--- title: "Self-service" slug: "settings-self-service" updated: 2026-11-06T17:41:13Z published: 2026-11-06T17:41:13Z canonical: "docs.senhasegura.io/settings-self-service" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt > Use this file to discover all available pages before exploring further. # Self-service On the **Self-request settings** screen, you can set the rules and permissions for the requests that users make directly in Segura™. More information in [Self-service requests](/v4-2/docs/self-service-about) and [Configure Self-service](/v4-2/docs/self-service-how-to-configure). ## Access path 1. In Segura, on the navigation bar, hover over the **Product Menu** and select **Settings**. 2. In the side menu, select **Access control > Access Self-service > Settings**. ## Self-request Configuration | Item | Type | Required | Description | | --- | --- | --- | --- | | **Active self-request** | Toggle button | Yes | Enables or disables Self-service for all users. When disabled, the **Access Self-service** menu is hidden. | | **Expiration time** | Quantity picker and Dropdown menu | Yes | Selects how long a request can wait for a decision. Enter a whole number from 1 to 100 and select **Minutes**, **Hours**, **Days**, or **Months**. When the period ends, the request expires and can no longer be approved. | ## Request types Each enabled request type appears as a card on the Self-service panel. | Item | Type | Required | Description | | --- | --- | --- | --- | | **Enable roles requests** | Toggle button | Yes | Shows the **Role request** card. Users request roles from the **List of roles available for request**. | | **Enable credential request** | Toggle button | Yes | Shows the **Credential request** card. Users request a new domain credential, which is approved automatically. | | **Enable AD Account Provisioning request** | Toggle button | Yes | Shows the **AD Account Provisioning** card and the **AD Provisioning** fields. Users request a new Active Directory account, which is approved automatically. Disabled by default. | ## Access policy request types Users request membership in an access policy of PAM Core, Cloud IAM, DevOps Secret Manager (DSM), Task Manager, or Certificate Manager. Each product has its own toggle and its own card on the panel. | Item | Type | Required | Description | | --- | --- | --- | --- | | **Enable access policies requests** | Toggle button | Yes | Turns access policy requests on or off for all products. When it is off, the product toggles are turned off and unavailable. Turning it back on does not turn the product toggles on. | | **Enable PAM Core access policies requests** | Toggle button | Yes | Shows the **PAM Core access policy request** card. | | **Enable Cloud IAM access policies requests** | Toggle button | Yes | Shows the **Cloud IAM access policy request** card. | | **Enable DevOps Secret Manager access policies requests** | Toggle button | Yes | Shows the **DevOps Secret Manager access policy request** card. | | **Enable Task Manager access policies requests** | Toggle button | Yes | Shows the **Task Manager access policy request** card. | | **Enable Certificate Manager access policies requests** | Toggle button | Yes | Shows the **Certificate Manager access policy request** card. | | **Enable access policy administration requests** | Toggle button | Yes | Shows the **Access policy administration request** card. Users request administration rights on a PAM Core access policy they are a member of. | | **Enable handover access policy administration requests** | Toggle button | Yes | Shows the **Handover of access policy administration** card. Users transfer their administration rights on a PAM Core access policy to another user. | A product card appears only when its toggle is on and you select at least one of its access policies in **Access policies**. When global approvers decide the request, the card also needs a global approver other than the user who opens the panel. Attention **Enable access policy administration requests** and **Enable handover access policy administration requests** are available only in the static access policy model. In the dynamic model, the settings screen hides them. ## Access policies Defines which access policies users can request. Each product with its toggle on shows a table of its access policies. Select the access policies users can request. The selection is kept when you turn a product toggle off. The table lists only active access policies that do not have **Block During Freezing?** enabled. For PAM Core, it lists the access policies created in the access policy registration. A policy that stops meeting these rules leaves the table and is no longer offered. ## List of roles available for request Defines the roles that users can request with **Role request**. | Item | Type | Required | Description | | --- | --- | --- | --- | | **Add** | Button | No | Opens the **Roles** modal. | | **Roles table** | Table | No | Each role's data includes the fields *Checkbox*, *Role*, *Built-In, and* *Description*. | ## List of global approvers Defines who approves **Role request** requests and access policy requests. In the static access policy model, requests for a PAM Core access policy go to that policy's administrators instead. Also: - Global approvers receive an email for each **AD Account Provisioning** request. - To approve role requests, global approvers need the **Self-service Approver** role. - Without global approvers, the access policy cards they decide do not appear on the panel. The **Global approvers** modal lists the users configured as approvers in [Approvers](/v4-2/docs/approvers). | Item | Type | Required | Description | | --- | --- | --- | --- | | **Add** | Button | No | Opens the **Global approvers** modal. | | **Approvers table** | Table | No | Data for each approver with fields *checkbox*, *ID, Name, Username, Email, Department, and Level*. | ## AD Provisioning Configures the **AD Account Provisioning** request type. These fields appear only when **Enable AD Account Provisioning request** is on. Segura creates the Active Directory account from the **Username mask**. Each entry in the **Variables** table becomes an **Identification** option that the user picks when requesting an account. More information in [Configure AD account provisioning in Self-service](/v4-2/docs/self-service-how-to-configure-ad-account-provisioning). | Item | Type | Required | Description | | --- | --- | --- | --- | | **Credential type** | Dropdown menu | No | Selects the credential type to create. | | **Domain** | Dropdown menu | Yes | Defines the domain of the credential. | | **Target device** | Dropdown menu | Yes | Selects the device where Segura creates the credential. | | **Change plugin** | Dropdown menu | No | Determines the plugin used for password or credential swapping. Required when you select a **Credential creation template**. | | **Credential creation template** | Dropdown menu | No | Selects the default template for credential creation. The template must belong to the selected **Change plugin**. | | **Authentication credential** | Dropdown menu | Yes | Selects the credential that Segura uses to authenticate when it creates the new credential. | | **Username mask** | Text field | Yes | Defines the format of the account username. Use `[#VARIABLE#]` for the value the user picks as **Identification**, and `[#USERNAME#]` for the requester's username. Segura replaces each marker when it creates the account. | | **Add** | Button | No | Adds a new entry to the **Variables** table. | | **Variables** | Table | No | Values for the `[#VARIABLE#]` marker of the username mask. Each variable is offered to the user as an **Identification** option. Variables cannot be empty or repeated. | ## Related topics - [Self-service requests](/v4-2/docs/self-service-about) - [Configure Self-service](/v4-2/docs/self-service-how-to-configure) - [Configure AD account provisioning in Self-service](/v4-2/docs/self-service-how-to-configure-ad-account-provisioning) - [Self-service panel and request screens](/v4-2/docs/self-service-panel-and-requests)