Key Takeaways
- 01Service accounts are the largest single category of identities in most enterprises — and the most poorly governed. Every modernization project leaves a tail of new ones; few projects retire old ones.
- 02Minimum discipline: every service account has an owner of record, a documented purpose and end date, credentials that rotate on schedule (automatically), permissions following least privilege (audited annually), and retirement when the consuming system retires.
- 03How to start with a sprawled estate: discovery first — pull every account with usage statistics for the past 90 days. Zero-usage accounts retire immediately (with 30-day quarantine for surprises). Active accounts get assigned to the team owning the consuming system. Ownerless accounts are the project.
- 04Path to fewer service accounts: each new system that previously used a static service account now uses workload identity. Service-account count declines as systems retire — a multi-year curve, not a quarter's project.
Service accounts are the largest single category of identities in most enterprises and the most poorly governed. Every modernization project leaves a tail of new ones; few projects retire the old ones.
The minimum discipline
- 01Inventory — every service account has an owner of record
- 02Lifecycle — every service account has a documented purpose and end date
- 03Rotation — every credential rotates on schedule, automatically
- 04Scoping — permissions follow least privilege, audited annually
- 05Retirement — when the system retires, the account does too
How to start with a sprawled estate
Discovery first — pull every account with usage statistics for the past 90 days. Accounts with zero usage retire immediately (with a 30-day quarantine for anything that surprises you). Accounts with usage get assigned to the team that owns the consuming system. The remaining ownerless accounts are the project.
The path to fewer service accounts
Each new system that previously would have used a static service account now uses workload identity. The number of service accounts declines as systems retire. This is a multi-year curve, not a quarter's project.
#Service Accounts#NHI#Sprawl