A Logon Account can be specified in the Master Policy.

The Master Policy in CyberArk Privileged Access Manager (PAM) is designed to enforce high-level, global security and compliance rules across the entire environment. It governs principles such as session recording, dual control, and exclusive access. It does not manage operational or platform-specific configurations.

A Logon Account is an operational component used by the Central Policy Manager (CPM) to connect to a target machine to perform password management tasks (e.g., change, verify). The specification of which Logon Account to use is a configuration detail defined at the Platform level, not within the Master Policy. Each platform is configured with the specific technical details required to manage accounts on that type of target system, including the assignment of Logon and Reconcile accounts.

The statement "True" is incorrect because it confuses the distinct roles of the Master Policy and the Platform. The Master Policy sets the strategic security requirements (the "what"), while the Platform defines the tactical implementation for a specific target type (the "how"), which includes assigning a Logon Account.

1. CyberArk Privileged Access Manager - Self-Hosted Documentation - "Master Policy": This section details the settings available in the Master Policy. The configurable rules include Enforce check-in/check-out exclusive access

Require dual control password access approval

and Enforce session recording and monitoring. The documentation makes no mention of specifying operational accounts like Logon Accounts

as this is outside its scope.

Reference: CyberArk Privileged Access Manager - Self-Hosted Documentation

Version 14.0

"Master Policy

" section "Default Policy Rules."

2. CyberArk Privileged Access Manager - Self-Hosted Documentation - "Platform Management": This documentation explicitly describes how Logon and Reconcile accounts are configured within a specific platform's settings. It shows that these accounts are properties of a platform

which is then applied to managed accounts.

Reference: CyberArk Privileged Access Manager - Self-Hosted Documentation

Version 14.0

"Platforms

" section "Edit a platform

" subsection "Automatic Password Management > Logon Account." This page details the procedure for associating a Logon Account with a platform.