Skip to content

Commit a9e9091

Browse files
committed
Add information about SPN to the service account article
1 parent 3c24ac8 commit a9e9091

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

ATPDocs/service-account-discovery.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ Service accounts are classified into several types:
1717
- sMSA (Managed Service Accounts): Designed for individual services on a single server rather than groups.
1818
- User Account: These standard user accounts are typically used for interactive logins but can also be configured to run services.
1919

20-
The auto discovery feature quickly identifies gMSA and sMSA accounts as well as user accounts within Active Directory that meet specific criteria and classifies them as service accounts. These accounts are then highlighted and presented, along with relevant information including insights into recent authentications and the sources and destinations of those interactions, as part of a dedicated inventory within the Defender experience. This helps you better understand the accounts' purpose so you can more easily spot anomalous activity and understand its implications.
20+
The auto discovery feature quickly identifies gMSA and sMSA accounts as well as user accounts within Active Directory that meet specific criteria such as having a [Service Principal Name ](/windows/win32/ad/service-principal-names)(SPN) or password never expires assigned to them and classifies them as service accounts. These accounts are then highlighted and presented, along with relevant information including insights into recent authentications and the sources and destinations of those interactions, as part of a dedicated inventory within the Defender experience. This helps you better understand the accounts' purpose so you can more easily spot anomalous activity and understand its implications.
2121

2222
Service account types are displayed in the Identity Info table within Advanced Hunting.
2323

@@ -96,8 +96,10 @@ When you investigate a specific Service account, you'll see the following detail
9696
Last seen | The date and time of the most recent sign in event over this connection. |
9797

9898

99-
10099
For more information about the following tabs, **Overview**, **Incidents and alerts**,**Observed in organization**, **Timeline**, and **Attack paths**, see: [Investigate assets](/defender-for-identity/investigate-assets#identity-details).
101100

101+
## Related content
102+
- [Service principal names](/windows/win32/ad/service-principal-names)
103+
- [How to configure SPN](/windows-server/identity/ad-ds/manage/how-to-configure-spn?tabs=add%2Caduc)
102104

103105
If you run into any problems, we're here to help. To get assistance or support for your product issue, see how to open a support ticket at [Microsoft Defender for Identity support](support.md).

0 commit comments

Comments
 (0)