Service account rules and limits
This page lists the rules the portal applies to service accounts. Use it when a name is rejected, when your application cannot read the password, or when you look up a message.
Field rules
| Field | Required | Rules |
|---|---|---|
| Username | Yes | 2 to 63 characters. Lowercase letters a-z, numbers 0-9, dots (.), hyphens (-), and underscores (_). Starts with a lowercase letter or a number. Unique, and not the name of a system account. Cannot be changed after you create the account. |
| Display Name | No | Up to 255 characters. |
| Description | No | Up to 255 characters. |
Valid examples: sa_data_ingest, bi-reader, etl.daily.
Invalid examples: SA_Ingest (uppercase), _loader (starts with _), a (too short).
Password format
The portal generates every password. You cannot choose one.
| Rule | Value |
|---|---|
| Length | 32 characters. |
| Characters used | Uppercase and lowercase letters, numbers 2 to 9, and ! @ # $ % ^ & * - _. |
| Characters never used | O, 0, l, 1 (easy to misread), quotes ' ", backslash \, backtick `, and spaces. |
You can paste the password into a shell command or a configuration file without escaping quotes or spaces. Characters such as $, !, and & still have a special meaning in some shells. Put the password in single quotes or read it from an environment variable.
Timing
| Event | Takes effect |
|---|---|
| Create or enable an account | New connections work within about 1 minute. |
| Rotate a credential | The old password stops working within about 1 minute. |
| Disable or delete an account | The account is blocked within about 1 minute. |
| Add the account to a policy, or remove it | New queries follow the change within about 1 minute. |
Messages
| Message | Shown when |
|---|---|
Service account '<username>' created successfully. | You created an account. |
Credential rotated successfully. | You rotated a credential. |
'<username>' has been disabled. Assigned access is being revoked. | You disabled an account. |
'<username>' has been re-enabled. | You enabled an account. |
Service account '<username>' has been deleted. | You deleted an account. |
Please copy the password now. It will not be shown again. | The Credential Generated window is open. |
If you close this window, you cannot see the password again. | You clicked outside the Credential Generated window. |
Username format is invalid. Use only lowercase letters, numbers, hyphens, and underscores. | The username breaks the field rules. |
Username already exists or is reserved by a system account. | The username is taken. |
Failed to create service account. Please try again or contact your administrator. | Create did not finish. Nothing was saved. |
Failed to rotate credential. Your current credential remains valid. Please try again. | Rotate did not finish. The old password still works. |
Failed to update account status. Please try again. | Disable or enable did not finish. |
Cannot delete a system-managed service account. | You tried to delete an account the Lakehouse uses itself. |
Failed to delete service account. Please try again. | Delete did not finish. Reload the list to check the status. |