SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Three questions on a theme...

Which accounts should be managed accounts?

Or perhaps to put it another way, which services / things are best to have as managed accounts?

Or perhaps the opposite question: Are there any accounts that are best not set up as managed accounts?

share|improve this question
up vote 1 down vote accepted

It is a best practice to create a specific service account per Service Application, so that the farm service account is only used for this specific purpose (health monitor will warn you if it is used for other services). With few exceptions these can each be made a managed account.

Also create a service account per application pool, as this is a natural security boundary in your farm. I usually create one for web services and one for web applications. If I run both intranet and extranet on the same farm, I will create a web application pool for each and give them each a unique account.

Some service accounts cannot be made managed accounts. This includes the User Profile Synchronization account, the portal super reader and super user account (both used for caching).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.