Real-Time Sessions

Watch what someone is doing on a resource right now, in real time, as it happens.

What This Does

When someone connects to a server, database, or web app through PAM, an admin with the right permission can open that same session and watch it live - like watching someone's screen over a video call.

This is different from Session Recording, which saves a session so you can watch it back later. Live Streaming is only for watching a session while it is actually happening. Session Recording has its own separate handbook page: Session Recording.

Live Streaming is useful for real-time oversight - keeping an eye on a sensitive session while it is in progress and stepping in immediately if something looks wrong.

Important: There is no single master switch that turns live streaming on for everything. Live streaming of your actual resources (Servers, Databases, RDP/VNC, and Web Apps) is controlled per policy and is on by default. A separate setting in Product Settings only controls live streaming of the PAM dashboard itself, not your resources. Do not mix the two up. Both are covered below.

Step 1: Check Live Streaming for Each Resource Type

Each policy - the rules that control access to your Servers, Databases, RDP/VNC connections, and Web Apps - has its own live-streaming switch, and it is turned on by default.

You do not need to change anything unless you want to turn live streaming off for a specific policy or confirm that it is enabled.

Go to Policy in the side menu and open the policy for the resource type you want (Server/SSH, RDP/VNC, Database, or Web Apps).

Privileged Access Management Admin Handbook: Navigate to Policy and open a resource type

In the General section, check the Livestream toggle. This setting decides whether admins can watch sessions under this policy live.

Privileged Access Management Admin Handbook: Livestream toggle in the General section of a resource policy

Note: Don't confuse this with Session Share. Session Share is a different feature - it lets two people jointly view or control the same session, with both actively participating in it. Live Streaming is for an admin to quietly watch someone else's session without joining it. Web App policies do not have a Session Share option.

Step 2 (Separate, Optional): Live-Stream Activity Inside the PAM Dashboard Itself

PAM can also let an admin watch, live, what someone else is doing while browsing the PAM dashboard website itself. This is separate from anything they do on an actual resource.

Go to Settings >> Product Settings, then open the Dashboard tab.
Turn on Enable User Live Stream under the Live Streaming heading.

Privileged Access Management Admin Handbook: Enable User Live Stream in Product Settings

Turning this on only affects live streaming of PAM dashboard browsing activity. It has no effect on whether your Servers, Databases, RDP/VNC connections, or Web Apps can be watched live. That is entirely controlled by each policy's Livestream setting in Step 1.

Step 3 (Optional): Notify Users They Are Being Watched

Go to Settings >> Product Settings, then open the Resources tab.

Privileged Access Management Admin Handbook: Click the Resources tab in Product Settings

Turn on Enable Live Stream Notification.

Privileged Access Management Admin Handbook: Turn on Enable Live Stream Notification

When this is enabled, the end user is notified when an admin is watching their session live. Leave it off if you do not want the user to receive this notification.

Watching a Session Live

Real-Time Sessions is available in a different part of PAM called the Audit Dashboard, not the main dashboard. In the top navigation bar, click Switch to Audit Dashboard.

Privileged Access Management Admin Handbook: Switch to Audit Dashboard

In the side menu, go to Sessions >> Real-Time Sessions.
You will see a list of everyone currently connected, with columns for User, Type, and Resource Name.
Click View on any row to watch that session as it happens in a new tab.

Privileged Access Management Admin Handbook: Real-Time Sessions list with User, Type, Resource Name, and View

Note: During an RDP, VNC, or SSH session, PAM automatically places the viewer's email and connection details on the screen as a watermark, whether or not you enabled the notification in Step 3. This happens automatically and cannot be turned off. It helps trace any screenshot or photo of the screen back to the person who was watching.

Ending Someone's Session

If you have the required permission, a Terminate option appears on each row in Real-Time Sessions. Clicking it immediately disconnects that session.

Privileged Access Management Admin Handbook: Click the Terminate button

You cannot terminate your own session this way.
You cannot terminate a more senior admin's session. For example, a regular admin cannot terminate a SuperAdmin's session.
If the session is someone's PAM dashboard login itself, rather than a resource session, you will instead see an option to lock that user's account as an alternative to simply closing their session.

Who Can Do What

Permission	What it allows
Audit Dashboard	Required for the Switch to Audit Dashboard button to appear in the top navigation bar.
Live Session	Required to see the Sessions menu, including Real-Time Sessions.
Enable/Disable Live Streaming	Required to change the Dashboard activity live-streaming setting in Product Settings (Step 2).
Enable/Disable Live Stream Notifier	Required to change the end-user live-stream notification setting.
Kill Session	Required to see the Terminate option in Real-Time Sessions.

Good to Know

There is no way to exempt a specific person or role from being watched. If live streaming is enabled for a resource policy, it applies to everyone who uses that policy.
Watching a session live does not automatically save a recording of it. A recording is saved only if Session Recording is separately enabled for the same resource.

Contents