Security & Access Paid advanced
API Token Manager
Create, rotate, and revoke service and user API tokens with scoped permissions.
Security & Access Control
RBAC, multi-tenancy, SSO, 2FA, audit logging and compliance checks.
Security is built into every layer. Users can authenticate through local credentials, LDAP or OIDC, and enforce TOTP or FIDO2 second factors. Fine-grained RBAC, multi-tenancy and VM-level ACLs keep teams isolated, while the RBAC explorer makes it easy to review and audit who can do what.
All sensitive database fields are encrypted at rest with Fernet, and audit logs are HMAC-signed so tampering is detectable. A built-in IDS/IPS watches monitored segments with signature and anomaly detection, alerting and applying response policies when traffic looks hostile. The client portal and tenant isolation features make ProxmoxVEx ready for MSP and hosting environments.
Capabilities
Protect your platform with role-based access control, multi-tenancy, LDAP and OIDC single sign-on, TOTP and WebAuthn/FIDO2, API tokens
- ✓Role-based access control with custom roles
- ✓LDAP and OIDC integration
- ✓TOTP and WebAuthn/FIDO2 MFA
- ✓API tokens with scoped permissions
- ✓Tamper-evident HMAC-signed audit logs
- ✓IDS/IPS with signatures, anomaly detection and response policies
- ✓Tenant isolation, client portal and RBAC explorer
Related plugins
Plugins that extend this capability.
Security & Access Paid advanced
Enhanced Audit Search
Full-text, date-range, and user-filtered search over the tamper-evident audit log.
Network & Security Paid advanced
Certificate Manager
Request, renew, deploy and track certificate expiry.
Access & Portal Free basic
Client Portal
Self-service portal for hosting customers. Clients see only their assigned VMs.
Network & Security Paid advanced
DNS Sync
Sync DNS zones and records with cluster VM hostnames.
Network & Security Paid advanced
Firewall Rule Manager
Manage firewall rule entries for clusters and networks.
Security Paid corporate
IDS / IPS
Intrusion Detection and Prevention System: monitored segments, signatures, anomaly detection, alerts, and response policies.
Network & Security Free basic
IPAM Manager
Manage subnets and IP reservations.
Network & Security Paid advanced
Network Topology Map
Build and refresh network topology graphs for clusters.
Network & Security Paid advanced
OPNsense Manager
OPNsense firewall management: multi-host status dashboard, interfaces, VPNs, NAT, DNS, gateways, and firewall rules.
Security Free basic
RBAC Explorer
Explore roles, users, tenants, and permissions across the system.
Network & Security Paid advanced
SDN Controller
Manage SDN zones and VNets and apply them to clusters.
Security & Access Free basic
Tenant Isolation
Enforce resource, network, and permission boundaries between tenants.
Network & Security Paid advanced
VLAN Provisioner
Define, validate, apply, and audit VLANs across clusters.
Security & Access Free basic
VM Tag Enforcer
Enforce and remediate VM tag compliance rules.
Network & Security Paid advanced
VPN Access Portal
Manage VPN clients and generate configuration bundles.