---
title: Secure realms
description: Secure PingAM realms by disabling module-based authentication, configuring strong authentication trees, setting sensible default authentication services, and removing demo accounts before...
component: pingam
version: 7.5
page_id: pingam:security:securing-realms
canonical_url: https://docs.pingidentity.com/pingam/8.1/security/securing-realms.html
llms_txt: https://docs.pingidentity.com/pingam/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
keywords: ["Security", "Setup & Configuration", "Realms", "Authentication"]
page_aliases: ["security-guide:securing-realms.adoc"]
superseded_by: https://docs.pingidentity.com/pingam/8.1/security/securing-realms.html
section_ids:
  demo-user: The demo user
---

# Secure realms

The AM installation process creates the Top Level Realm (`/`), which contains AM default configuration data. This realm cannot be deleted or renamed, since it is the root of the realm hierarchy in AM.

Consider the following list of security best practices related to realms:

* Disable module-based authentication

  Module-based authentication lets users authenticate using the `module=module-name` login parameter, therefore bypassing multi-factor authentication if multiple modules are configured in a chain with the same `authLevel`.

  To disable module-based authentication, go to Realms > *realm name* > Authentication > Settings > Security, and clear the Module Based Authentication check box.

* Create strong authentication trees

  Ensure your users log in to AM using sensible authentication trees, such as trees that enforce multi-factor authentication.

- Configure sensible default authentication services

  By default, users that log in to the console make use of the chain or tree configured in the Organization Authentication Configuration property for the realm. To locate this property, go to Realms > *realm name* > Authentication > Settings > Core.

  Be extra careful when setting your *default* authentication tree or chain.

  If you leave the default authentication service as the `ldapService` chain, users can still post their username and password to the authentication endpoint to retrieve a session, regardless of the services configured for authentication.

  For example, consider a deployment where you disable module-based authentication but retain the default authentication chain, `ldapService`. If you set up two-factor authentication, your users can still access their accounts without performing the correct two-factor authentication chain login sequence by using the default `ldapService` chain.

  When you are ready to go to production, set the default authentication tree or chain to your most secure tree or chain. Don't leave it set to `ldapService`.

  Ensure that you change the default for all realms, including the Top Level Realm.

- Prevent access to the Top Level Realm

  If most of your privileged accounts reside in the Top Level Realm, consider blocking authentication endpoints that allow access to the Top Level Realm.

  Learn more in [Protecting PingAM with PingGateway](https://docs.pingidentity.com/pinggateway/2024.11/gateway-guide/protect-am.html) and [Best practice for blocking the top level realm in a proxy for PingAM](https://support.pingidentity.com/s/article/Best-practice-for-blocking-the-top-level-realm-in-a-proxy-for-PingAM).

## The `demo` user

When you install AM for evaluation, using the embedded DS server, a `demo` user is created. This is a regular account with no administrative permissions and is intended for test and demo purposes. You should remove this user from production environments.

To remove the `demo` account, go to Realms > Top Level Realm > Identities, choose the `demo` account, and click Delete.