as stale on hosts that the scan reached, so an unreachable host doesn't change its accounts.

### Unix sources

Unix sources never remove staged accounts or mark imported accounts as stale. If you delete a user from a Unix host, its staged account and its PAM account stay as they were. Check the host itself before you treat an account from a Unix source as current.

## Scan schedules

Each source has a **Scan Schedule**:

| Schedule | When Infisical scans the source |
| - | - |
| **Manual** | Only when you select **Scan Now** |
| **Daily** | Once a day |
| **Weekly** | Once a week |

Infisical checks once a day for sources that are due. A scheduled source scans at the first check after its interval has passed since its last scan.

The source's **Runs** tab shows each scan's start time, status, and result.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.