Okta Service Accounts Overview
Last Updated:
Overview
A service account represents a non-human user that authenticates and authorizes access to data within an application. These accounts allow Okta to authenticate in an application to access data, run processes, or perform actions on behalf of an application user.
Service accounts are considered normal users and do not incur additional charges. Service accounts count towards Okta user licenses.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Administrator
- Service Account
- Provisioning
Solution
Application Service Accounts Enable the Provisioning Flow
In Okta, application service accounts enable the provisioning flow. The provisioning connector typically lacks the ability to handle Multi-Factor Authentication (MFA) prompts. The permissions assigned to the service account determine the specific resources the account accesses and the actions the account performs.
What are the best practices for managing service accounts?
Secure and manage service accounts effectively by restricting credential sharing, avoiding default passwords, rotating credentials regularly, applying the Principle of Least Privilege (PoLP), and using unique accounts for each application.
- Restrict the service account credential to a single administrator, as it represents a non-sharable credential.
- Avoid default vendor passwords, as these passwords are easily guessable and available online.
- Change passwords regularly to maintain security through password rotation.
- Assign the service account only the bare minimum privileges required to perform the necessary tasks, adhering to the Principle of Least Privilege (PoLP). This strategy minimizes the potential damage a compromised account causes.
- Assign a unique service account for each individual application whenever possible.
