Service account password rotation SOP

Overview

Shared service account passwords become tribal knowledge—rotate with automation and vault checkout.

Standard

• Unique account per service; gMSA on-prem where possible.
• Rotation at max 90 days or after technician turnover.

Process

1. Schedule maintenance; update password in vault + app config atomically.
2. Smoke test integration; rollback playbook if service fails.

Never

Send passwords via Teams/email; never reuse domain admin creds as “service.”