Configure Privileged Access Manager settings

Console

1. Go to the Privileged Access Managerpage.

   Go to Privileged Access Manager

2. Select the organization, folder, or project.

3. Click the Settingstab.

4. In the Notificationssection, Inherit from parentis selected by default.

   The following table shows the default notification preferences:

   Event	Admin	Requester	Approver
   Entitlement assigned	-	✓	-
   Grant requires approval	-	-	✓
   Grants are activated	✓	✓	-
   Grants are denied	-	✓	-
   Grants are expired	-	✓	-
   Grants have ended	✓	✓	-
   Grants are revoked	-	✓	-
   Grants are externally modified	✓	✓	-
   Grants activation failed	✓	✓	-

5. To override settings inheritance from the parent, turn on the Send notifications for the following eventstoggle.

6. To disable notifications for the required PAM event and persona, clear the corresponding checkboxes, and click Save.

7. To disable all the notifications, clear Send notifications for the following events, and click Save.

gcloud

The gcloud alpha pam settings update command configures additional Privileged Access Manager.

Before using any of the command data below, make the following replacements:

• RESOURCE_TYPE : Optional. The resource type that you want to update the settings for. Use the value organization , folder , or project .
• RESOURCE_ID : Used with RESOURCE_TYPE . The ID of the Google Cloud project, folder, or organization that you want to manage entitlements for. Project IDs are alphanumeric strings, like my-project . Folder and organization IDs are numeric, like 123456789012 .
• NOTIFICATION_MODE : In the emailNotificationSettings field, use ENABLED to send notification emails for the event, or DISABLED to prevent them.
  • If you specify the emailNotificationSettings field with a value, then that setting is applied to your resource.
  • If you specify the emailNotificationSettings field but leave it empty, then the default settings are applied to your resource.
  • If you don't specify the emailNotificationSettings field at all, then your resource inherits the settings from the parent resource.
• request.json : A file containing the modified settings. To create this file, get the existing settings, save the response in file named request.json , and then modify it to use as the body of your update request. You must include the ETAG in the body to update the latest version of the settings.

Save the following content in a file called filename.yaml :

 emailNo 
 t 
 i 
 f 
 ica 
 t 
 io 
 n 
 Se 
 tt 
 i 
 n 
 gs 
 : 
  
 cus 
 t 
 omNo 
 t 
 i 
 f 
 ica 
 t 
 io 
 n 
 Behavior 
 : 
  
 admi 
 n 
 No 
 t 
 i 
 f 
 ica 
 t 
 io 
 ns 
 : 
  
 gra 
 nt 
 Ac 
 t 
 iva 
 te 
 d 
 : 
  
  NOTIFICATION_MODE_ 
 1 
 
  
 gra 
 nt 
 Ac 
 t 
 iva 
 t 
 io 
 n 
 Failed 
 : 
  
 DISABLED 
  
 gra 
 nt 
 E 
 n 
 ded 
 : 
  
 ENABLED 
  
 gra 
 nt 
 Ex 
 ternall 
 yModi 
 f 
 ied 
 : 
  
 ENABLED 
  
 approverNo 
 t 
 i 
 f 
 ica 
 t 
 io 
 ns 
 : 
  
 pe 
 n 
 di 
 n 
 gApproval 
 : 
  
  NOTIFICATION_MODE_ 
 2 
 
  
 reques 
 ter 
 No 
 t 
 i 
 f 
 ica 
 t 
 io 
 ns 
 : 
  
 e 
 nt 
 i 
 tle 
 me 
 nt 
 Assig 
 ne 
 d 
 : 
  
 ENABLED 
  
 gra 
 nt 
 Ac 
 t 
 iva 
 te 
 d 
 : 
  
 ENABLED 
  
 gra 
 nt 
 Expired 
 : 
  
  NOTIFICATION_MODE_ 
 3 
 
  
 gra 
 nt 
 Revoked 
 : 
  
 ENABLED 
 e 
 ta 
 g 
 : 
 ' 
 "ZjlkNWZlMWUtNDlhYS00YjJjAYlzNWYtZWFkNGVjOWU3NWMkBwYRsottW5Md" 
 ' 
 na 
 me 
 : 
  
  RESOURCE_TYPE 
 
/ RESOURCE_ID 
/loca t 
 io 
 ns 
 /global/se 
 tt 
 i 
 n 
 gs 
 serviceAccou 
 nt 
 ApproverSe 
 tt 
 i 
 n 
 gs 
 : 
  
 e 
 na 
 bled 
 : 
  
  SA_AS_APPROVER 
 

Execute the following command:

gcloud  
alpha  
pam  
settings  
update  
 \ 
  
--location = 
global  
 \ 
  
-- RESOURCE_TYPE 
 = 
 RESOURCE_ID 
  
 \ 
  
--settings-file  
 FILENAME 
.yaml

gcloud  
alpha  
pam  
settings  
update  
 ` 
  
--location = 
global  
 ` 
  
-- RESOURCE_TYPE 
 = 
 RESOURCE_ID 
  
 ` 
  
--settings-file  
 FILENAME 
.yaml

gcloud  
alpha  
pam  
settings  
update  
^  
--location = 
global  
^  
-- RESOURCE_TYPE 
 = 
 RESOURCE_ID 
  
