Service Account
A non-human account used by an application or service to authenticate. Often over-permissioned and rarely rotated, making service accounts a frequent breach vector.
Service accounts are the most reliable finding in any identity audit: over-permissioned because scoping was hard on day one, never rotated because nobody knows what depends on them, and excluded from MFA policy because they cannot do MFA. Ownership is the fix that unlocks the others. An account with a named owner can be reviewed, scoped, rotated, and eventually replaced by a workload identity.
See also: non-human identity, client credentials, workload identity, what is non-human identity
Related on Start with Identity
- GlossaryService Principal
A service principal is the identity an application or automated workload uses to sign in to Microsoft Entra ID and access Azure or Microsoft Graph resources: th
- GlossaryAPI Key
A static secret string used to authenticate an application or caller to an API. Simple but weak: it does not expire on its own, is easy to leak, and should be v
- GlossaryAgent Registry
An agent registry is an inventory of the AI agents an organization runs or allows, recording for each one its identity, accountable human owner, purpose, permis
- BlogOkta Access Gateway flaw lets an admin run system commands as the gateway's service account
Okta published CVE-2026-115547 on October 22: an input validation flaw in the Okta Access Gateway Admin Console lets an authenticated administrator execute syst
- TemplateService Account and Non-Human Identity Policy Template
A fill-in policy for service accounts, API keys, OAuth apps, workload identities and AI agents: ownership, approved credential types and maximum lifetimes, rota
- BlogA password-spraying campaign across 5,700 accounts found its way in through seven service accounts on default passwords
Proofpoint tracked a TeamFiltration campaign against 28 Microsoft 365 tenants in Chile. It sprayed more than 5,700 accounts and compromised seven, every one an