Improve security, reduce Identity sprawl, and manage accounts with Secure SaaS Service Accounts 

Early Access for Secure SaaS Service Accounts, a new feature in Okta Privileged Access, is now available. With this new feature, we aim to help customers protect service accounts across an organization with account takeover, vaulting, and password rotations.

Whether they’re service, shared, or break-glass accounts, security and IT teams can take control of non-federated accounts in an organization’s SaaS environment and manage them as part of their broader Identity posture.

Read on to learn more about service accounts and how they contribute to Identity sprawl plus details about Okta’s new solution.

What are service accounts?

No matter what industry or size, businesses today use dozens if not hundreds of cloud-based applications. And within the organization, there are appointed people (or machines) to manage these applications or tasks for the company.

An account is created to manage a process or task, and the organization may call it a:

• Service account
• Shared account
• Break-glass account
• Admin account
• Privileged account
• Local account

A service account often holds privileges that allow extensive access to system resources, either locally or across a domain. You can start to see why a compromised credential to one of these accounts could result in catastrophic damage to an organization.

Non-federated accounts and Identity sprawl

Identity sprawl is an issue organizations face today because of the proliferation of applications. As admins provision applications, the service accounts created aren’t tied to a specific user’s identity.

Because they don’t belong to a specific user, these accounts cannot be federated. That leaves IT and security teams to come up with a solution for provisioning, authentication, access policies, compliance, and more. These accounts are often under-managed and present a security and visibility problem. 

Security challenges and pain points 

Teams try several solutions to try to manage these types of accounts.

Potential solution: Use a password management tool to store the accounts.

Pain point: Not everyone may have access to this tool, and the tool might not provide the features needed for holistic management.

Potential solution: Use a manual process, like a spreadsheet or document.

Pain point: Manual processes are time consuming, unsecure, and unscalable.

Potential solution: Use a Privileged Access Management (PAM) vault to store credentials. 

Pain point: With another PAM solution, an admin will have to use multiple connectors — one app connector with Okta for SSO/federation and then a second app connector with the PAM vendor. The admin would have to configure policies across multiple solutions, choosing, adopting, and enrolling end users in another high-assurance factor.

Whichever option used, there are security and efficiency trade-offs — until now.

Securing service accounts with Okta

Secure SaaS Service Accounts will help customers address all the pain points that come with managing service accounts the traditional way.
 

Visibility

The feature offers a new view in the Okta Admin Console to unlock centralized visibility of SaaS application accounts. 

Management

Within Okta Privileged Access, admins can create and manage access policies for shared accounts to reduce or eliminate standing privileges. Set policies for rotation schedules, and to ensure only one user has access to an account at a time.
 

Governance

Admins can create multi-level approvals across applications, resource owners, and security personas. 

Vaulting

Protect credentials to shared accounts in the Okta Privileged Access Secrets Vault. 

Accountability

Know who had access to an account within a specific time period.

Ownership

Assign resource owners to shared accounts.

Integrated experiences with a unified Identity platform

The benefits of unifying your Identity solutions across Identity and Access Management, Identity Governance and Administration, and PAM use cases goes beyond vendor consolidation. Okta Workforce Identity Cloud delivers deeply integrated tools and experiences across these use cases with Identity at the core. With Okta, you have an extensive integration network, allowing you to discover, manage, and govern shared, service, and privileged accounts across enterprise applications for stronger security.

Secure SaaS Service Accounts in Okta Privileged Access supports many out-of-the-box integrations:

• Salesforce
• Google Workspace
• Microsoft Office 365
• ServiceNow UD
• Zendesk 
• NetSuite (Oracle)
• Coupa
• ShareFile (Citrix)
• Snowflake
• Cisco Webex Meetings
• Salesforce.com (Federated ID)
• SuccessFactors
• Atlassian Confluence Cloud
• 15five
• Workplace by Facebook
• Better Stack
• Outsystems v.598
• Streamline AI
• RightScale
• TOPdesk Person by FuseLogic
• TOPdesk Operator by FuseLogic
• Salesforce.com (Nonprofit)

More connections are being tested and added daily. Contact our team today to schedule a demo and see how you can start managing your service accounts with Okta to take control of account sprawl.