Which CyberArk group does a user need to be part of to view recordings or live monitor sessions?

The built-in 'Auditors' group in CyberArk is specifically designed for users who need to perform audit-related tasks. By default, members of this group are granted the necessary authorizations to view session recordings and monitor live privileged sessions through the Privileged Web Access (PVWA) interface. This aligns with the principle of separation of duties, where the responsibility for reviewing privileged activity is assigned to a dedicated audit role, distinct from administrative or operational roles.

B. Vault Admin: The Vault Admins group is for high-level Vault configuration and management, not for routine session auditing.

C. DR Users: This group's permissions are strictly limited to performing disaster recovery operations on the Vault.

D. Operators: This is a legacy group whose permissions are related to Safe management, not session monitoring or viewing recordings.

1. CyberArk Privileged Access Manager Documentation (Version 14.0): "Built-in users and groups". In the description of the Auditors group

it states

"This group is for users who are responsible for auditing the system. By default

members of this group have authorizations to view recordings and run reports."

2. CyberArk Privileged Access Manager Documentation (Version 14.0): "Monitor and record privileged sessions" > "Monitor active sessions". The documentation specifies the required permissions: "To monitor sessions

you must be a member of the Vault Auditors group or have the relevant permissions in the Safe where the recording is stored." This confirms the Auditors group as the primary entity for this function.

3. CyberArk Privileged Access Manager Documentation (Version 14.0): "Monitor and record privileged sessions" > "View session recordings". This section details the permissions required to access recordings

stating

"By default

the built-in Auditors group has the permissions required to view session recordings."