Identity and Privileged Access Security
Service Accounts and Machine Identities
We identify the accounts used by applications and automation. We determine each one's privileges, owner and the last password change date.
What it is
Service accounts and machine identities are accounts that applications, not people, use to sign in. They are often created with broad privileges, left without an owner, and their passwords remain unchanged for long periods. Since they cannot use MFA, compromise is hard to detect. The assessment consolidates these identities from Active Directory, Entra ID and cloud environments into a single inventory.
Scope
- Active Directory service accounts and group managed service accounts (gMSA)
- Passwords and certificates of applications and service principals in Entra ID
- Cloud workload identities and access keys
- Accounts exposed to Kerberoasting and weak passwords
- Service accounts that can sign in interactively
- Account owners and unused accounts
The need
When organizations need it
- When an application team is disbanded or outsourced development ends and accounts are left without an owner.
- When a service account password has never been changed due to concern about stopping the application.
- When preparing your cardholder data environment accounts for audit. PCI DSS requires application and system accounts to have least privilege and be reviewed regularly.
Method
How we work
-
Discovery
We identify machine identities in the directory, cloud environments and application configurations.
-
Usage analysis
We analyze logs to see where, when and to which systems each account signs in.
-
Risk ranking
We prioritize accounts with broad privileges, old passwords or interactive sign-in.
-
Transition plan
We prepare a plan to move suitable accounts to gMSA or managed identities without disrupting applications.
Outcome
What you have at the end
The owner, privileges and usage location of every service account are identified. You have a step-by-step plan to move risky accounts to managed identities.
Frequently asked questions
Will changing a service account password stop the application?
It can if the password usage locations are unknown. That is why usage analysis is done first. With managed accounts such as gMSA, the system changes the password automatically.
Do certificates count as machine identities?
Yes. TLS and client certificates also prove a system's identity. Certificates nearing expiry or with unprotected private keys can also be included in scope.
Identity and Privileged Access Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting