CyberArk PAM Import
Use the pam project cyberark-import command to migrate privileged accounts from CyberArk PVWA or Privilege Cloud into KeeperPAM. The command imports CyberArk accounts and safes as KeeperPAM resources
Prerequisites
Keeper Commander is installed and you are logged in.
Your Keeper account has permission to create and manage PAM projects.
You can connect to the CyberArk PVWA API endpoint.
You have CyberArk credentials with permission to read the safes and accounts you want to migrate.
The command prompts for CyberArk credentials when they are not provided through environment variables. For unattended runs, set the appropriate variables before starting Commander:
KEEPER_CYBERARK_ID_TENANT
CyberArk Identity tenant for Privilege Cloud
KEEPER_CYBERARK_USERNAME
CyberArk username or service-account client ID
KEEPER_CYBERARK_PASSWORD
CyberArk password or service-account client secret
KEEPER_CYBERARK_LOGON_TYPE
Self-hosted logon type: CyberArk, LDAP, RADIUS, or Windows
KEEPER_CYBERARK_AUTH_METHOD
Privilege Cloud authentication method, when required
Command syntax
<PVWA_HOST> can be a self-hosted PVWA hostname, such as pvwa.example.com, or a Privilege Cloud tenant, such as mycompany.cyberark.cloud.
Quick start
Preview the import
Run a dry run before changing the vault. Credentials are omitted unless --include-credentials is explicitly supplied.
Review the available safes
Import the selected safes
If --name is omitted, the project name defaults to CyberArk Migration.
Import from Privilege Cloud
Common options
--name, -n
Name of the PAM project.
--config, -c
Extend an existing PAM project by PAM Configuration UID or title.
--gateway, -g
Gateway UID or name for a new project.
--folder-mode
Safe-folder layout: safe (default), ksm, exact, or flat.
--safes
Import only matching safes. Comma-separated names and globs are supported.
--exclude-safes
Exclude matching safes. Comma-separated names and globs are supported.
--list-safes
Display safes with account counts and exit.
--dry-run, -d
Preview the import without changing the vault.
--output, -o
Save the generated import JSON to a file.
--include-credentials
Include passwords in dry-run output or the saved JSON.
--yes, -y
Skip confirmation prompts.
--skip-users
Import resource records without importing pamUser records.
--skip-linked-accounts
Skip linked logon, reconcile, and enable accounts.
--skip-dependents
Skip CyberArk dependent-account service mappings.
--state-filter
Import only accounts with the specified CPM states.
--platform-map
Use a JSON file with custom CyberArk platform mappings.
--no-verify-ssl
Disable certificate verification for self-hosted PVWA. Use only when necessary.
--include-system-safes
Include CyberArk system safes, which are excluded by default.
--strict-policies
Stop the import when a platform rotation policy cannot be read.
Folder layout
The default safe mode creates a Keeper shared folder for each CyberArk safe. This preserves the safe's member permissions and makes it easier to maintain access control after migration.
The imported project contains:
PAM machine and database resources.
PAM users linked to their resources.
Login records for supported website accounts.
Safe-member permissions mapped to Keeper permissions.
Rotation and connection settings from CyberArk policies.
Linked logon and reconcile accounts, when available.
Use --folder-mode exact to preserve the safe hierarchy under the project folders, or --folder-mode flat to place records in the legacy shared-folder layout.
Save the import JSON
To review or archive the generated payload without importing it:
Passwords are redacted by default. Add --include-credentials only when the output file is protected and the credentials are required.
Remove an imported project
Preview the cleanup first:
Remove the project by name or PAM Configuration UID:
Cleanup removes the imported project records and folders, and the gateway and Secrets Manager application associated with the project when they were created by the import.
Troubleshooting
Authentication failed
Confirm the tenant or PVWA hostname and CyberArk credentials. For self-hosted installations, verify KEEPER_CYBERARK_LOGON_TYPE.
No safes or accounts found
Confirm that the CyberArk account can read the target safes and review the output of --list-safes.
SSL certificate error
Install the issuing CA certificate or use --no-verify-ssl only for a trusted internal test environment.
Import is too large or slow
Use --safes, --exclude-safes, --batch-size, and --batch-delay to control the import.
Rotation settings are missing
Check that the CyberArk platform policy is available to the importing account. Use --strict-policies to fail instead of applying the master-policy default.
For command details available in your installed version, run:
Last updated