> ## Documentation Index
> Fetch the complete documentation index at: https://docs.idemeum.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Service account
## What it is
The idemeum service account is an Active Directory user account that the idemeum agent uses to manage just-in-time (JIT) domain accounts for technicians. With it, idemeum can create a technician's account when it's needed, set a one-time password, grant admin access, and disable the account afterwards, without storing any person's admin credentials.
| Attribute | Description |
| - | - |
| Name | `idmservice-user` followed by four random digits, for example `idmservice-user4817` |
| AD description | "Service user managed by idemeum" |
| Location | `Managed Service Accounts` container if it exists, otherwise `Users`, or the OU configured for MSP JIT accounts in your tenant settings |
| Created by | The idemeum agent on a domain controller, automatically, once the tenant is set up for domain JIT access. It's checked and kept up to date every 6 hours. |
| Privilege | `Domain admins` |
| Type | It's a regular AD user account, not a Windows group Managed Service Account (gMSA). It's hidden from the Windows sign-in screen. |
> [!WARNING]
>
> Don't move this account to a different OU or rename it. The agent expects it in the configured location and recreates it there if it can't find it. The recreated account is a new AD object with a new SID, so group memberships or delegations added to the old one are lost. To change the location, update the JIT OU setting in your tenant.
## How it's used when a technician signs in to a domain computer
Here is the flow for how service account is used when managing domain JIT accounts.
> [!NOTE]
>
> The service account is used only when technicians sign in with **domain** accounts, which covers domain controllers and tenants that use domain JIT accounts on workstations. When technicians use **local** JIT accounts on workstations, the service account isn't involved.
```mermaid actions={true} theme={null}
%%{init: {
"theme": "base",
"themeVariables": {
"fontFamily": "Inter, ui-sans-serif, system-ui, sans-serif",
"fontSize": "14px",
"primaryColor": "#ffffff",
"primaryBorderColor": "#e4e4e7",
"primaryTextColor": "#18181b",
"lineColor": "#a1a1aa",
"edgeLabelBackground": "#ffffff",
"actorBkg": "#ffffff",
"actorBorder": "#e4e4e7",
"actorTextColor": "#18181b",
"actorLineColor": "#a1a1aa",
"signalColor": "#a1a1aa",
"signalTextColor": "#18181b",
"noteBkgColor": "#f4f4f5",
"noteBorderColor": "#e4e4e7",
"noteTextColor": "#3f3f46",
"activationBkgColor": "#18181b",
"activationBorderColor": "#18181b",
"sequenceNumberColor": "#18181b"
},
"sequence": { "useMaxWidth": true }
}}%%
sequenceDiagram
autonumber
actor T as Technician
participant A as idemeum agent
(domain computer)
participant C as idemeum cloud
participant DC as Active Directory
(domain controller)
T->>A: Selects the idemeum tile
and scans the QR code
A->>C: Sign-in request
C-->>T: Approval prompt in the
idemeum mobile app
T-->>C: Approves
C-->>A: Approval and
technician entitlement
A->>A: Generates a new
random password
rect rgb(244, 244, 245)
A->>DC: Connects as the
idemeum service account
activate DC
A->>DC: Creates or enables the JIT
account and sets the password
A->>DC: Adds the JIT account
to the admin group
A->>DC: Replicates the change
to all domain controllers
deactivate DC
end
A->>T: Signs the technician in
with the JIT account
Note over T,DC: At sign-out, the agent uses the service account again
to set a new random password and disable the JIT account
```
## Service account password rotation
| Rotation type | Support | Notes |
| - | - | - |
| Manual rotation | **Not supported** | Resetting the service account password directly in Active Directory isn’t supported. Technician JIT logins fail until the next sync (up to 6 hours), and at that sync the agent **restores its own managed password**, so the manual change doesn’t persist. Use **Reset service account** instead. |
| Rotation with UI | Supported | On a **domain controller**, open the idemeum desktop client → **Installed** screen → **Reset service account**. This generates a new password and updates Active Directory, the idemeum cloud, and the local store together. |
| Automatic rotation | Coming soon | We will be releasing the automatic service account password rotation soon. Every Sunday at midnight the service account will be automatically rotated. |
## Domain policy for password age
If your domain password policy sets a maximum password age, the service account can expire like any other user. When it does, JIT sign-ins fail until the next sync on the domain controller, which renews the password.
## Who has access to the account
| Who | How |
| - | - |
| Your domain administrators | It's a normal AD account, visible and manageable in Active Directory Users and Computers. |
| Idemeum desktop agents | On your domain controllers and on managed computers that do domain JIT sign-ins. The agent needs the password to manage JIT accounts, so the encrypted password and your tenant master key are stored on those computers. |
| Idemeum team | idemeum team does not have access to clear text service account password. It is encrypted with your master key (only known to you) on the desktop before it is uploaded to idemeum cloud. |
## Why it needs Domain Admin privileges
Here is why the service account needs to have Domain Admins privilege:
1. Technicians need administrative access, so by default their JIT accounts are added to the **Domain Admins** group. Windows protects that group and every account in it: only accounts with Domain Admin–level rights can add members, reset those members' passwords, or enable and disable them.
2. The service account also tells all domain controllers to replicate each change immediately, which by default requires administrator rights on the domain.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.