Service account
What it is
A service account is a non-human identity used by an application, agent, scheduled task, or pipeline. It has permissions, credentials or tokens, an owner, and a lifecycle distinct from a person’s user account.
Why it exists
Automation must authenticate without borrowing an employee’s identity. A dedicated non-human identity makes permissions attributable, reviewable, and revocable when the workload changes or is retired.
Not the same as
- Traditional directory service account — a user-like account often used by a Windows service. It can require password rotation and is usually a poor default for cloud automation.
- service-principal — the Microsoft Entra application identity commonly used by software or external automation.
- managed-identity — an Azure-managed service principal for an Azure-hosted workload; prefer it when available because the workload does not store a credential.
- workload-identity-federation — a way for an external workload, such as CI, to exchange a short-lived OIDC token for cloud access without a stored secret.
Operational rule
Give each service account a named owner, purpose, minimum scope, credential/rotation plan, and retirement date. Do not use a human administrator account as a pipeline identity.
Related
user-account · service-principal · managed-identity · workload-identity-federation · service-connection
📘 Sources: Microsoft Learn — secure service accounts and Windows service accounts, checked 2026-08-22. Re-audit when Entra workload-identity or Windows service-account guidance changes.