Using Group Managed Service Accounts (gMSA) to set and forget the Service Accounts.

Question

Hi Everyone,

I have the requirement to use gMSA (Group Managed Service Accounts) to replace the statically assigned service account in my AD domain joined Servers that is already members of highly privileged groups like: Domain Admins, Enterprise Admins, etc...

I assume that any AD account that is running or used by the Windows or Application services can be replaced with this gMSA as it is very secure and no need to worry about writing down the password somewhere.

The normal service account is currently used by:

• Azure AD Sync
• ADFS
• SQL Server

What's the best practice for when to use gMSA and when NOT to use gMSA ?

Thanks in advance.

Answer 1

Hi @EnterpriseArchitect ,

Microsoft has written on their official documentation a good text on when to use gMSAs and the benefits from using them:

Benefits of using gMSAs
https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/service-accounts-group-managed#benefits-of-using-gmsas

When to use gMSAs
https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/service-accounts-group-managed#when-to-use-gmsas

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Best regards,
Leon

Answer 2

Hello @EnterpriseArchitect ,

Thank you for posting here.

Hope the information provided by LeonLaude is helpful to you.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.