Centrify and Delinea Server Suite zones to modern server identity
Cohash modernizes Centrify and Delinea Server Suite estates. We export zones, UID and GID maps, roles and dzdo rights, then decide per server group whether to connect Server Suite to the Delinea Platform in place, move cloud-first hosts to the Platform Agent, or join them natively to Active Directory or Entra ID with sudo rules. Servers move in waves with login and elevation tested first.
- 01Zone export and analysis
- 02ID rationalization
- 03Target per server group
- 04Rights rebuild
- 05Pilot and waves
The story
Told without the client's name or anything that could identify them.
A financial services firm's Unix and Windows engineering team had Centrify zones designed long before anyone on the team arrived. Child zones nobody could explain, UID and GID overrides that broke file ownership whenever a server moved, and dzdo roles that had grown one ticket at a time were all still in use. Cloud-built Linux hosts didn't fit the domain-joined model, and the Server Suite session audit fed SOX evidence. We exported zones, roles, dzdo rights and ID profiles, agreed one UID and GID per person and group, and chose a target per server group: Server Suite connected in place to the Delinea Platform, or native directory join with sudo rules as code. Servers moved in waves by application owner, with login, elevation, cron jobs and service accounts tested in a pilot first.
why it was urgentIn August 2026 Delinea published guidance for Server Suite customers moving to the Delinea Platform, with deployments connected in place. Its newer Platform Agent doesn't join an Active Directory domain, but it is still in private preview and isn't offered in FedRAMP tenants. Delinea hasn't published an end-of-life date for Server Suite.
- openSomeone designed the zone hierarchy a decade ago. Nobody can tell you now what the child zones are for.
- recurringZones don't agree on UID and GID overrides, so file ownership breaks whenever a server moves.
- blockeddzdo role definitions grew one ticket at a time and nobody reviews them.
- openCloud-built Linux hosts don't fit the domain-joined zone model at all.
The estate, before and after
Before: tangled Centrify zones on every server
Servers joined Active Directory through Centrify zones with per-zone UID and GID overrides and dzdo roles. Cloud-built Linux hosts fell outside the model and were managed separately.
Read the diagram as text
- Active Directory → Centrify zones: identities
- Centrify zones → Linux servers: UID · GID map
- Centrify zones → Windows servers: computer roles
- dzdo roles → Linux servers: elevation
- Linux servers → NFS shares: file access
- Cloud-built Linux hosts → NFS shares: mismatched UIDs
After: one ID map and elevation rules as code
Each server group follows a model we decided up front. It's either Server Suite connected to the Delinea Platform, or a native directory join with sudo rules. One UID and GID per identity keeps file ownership stable. Elevation policies live in version control.
Read the diagram as text
- Active Directory → Connected Server Suite hosts: identities
- Entra ID → Natively joined hosts: directory join
- Delinea Platform → Connected Server Suite hosts: elevation policy
- Sudo rules as code → Natively joined hosts: sudo rules
- Connected Server Suite hosts → NFS shares: file access
- Natively joined hosts → NFS shares: file access
- Connected Server Suite hosts → Session recordings: session records
- Delinea Platform → Session recordings: audit data
How we run it, phase by phase.
5 phases take you from Centrify / Delinea Server Suite zones to Delinea Platform server PAM or native directory join. Each one ends with something you can check before the next starts. As you scroll, the blocks show the estate moving across.
- phase 01
Zone export and analysis
We export zones, computer roles, role assignments, dzdo command rights, PAM access rules and UID and GID profiles. Then we go looking for duplicate IDs, orphaned roles and servers that don't exist any more but are still listed.
- phase 02
ID rationalization
Agree one UID and GID per person and group, and map where overrides exist. Plan file ownership fixes on NFS shares and local disks before any server changes model.
- phase 03
Target per server group
We decide group by group. Keeping Server Suite and connecting it to the Delinea Platform is one option. Cloud-first Windows and Linux hosts can go to the Platform Agent once you can get it, and anything else can join natively with standard sudo rules.
