What does PAM stand for?
PAM stands for Privileged Access Management. Privileged access management: controls for admin accounts, such as vaulting credentials, just-in-time access, session recording and approval workflows.
PAM covers the controls around accounts with elevated rights: administrators, service accounts, root. A PAM system stores those credentials in a vault, hands them out for a limited time on request, changes them automatically after use and records what was done in the session. The goal is that nobody holds powerful access permanently, and that every use of it has an owner and a record.
PAM in practice: an example
A database administrator needs to restart a production server. He requests access in the PAM portal with a ticket number, a manager approves, and he receives a connection that is recorded and ends after one hour. He never sees the server's administrator password, which the system changes when the session closes.
What PAM is confused with
PAM vs IAM: what is the difference?
IAM manages every identity and its ordinary access. PAM is the stricter layer for the small number of accounts that can change systems or read everything. What IAM stands for
PAM vs PIM: what is the difference?
Privileged identity management usually refers to controlling who may activate a privileged role and for how long. PAM also covers the vault, the session and its recording. Vendors use the two terms differently.
Which exams cover PAM?
PAM is on the official CompTIA acronym list for two of the four exams covered here.
- CySA+ CS0-004: 1.1 (Security Operations).
- A+ 220-1201 and 220-1202: 220-1202 2.0 (Security).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A company wants administrator rights to be granted only when needed and removed automatically afterwards. Which PAM feature is this?
- Just-in-time access
- Password hints
- Single sign-on
- Disk quotas
Show the answer
A. Just-in-time access. Just-in-time access gives the privilege for a limited period on request, so no account holds it permanently.
2. Which is a direct benefit of storing administrator passwords in a PAM vault?
- Administrators can share one password by email
- Passwords can be rotated automatically and each use can be attributed to a person
- Servers no longer need patches
- Users can skip multifactor authentication
Show the answer
B. Passwords can be rotated automatically and each use can be attributed to a person. The vault releases a credential to a named person and can change it afterwards, which gives accountability and limits the value of a stolen password.
Sources: NIST glossary: privileged access management; Microsoft Learn: Securing privileged access: enterprise access model; Microsoft Learn: What is Microsoft Entra Privileged Identity Management?. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.