功能: SaaS Rotation

Automate rotation of SaaS accounts, secrets and API keys with KeeperPAM®

Run rotations on a schedule or on demand. The Keeper Gateway authenticates to your SaaS applications and updates credentials automatically, storing every change in your Keeper Vault with no scripts to write or maintain for supported applications.

开始免费体验

Keeper vault showing an Okta Administrator PAM user record with password rotation settings and SaaS configuration.

How SaaS rotation works in Keeper

Create a SaaS configuration

Create a SaaS rotation configuration using a built-in, catalog or custom plugin. Administrators can configure rotations through the Keeper Web Vault or Keeper Commander®.

Associate the configuration with a PAM User

Link the SaaS configuration to one or more PAM User records and configure the appropriate rotation settings.

Rotate credentials automatically

Run rotations on a schedule or initiate them on demand. The Keeper Gateway securely authenticates to the SaaS application and updates credentials using the application's supported API.

Securely store and audit every rotation

Updated credentials are automatically stored in the Keeper Vault. Every rotation event is logged for auditing, compliance reporting and SIEM integrations.

Rotation built for the apps your business runs on

Extensible plugin architecture

Rotate credentials through built-in, catalog and custom plugins. Keeper supports official integrations while allowing organizations to extend coverage for proprietary or specialized SaaS platforms.

Keeper Okta SaaS configuration showing editable fields for SaaS type, active status, Okta URL and token.

Scheduled and on-demand rotation

Set credentials to rotate on a recurring schedule or trigger an immediate rotation whenever security policies or events require it. The same configuration supports both automated rotation and ad hoc credential changes.

Keeper password rotation settings showing a daily rotation schedule, Rotate Now button and protected private PEM key.

Centralized management

Manage SaaS rotation configurations from the Keeper Web Vault or Keeper Commander. Configurations are stored as records in your encrypted Keeper Vault, where they can be managed, shared and governed using the same controls applied to other privileged credentials and secrets.

Keeper password rotation settings showing monthly rotation at midnight and 50-character password complexity options.

Gateway-based execution

The Keeper Gateway securely authenticates to supported SaaS applications and performs credential rotations via the application's supported APIs. Administrators never handle rotated credentials directly.

Keeper SaaS password rotation settings showing on-demand rotation, AWS KeeperPAM and Okta configuration with password complexity options.

Flexible rotation controls

Activate, deactivate or remove rotations at any time. Pause a rotation without deleting the configuration, then reactivate it later without rebuilding the integration.

Keeper Password Rotation Settings showing a monthly schedule, midnight rotation time and time zone selection.

Complete audit visibility

Every rotation event is logged to support security operations, auditing and compliance requirements. Export events to your SIEM through Keeper's Advanced Reporting and Alerts Module (ARAM) for centralized monitoring and reporting.

Keeper alert settings showing enabled BreachWatch and policy change alerts with frequencies and counts.

Why use KeeperPAM for SaaS rotation?

One platform for every rotation

SaaS rotation uses the same vault, gateway, access controls and audit trail as the rest of KeeperPAM. Machines, databases, directories and SaaS applications all rotate through a unified platform, with no separate tool to deploy or manage.

零知识设计理念

Built on Keeper's zero-knowledge security architecture, the customer-hosted Keeper Gateway performs credential rotations and encrypts the credentials in the vault, enforcing end-to-end encryption.

Eliminate script maintenance

Built-in and catalog plugins automate the rotation process, reducing the need to build, maintain and troubleshoot custom scripts.

Support compliance requirements

Detailed audit logs and automated credential rotation help organizations support security controls required by frameworks such as NIST, ISO 27001, SOC 2, HIPAA and PCI DSS.

Secure SaaS credentials with automated rotation

开始免费体验

常见问题解答

What is SaaS rotation?

SaaS rotation is the automated process of updating credentials for SaaS applications, including privileged user accounts, service accounts, application secrets and API credentials. Automated rotation reduces the risk associated with long-lived credentials and helps organizations enforce credential management policies.

Which SaaS applications are supported in Keeper?

Keeper supports built-in integrations for Okta, Snowflake, AWS Access Key, Azure Client Secret, Check Point Gaia OS, Cisco IOS XE, Cisco Meraki and REST-based services. Additional catalog plugins cover integrations such as AWS Cognito, Cisco APIC and Oracle Identity Domain User, with more integrations available through the catalog. Organizations can also deploy custom plugins through the Keeper Gateway for proprietary or unsupported applications.

Do I need to write scripts to use Keeper SaaS rotation?

No, for supported SaaS applications, Keeper's plugins handle the rotation process. Administrators simply configure the application and define rotation policies. Organizations can optionally deploy custom plugins for applications not covered by built-in or catalog integrations.

Does Keeper support custom integrations?

Yes, Keeper supports custom SaaS rotation plugins through the Keeper Gateway. Custom plugins allow organizations to automate credential rotation for applications that are not available through Keeper's built-in or catalog plugin libraries.

Can a single Keeper account rotate multiple SaaS systems?

Yes, a single PAM User can be associated with multiple SaaS rotation configurations, allowing credential changes to propagate across several SaaS platforms as part of a unified rotation workflow.