Machine account (service account): what it is and how it is attacked
An account used by software rather than by a person.
Also known as
- service account
- robot account
- non-human account
- application account
Typing any of them into the editor finds this object.
Why it matters on a security diagram
Its password rarely changes, nobody watches it, and it usually carries more access than any person would be given. It is also the account most often left out of the second factor and out of the sign-in rules, because a program cannot answer a prompt, which quietly makes it the way around both.
How it gets attacked, and what reduces it
How it gets attacked
- Credentials found in scripts and configuration files
- Broad permissions granted once to make something work
What reduces it
- Replace with a platform-issued machine identity where the platform supports it, which removes the stored credential
- Scope permissions to the job and review them, since they are granted once and never reduced
- Do not reuse the same account between test and live
Where it sits
- Group
- Identity · Who something claims to be, and what proves it.
- Whose side, by default
- Ours · Belongs to the organisation the diagram is about.
- Catalogue identifier
- service-account
Reviewed . CC BY 4.0.
Others in identity
- Sign-in serviceIdP · SSO · identity provider · Entra ID · OktaThe single service that proves who someone is, for every application.
- Directory serviceActive Directory · AD · DC · LDAP · domain controller · staff directory · identity storeThe system that holds every account and computer, and decides what each one is allowed to do.
- Second factorMFA · 2FA · multi-factor authenticationA second proof of identity beyond the password.
- CertificateTLS certificate · PKI · code signing certificateA digital document proving something is genuinely what it claims to be.
- Access badgeproximity card · prox card · RFID card · fob · smart card · staff passThe card or fob a person holds against a reader to open a door.
The identity group lists all 6 of them side by side.
Machine account on your own diagram
Open the editor, press N, and type service account. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker