Service accounts overview
A service account gives an application, a pipeline, or a scheduled job its own account to connect to the Lakehouse, separate from anyone's personal account. The portal generates its username and password, so your jobs keep running even when your team changes.
When to use a service account
| Use a service account for | Use a user account for |
|---|---|
| ETL jobs and data pipelines. | People who work in the portal. |
| BI tools and dashboards that refresh on a schedule. | Running queries by hand in Query Editor. |
| Third-party applications that read or load data. | Browsing data in Data Explorer. |
Create one service account per application or job. When one of them is no longer needed, or its password leaks, you change only that account.
What a service account can access
A new service account can connect to the Lakehouse but reads no data. It gets data access only when you add it to a policy in Data Security, the same way as a user or a group. See Give a service account data access.
The password is shown only once
The portal generates the password when you create the account or rotate its credential. You see the password once, in the Credential Generated window. Nobody can see it again later, including administrators. If you lose it, rotate the credential to get a new one.
Status and actions
A service account is always in one of three statuses.
| Status | Can connect | Has data access | Actions you can take |
|---|---|---|---|
| Active | Yes | Yes, from its policies | Rotate Secret, Disable, Delete |
| Disabled | No | No | Enable, Delete |
| Deleted | No | No | Restore |
- Disable blocks an account for a while, for example when a job is paused. Its policies stay. Enable gives the old access back.
- Delete blocks the account and moves it to Deleted. Deleted accounts do not show in the default list. Select the Deleted status filter to see them.
- Restore brings a deleted account back to Active with a new password. Its ID and policies stay the same. See Restore a service account.
If an action fails, the account keeps its current status. Nothing is changed halfway.
The list also shows system-managed service accounts, which the Lakehouse uses itself, for example for Lakehouse Janitor. You cannot delete them. When you rotate one, the portal does not show the new password.
When changes take effect
A new account, a new password, or a status change applies to new connections within about 1 minute. You never need to restart anything.
After you disable, delete, or rotate a service account, the old password can still work for about 1 minute.
Who can manage service accounts
| Permission | Lets you | Roles that have it |
|---|---|---|
service-accounts:read | View the list and details of service accounts. | portal_admin, policy_manager |
service-accounts:manage | Create, rotate, disable, enable, delete, and restore service accounts. | portal_admin |
See Portal roles and permissions.