A service account is a noninteractive identity that lets a software service access operating-system or network resources. In SQL Server security, its scope affects both administrative effort and the damage caused by compromise. section 14.0
Mistake: choosing granularity by instinct. A fine-grain strategy assigns a separate account to every service on every instance, while a coarse-grain strategy reuses one or a few accounts across many services. section 14.3
The nine-account estate
Three SQL Servers running the Database Engine, Integration Services, and Analysis Services require nine accounts under a fine-grain strategy. At 200 instances across 150 servers, averaging two services each, the estate reaches 400 accounts. section 14.3
Compare the consequences before selecting a service-account strategy:
- Fine-grain separation limits lateral movement between instances and features, but creates password-rotation, synchronization, and configuration-management problems. section 14.3
- Coarse-grain reuse reduces account count but expands the blast radius: one compromise can expose the entire SQL Server estate. section 14.3
- Treat password rotation as an operational requirement; unmanaged rotation can create security exposure and regulatory-compliance problems. section 14.3
