The ownerless service account: a small access path easily forgotten
Give each service account a short card: purpose, owner, permissions, secure credential reference and review date, without putting passwords in public documents.
Conceptual source: securing service principals in Microsoft Entra. This card is an independent operational proposal, not a ready-made policy for every product.
A scheduled task still runs, but nobody knows what its account does. Immediate deletion can stop a service; permanent neglect does not replace understanding dependencies and controlling access.
A proposed short card
- Purpose: Which task and system use the identity?
- Owner: Who are the technical contact and replacement?
- Authority: Which permissions are necessary, and why?
- Credentials: Where is the secure-store reference and authorized access method? Do not write the password.
- Review: When, and after which changes, will need and permissions be reassessed?
A hypothetical example
An account generates reports, but old privileges remain after a system change. First identify consumers and dependencies. Reduce permissions through a tested process with the owner and a rollback route. Changing permissions is not sufficient: reports must still be produced correctly.
Documentation boundaries
The card is not storage for tokens, private keys or passwords. Even internal names and paths belong only with authorized readers. Keep training material separate from actual network details.
My review question is: if the creator is unavailable, can another authorized person understand why the account exists and what a change would affect?
Source checked: November 2, 2026. Hypothetical example; no fixed password-rotation interval or instruction to delete a particular account is proposed.
Continue reading
All posts →
Not ready or actually stuck? One health check cannot make every decision
Separate readiness for traffic from application liveness so a temporary dependency fault does not become a restart loop.
Investigate 502 across three boundaries, before restarting everything
Separate client, proxy and upstream faults using time and request identifiers, with a short investigation path that avoids premature conclusions.
TLS renewed, but users still see an error: what to check
Renewal success is not the finish line. Check hostname, served certificate and CDN-to-origin connection separately without bypassing browser warnings.