Service Accounts¶
| Account Name | PIM Safe | MFA Enabled For | KaaS NovoAccess Roles | Usage |
|---|---|---|---|---|
| KaaSOpsAdmin | NNG_MG_KAAS_BUILD | UAGK, ORGD | KaaS Operator | Release Validation |
| KaaSOperator | NNG_MG_KAAS_BUILD | UAGK, ORGD | KaaS Operator | Release Validation |
| KaaSSupporter | NNG_MG_KAAS_BUILD | UAGK, ORGD | KaaS Supporter | Release Validation |
| KaaSPilotOperator | NNG_MG_KAAS_BUILD | UAGK, ORGD | KaaS Pilot Operator | Release Validation |
| KaaSPilotSupporter | NNG_MG_KAAS_BUILD | UAGK, ORGD | KaaS Pilot Supporter | Release Validation |
| KaaSPilotDeveloper | NNG_MG_KAAS_BUILD | UAGK, ORGD | KaaS Pilot Developer | Release Validation |
| KaaSTester | NNG_MG_KAAS_BUILD | UAGK, ORGD | KaaS Viewer | Release and informal testing |
| TF_runner | N/A | N/A | N/A | Confluent Cloud Service Account for IaC Terraform |
| kaasowner | NNG_UM_KAAS_emergency | N/A | KaaS Administrator | Password for (Non SSO login) admin account for fallback emergency login scenario. Password is manually rotated. |
| kaasowner (O365) | NNG_MG_KAAS_emergency | UAGK, ORGD | N/A | This PIM safe stores the account owner of above kaasowner. As the password may expire and require requesting and receiving a new one, this login is required to access the mailbox. |
*The account has the roles AzureDevOps : KaaSWorkspace Administrator & Prisma Cloud : CWPP CI User, and owns the PAT for kaas-workspace-wizard and pipeline-agent-build-prod
MFA¶
On top of storing passwords in PIM (automatically rotated in MG safes), MFA is enabled across all 'Shared users/service accounts'. The Lead Architect and potential delegates have and continuously manages access to MFA methods.
To enable a new authentication method, a user with access already needs to login to the My Sign-Ins | Security Info | Microsoft.com with the shared user/service account credentials (browser profile or incognito login) and add the new method.
Please note, an account can only set up authentication method on up to 5 different devices (unique authenticator apps or security keys)
Microsoft Authenticator¶
In My Sign-Ins | Security Info | Microsoft.com on the respective Account, 'Add authenticator' and follow the wizard steps.
YubiKey¶
In My Sign-Ins | Security Info | Microsoft.com on the respective account, 'Add security key' and follow the wizard steps, also explained in the guide here User-guide_YubiKey.pptx
Service Account Retirement¶
In order to remove a 'Shared-user Service Account', you have to do the following actions;
- Create a Windows - Service Accounts with Mailbox and Shared Mailbox - IT Portal request in the IT Portal to "Delete". (takes approx 18 days, also removes novoAccess configuration)
- Once step 1 is completed, create a request Unified PIM - Functional Safe - IT Portal to have the account modified/deleted from the PIM safe
- Reach out to a "Platform Administrator" to have them remove the user from Confluent Cloud
- If relevant, update documentation (e.g. Service Account overview)