Service Account

What is a service account?

A service account is an account created for an application, a script, or an automated process rather than for a person. It holds credentials, carries permissions, and authenticates to systems exactly as a user would, which is precisely what makes it useful and what makes it dangerous. It is the most common form of non-human identity inside a company.

What distinguishes a service account

• It has no human user, yet it usually lives in the same directory or user table as employees.
• Its credential is long-lived, often a static password, API key, or token that is never rotated.
• Its permissions tend to be broad, because scoping them precisely takes effort at setup time.
• It rarely has MFA, since no human is present to complete a second factor.
• It frequently has no documented owner, which is the root of every other problem.

Ownerless means unrevocable in practice

Ask who owns a service account and the honest answer is often nobody. It was created for an integration three years ago by someone who has since left. Nobody will disable it, because nobody can say what breaks if they do. That single dynamic is why service accounts accumulate permanently, appear in every access review as an unresolved line, and remain a standing finding under ISO 27001 and NIS2.

Examples and use cases

An access review of a finance system returns 34 accounts, six of which are service accounts. Two are documented. The other four carry generic names, admin-level rights, and no owner. The reviewer can neither approve them nor revoke them, so the lines are deferred and the same four reappear next quarter. Assigning a human owner to every non-human identity is what unblocks it, and Corma classifies and tracks those accounts so they stop being the unresolved residue of each campaign.

Related concepts

• Automated identity governance and administration
• Automated and compliant access reviews
• IAM for IT teams

FAQ

What is the difference between a service account and a user account?

A user account belongs to a person who authenticates interactively. A service account belongs to an application or process and usually authenticates with a static credential, with no human present.

Is a service account a non-human identity?

Yes. Non-human identity is the umbrella category, which also covers machine identities, workload identities, API keys, and bots. The service account is its most familiar form.

Should service accounts have MFA?

Interactive multi-factor authentication does not fit them. The equivalent controls are short-lived credentials, IP restriction, and ideally replacement by workload identity.

How do you govern service accounts?

Give each one a named human owner, document its purpose, scope its permissions to the task, rotate its credential on a schedule, and include it in every access review.

Request a demo