---
title: Configuring Human Privilege
description: "Learn how to set up and customize Human Privilege to suit your organization's requirements."
component: privilege
page_id: privilege:human-privilege:configuration/index
canonical_url: https://docs.pingidentity.com/privilege/human-privilege/configuration/index.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: September 10, 2026
page_aliases: ["configuration:index.adoc"]
section_ids:
  access-cloud-resources-directly: Access cloud resources directly
  access-kubernetes-clusters: Access Kubernetes clusters
  access-on-premise-servers-and-databases: Access on-premise servers and databases
  add-mfa-challenges: Add MFA challenges
---

# Configuring Human Privilege

This section provides guidance for administrators on configuring Human Privilege. Which configuration steps you need depends on the resources your organization uses and how users connect to them. Find your scenario in the following topics, then follow the linked pages in the order shown.

If you're securing AI agent access instead of human access, see [Configuring Agent Privilege](../../agent-privilege/index.html). The multi-factor authentication and User Vault topics in this section also apply to Agent Privilege deployments.

## Access cloud resources directly

Choose this path if your users need just-in-time (JIT) access to cloud resources, such as AWS, Azure, or Google Cloud. No gateway is required.

1. [Onboard an AWS account](cloud-accounts/aws.html)

2. [Onboard an Azure account](cloud-accounts/azure.html)

3. [Onboard a GCP account](cloud-accounts/gcp.html)

## Access Kubernetes clusters

Choose this path if your users need just-in-time access to Kubernetes clusters. Onboard the cloud account first; the Kubernetes setup depends on it.

1. [Onboard the cloud account that hosts the cluster](cloud-accounts/aws.html) (AWS, Azure, or GCP)

2. [Configure AWS EKS access](configuring-kubernetes-access/aws-eks.html)

3. [Configure Azure AKS access](configuring-kubernetes-access/azure-aks.html)

4. [Configure GCP GKE access](configuring-kubernetes-access/gcp-gke.html)

If the cluster is in a private VPC with no inbound internet access, also deploy a gateway or relay. Learn more in [Gateways](gateways/index.html).

## Access on-premise servers and databases

Choose this path if your users need access to resources on a private network, such as on-premise servers, databases, or applications. These resources are reachable only through a gateway, so configure the network infrastructure first.

1. [Deploy gateways](gateways/index.html)

2. [Deploy private relays, if your network doesn't allow inbound connections](gateways/relays.html)

3. [Configure certificate-based SSH access for Linux servers](access-protocols/ssh.html)

4. [Configure RDP access for Windows servers](access-protocols/rdp.html)

5. [Configure database access for discovered databases](cloud-accounts/database-access.html)

## Add MFA challenges

Choose this path if you want to challenge users with multi-factor authentication (MFA) when they connect to PingOne Privilege or escalate privileges.

1. [Require PingID MFA when users connect the PingOne Privilege app](multi-factor-authentication/pingid-mfa-app-connect.html)

2. [Require step-up authentication for `sudo` commands](multi-factor-authentication/step-up-authentication-sudo.html)