^  
--settings-file  
 FILENAME 
.yaml

You should receive a response similar to the following:

Parsed [location] resource: RESOURCE_TYPE 
/ RESOURCE_ID 
/locations/global
Request issued for: [global]
Updated location [global].
createTime: '2025-05-18T10:10:10.101010101Z'
emailNotificationSettings:
  customNotificationBehavior:
    adminNotifications:
      grantActivated: ENABLED
      grantActivationFailed: DISABLED
      grantEnded: ENABLED
      grantExternallyModified: ENABLED
    approverNotifications:
      pendingApproval: ENABLED
    requesterNotifications:
      entitlementAssigned: ENABLED
      grantActivated: ENABLED
      grantExpired: ENABLED
      grantRevoked: ENABLED
etag: "ZjlkNWZlMWUtNDlhYS00YjJjAYlzNWYtZWFkNGVjOWU3NWMkBwYRsottW5Md1"
name: RESOURCE_TYPE 
/ RESOURCE_ID 
/locations/global/settings
serviceAccountApproverSettings:
  enabled: true
updateTime: '2025-05-18T10:10:40.101010101Z'

REST

The Privileged Access Manager API's updateSettings method configures additional Privileged Access Manager.

Before using any of the request data, make the following replacements:

• SCOPE : The organization, folder, or project that you want to update the settings for, in the format of organizations/ ORGANIZATION_ID , folders/ FOLDER_ID , or projects/ PROJECT_ID . Project IDs are alphanumeric strings, like my-project . Folder and organization IDs are numeric, like 123456789012 .
• UPDATED_FIELDS : A comma-separated list of fields that need to be updated in the settings. For example, emailNotificationSettings,serviceAccountApproverSettings .

  To update all fields that can be modified, set the update mask to * .

• NOTIFICATION_MODE : In the emailNotificationSettings field, use ENABLED to send notification emails for the event or DISABLED to prevent them.
  • If you specify the emailNotificationSettings field with a value, then that setting is applied to your resource.
  • If you specify the emailNotificationSettings field but leave it empty, then the default settings are applied to your resource.
  • If you don't specify the emailNotificationSettings field at all, then your resource inherits the settings from the parent resource.
• request.json : A file containing the modified settings. To create this file, get the existing settings, save the response in file named request.json , and then modify it to use as the body of your update request. You must include the ETAG in the body to update the latest version of the settings.

HTTP method and URL:

PATCH https://privilegedaccessmanager.googleapis.com/v1beta/ SCOPE 
/locations/global/settings?updateMask= UPDATED_FIELDS 

Request JSON body:

{
  "emailNotificationSettings": {
    "customNotificationBehavior": {
      "adminNotifications": {
        "grantActivated": " NOTIFICATION_MODE_1 
",
        "grantActivationFailed": "DISABLED",
        "grantEnded": "ENABLED",
        "grantExternallyModified": "ENABLED"
      },
      "approverNotifications": {
        "pendingApproval": " NOTIFICATION_MODE_2 
"
      },
      "requesterNotifications": {
        "entitlementAssigned": "ENABLED",
        "grantActivated": "ENABLED",
        "grantExpired": " NOTIFICATION_MODE_3 
",
        "grantRevoked": "ENABLED"
      }
    }
  },
  "etag": "\"ZjlkNWZlMWUtNDlhYS00YjJjAYlzNWYtZWFkNGVjOWU3NWMkBwYRsottW5Md\"",
  "name": " SCOPE 
/locations/global/settings",
  "serviceAccountApproverSettings": {
    "enabled": SA_AS_APPROVER 
}
}

To send your request, expand one of these options:

curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://privilegedaccessmanager.googleapis.com/v1beta/ SCOPE 
/locations/global/settings?updateMask= UPDATED_FIELDS 
"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
-Method PATCH `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://privilegedaccessmanager.googleapis.com/v1beta/ SCOPE 
/locations/global/settings?updateMask= UPDATED_FIELDS 
" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "name": " SCOPE 
/locations/global/operations/ OPERATION_ID 
",
  "metadata": {
    "@type": "type.googleapis.com/google.cloud.privilegedaccessmanager.v1beta.OperationMetadata",
    "createTime": "2024-03-25T01:55:02.544562950Z",
    "target": " SCOPE 
/locations/global/settings",
    "verb": "update",
    "requestedCancellation": false,
    "apiVersion": "v1beta"
  },
  "done": false
}

To check on the progress of an update operation, you can send a GET request to the following endpoint:

https://privilegedaccessmanager.googleapis.com/v1beta/ SCOPE 
/locations/global/operations/ OPERATION_ID 

Send a GET request to the following endpoint to list all operations:

https://privilegedaccessmanager.googleapis.com/v1beta/ SCOPE 
/locations/global/operations