- phase 04
Rights rebuild
We rewrite dzdo rights as platform elevation policies or sudo rules kept as code, and turn on MFA for elevation wherever the target supports it. Rights that went unused during the review period don't make the trip.
- phase 05
Pilot and waves
Move a pilot group, test login, elevation, cron jobs and service accounts, then migrate by application owner. Remove the old agent only after each wave signs off.
What the client got
What changed for the client once the work was done. Described, not scored: we don't publish client figures.
- result 01
One UID and GID per person and group
Before a single server changed model, we mapped every conflicting override and fixed ownership on NFS shares and local disks. Now a move doesn't cost anyone access to their files or jobs.
- result 02
Elevation rights are code that gets reviewed
We rewrote dzdo rights as platform elevation policies or sudo rules, kept in version control. Elevation needs MFA where the target supports it. Rights nobody used during the review period were dropped.
- result 03
Each server group has a decided target
Every group is recorded as connected Server Suite, native directory join or a later Platform Agent move, with a fallback where the plan relied on a preview feature.
- result 04
Session audit evidence kept flowing
The replacement model kept turning out session records for auditors from the first wave on, so there was no gap in SOX or PCI evidence.
- result 05
Service accounts were found before they failed
In each wave we listed and tested the zone-mapped AD accounts applications use, and the cron jobs, before the old agent came off.
Risks we plan for
-
File ownership breaks
A changed UID means a user locked out of their own files and jobs that fail. We fix ID mapping first, before touching agents.
-
Service accounts in zones
Applications often run as zone-mapped AD accounts. Each one is found and tested, or a batch job fails on its first night.
-
Preview features in the plan
The Platform Agent is private preview today. A design that depends on it needs a fallback and a check with Delinea before the date is fixed.
-
Auditors expect session records
Server Suite is often where the SOX or PCI session audit evidence comes from. Whatever replaces it has to keep producing that evidence from day one.
Where AI helps, and where it needs guardrails
Delinea's August 2026 guidance lets Server Suite audit run on the platform, where Iris AI summaries flag risky moments in recordings. We check those summaries against recordings your team has already been through. When an AI agent runs commands on servers, we give it its own identity and least-privilege elevation rules instead of someone's dzdo role. We record its sessions the way we'd record any admin's.
forward deployed engineers →What you're left with
We write these for your setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
- document01
Zone, role and UID/GID export with conflicts flagged
yours to keep - inventory02
ID mapping plan with file ownership fixes per share
yours to keep - design03
Target model decision per server group
yours to keep - guide04
Elevation policies or sudo rules in version control
yours to keep - tests05
Wave plan with login, elevation and job tests per application
yours to keep
Platforms and services on this move
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
01Is Server Suite being retired?
None that we found, as of 20 October 2026. But Delinea is steering customers to the Delinea Platform, so get the support commitment from your account team in writing before you plan a long stay.
02Can we drop Active Directory for Linux login?
On some hosts. The Platform Agent from Delinea skips the domain join, but it's still private preview. Native options put Linux directly into Active Directory instead. It comes down to where the servers run and what evidence your auditors expect.
03How long does a zone cleanup take?
That depends on how many zones you have, how many UID overrides exist, and how many applications run under zone-mapped accounts. We'll know by the end of the first phase, from the export and the ID analysis.
Often on the same roadmap
On-premises Active Directory to cloud-first Microsoft Entra ID
We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.
read the case studyAD FS federation to Entra ID authentication
Converting federated domains from AD FS to Entra ID cloud authentication, moving relying parties app by app and retiring the AD FS farm.
read the case studyAuth0 Rules and Hooks to Actions before end of life
Rewriting Auth0 Rules and Hooks as Actions before their 18 November 2026 end of life, with token claims compared before and after each change.
read the case study810e959e - 01Delinea blog: Why Server Suite customers are moving to the Delinea Platform (Aug 2026)delinea.com ↗
- 02Delinea docs: Privilege Control for Servers with Platform Agent (private preview)docs.delinea.com ↗
Planning this move?
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it