docs/documentation/platform/pam/discovery/overview.mdx
Discovery scans external systems to find privileged accounts you may not know exist, stages them for review, and lets you import the ones you want into PAM as managed accounts. This gives you visibility into the accounts spread across your environment and a fast path to bringing them under management.
<Note> Discovery is available to **Product Admins**. See [Access Control](/documentation/platform/pam/concepts/access-control) for how roles work. </Note>A staged account is an account that a scan found but that has not been imported yet. Each staged account records its name and type but does not become usable until you import it.
Discovery deduplicates accounts by a stable fingerprint per source. Re-running a scan updates existing staged accounts rather than creating duplicates, and accounts you have already imported are left untouched so they cannot be imported twice.
When you import staged accounts, you choose:
Each source can scan on demand or automatically:
| Schedule | Behavior |
|---|---|
| Manual | The source is only scanned when you trigger it with Scan Now. |
| Daily | Infisical scans the source about once per day. |
| Weekly | Infisical scans the source about once per week. |
Scheduled scans are evaluated once a day, so a source runs on its next scheduled check after its interval has elapsed. Every run is recorded in the source's scan history with its status, timestamps, and the number of accounts found.