# privileged-remote-access

Source: https://startwithidentity.com/glossary/privileged-remote-access/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

Privileged remote access (PRA) is the brokering of administrative sessions to servers, network devices, databases and OT systems for remote employees, vendors and contractors through a gateway that authenticates the user, injects or hides the credential, limits the session to named systems and records it, without giving the user a VPN connection to the network. It is a component of [PAM](https://startwithidentity.com/glossary/pam/), sold separately by some vendors.

| | VPN | [ZTNA](https://startwithidentity.com/glossary/ztna/) | Privileged remote access |
|---|---|---|---|
| What the user reaches | A network segment | Specific applications | Specific privileged sessions (SSH, RDP, database, web console) |
| Credential handling | User holds their own | User holds their own | Vaulted credential injected; the user never sees it |
| [Session recording](https://startwithidentity.com/glossary/session-recording/) | No | Usually logs, not recordings | Yes, a core feature |
| Approval and time limits | Rare | Policy-based | Per-session approval, [just-in-time](https://startwithidentity.com/glossary/jit-access/) windows |

The pattern grew out of vendor and remote-support access, which is still the strongest use case: a third-party engineer needs two hours on one controller, not standing VPN access. [BeyondTrust](https://startwithidentity.com/vendors/pam/beyondtrust/), whose roots are in remote support, is the PAM vendor most associated with the category, and it covers employee and third-party sessions alongside password and session management; infrastructure access tools such as [Teleport](https://startwithidentity.com/vendors/pam/teleport/) and [StrongDM](https://startwithidentity.com/vendors/pam/strongdm/) (acquired by Delinea in March 2026) apply the same model to engineers. [Teleport's documentation](https://goteleport.com/docs/reference/architecture/session-recording/), for instance, records full terminal output for SSH and screen activity for remote desktop.

It matters because remote access tools are a favored entry point: a vendor account with a VPN and a shared password is standing privilege held by someone outside your directory. PRA replaces that with an identity-bound, time-boxed, recorded session. The tools themselves are targets too: pre-authentication command injection in BeyondTrust Remote Support ([CVE-2026-1731](https://startwithidentity.com/cves/cve-2026-1731/)), technician-to-admin escalation in SimpleHelp ([CVE-2024-57726](https://startwithidentity.com/cves/cve-2024-57726/)), an authentication bypass in N-able N-central ([CVE-2026-18556](https://startwithidentity.com/cves/cve-2026-18556/)), unconfirmed file execution through ScreenConnect sessions ([CVE-2026-84869](https://startwithidentity.com/cves/cve-2026-84869/)) and a password-free login to macOS Screen Sharing ([CVE-2026-65400](https://startwithidentity.com/cves/cve-2026-65400/)) are all in CISA's Known Exploited Vulnerabilities catalog, as is an Ivanti Endpoint Manager bypass that exposed stored credential data ([CVE-2026-1603](https://startwithidentity.com/cves/cve-2026-1603/)). Keep the remote access server itself patched and off the open internet where you can. Check that vendor users authenticate with phishing-resistant MFA, ideally federated from their own employer, and that sessions end when the approval window closes.

See also: [third-party access management practices](https://startwithidentity.com/articles/third-party-access-management-practices/), [privileged access workstation](https://startwithidentity.com/glossary/privileged-access-workstation/), [standing privilege](https://startwithidentity.com/glossary/standing-privilege/), [best PAM tools](https://startwithidentity.com/rankings/best-pam-tools/), [what is PAM](https://startwithidentity.com/guides/fundamentals/what-is-pam/)