Breadcrumbs

Shared vault items

A provider can make a vault item of its main tenant usable inside a customer tenant without copying the secret. The tenant gets a read-only vault item with the same name; every use reads the secret from the main tenant at that moment, so a password rotated by the provider is current in every tenant at once.

Applies to

Who can do this

Monopam v2026.10

Super administrators of the main tenant or users with monopam.federation.full.

Share a vault item

  1. Open the vault item in the main tenant and choose Share to Tenants from its menu, or open System → Tenants → tenant → Shared Vault Items and click Share Vault Item.

  2. Choose the Tenant.

  3. Choose the Use (1). Off (the default, Sessions only): the vault item opens sessions, but its secret is not shown, not returned by the vault API and not placed into scripts. On (Sessions and reveal): the tenant's own vault policies decide who may reveal it.

  4. Set Share ends (2) or keep No end date, add a reason and click Save.

    Share Vault Item dialog with tenant, use mode, end date and reason

    Figure 1. Sharing a provider vault item with a customer tenant.

In the customer tenant

  • The vault item appears in the tenant's default space marked Shared from provider, without a Save button.

  • The tenant assigns it to its resources, spaces and policies like any other vault item.

  • The user name stays visible to users who may see the vault item; the secret follows the use mode.

  • Nothing secret is stored in the tenant, whether the tenant uses the installation database, its own database or its own installation.

Change or end a share

  • Suspend and Resume: a suspended share makes the tenant's vault item read as nothing at once; new sessions that use it are refused.

  • Revoke removes the vault item from the tenant together with its resource and policy assignments. Sharing it again creates a new vault item that must be assigned again.

  • Rotation, password history, expiry and reconcile run only on the main tenant's vault item.

  • Each use is audited on the main tenant (at most one entry a minute per share); arrival and removal are audited on the tenant.

Limits

  • Personal vault items, vault items that are themselves shared, and the types OTP, Single Sign-On, Ephemeral, Pool and Kubernetes Token cannot be shared.

  • Sharing works from the main tenant only, never from one customer tenant to another.

  • A tenant that already has a vault item with the same name cannot receive the share.

  • For a remote tenant, shared vault items work only while its link to the provider is up.

Troubleshooting

What you see

Why

What to do

Sessions in the tenant fail with The provider's share of this vault item is suspended or has ended.

The share was suspended, revoked or expired, or the main tenant's database is unreachable.

Check the share's state on the main tenant.

The tenant is not ready yet (no default space); run its seed first.

The tenant's seed has not completed.

Run the seed on the tenant's Overview.

A {{Vault.<name>.Password}} token resolves to empty text in the tenant.

The share is Sessions only.

Share it with Allow the tenant to show and export the secret if the tenant needs the value itself.

  • Service Provider Guide

  • Provider access

  • Vault items

  • Password rotation and reconcile