Service Users

Service Users provide secure, non-human identities for automated access and integrations. They are designed to replace personal user-based API keys, ensuring uninterrupted connectivity and improved access control for system-to-system communication.

Service Users operate independently of individual user accounts, removing the risk of access loss when a user leaves the organization or their account is deactivated. Each Service User has its own lifecycle, permissions, and API keys, enabling administrators to centrally control and audit all automated connections.

Common use cases for Service Users include:

• Integrating third-party applications or tools with ADOC via the API.

• Running automated scripts or jobs that call ADOC APIs on a schedule.

• Representing a business unit's programmatic access without tying it to a person's account.

Benefits

• Prevents downtime: Integrations do not break when a personal account is deactivated or a user leaves the organization.

• Secure and auditable: API access is scoped to the Service User's assigned roles and is fully captured in Audit Logs.

• Flexible permissions: Service Users support both Tenant-level roles and Domain role mappings, giving them the same permission scope as a regular user.

• Centrally managed: Administrators can create, disable, and manage API keys for Service Users from a single location.

Access Service Users

To access the Service Users page:

1. Navigate to Control Center > Security > Service Users.

The Service Users page lists all existing service accounts in your tenant. Each entry shows:

Use the Search by name field to find a specific Service User.

Create a Service User

2. On the Service Users page, click Create Service User.

3. Enter a Name for the Service User. The name must be unique within your tenant.

4. Optionally, enter a Description to describe the purpose of the Service User.

5. In the Add Tenant Roles section, select one or more Tenant-level roles to assign. Selected roles appear in the list below the selector with a delete option. To remove a role, click the delete icon next to it.

6. In the Select Domains & Map Roles section, assign Domain roles to the Service User:

   • To add mappings for additional domains, click + Add More and repeat the selection. To remove a domain mapping, click the × icon next to it.

7. The Enable Service User toggle is on by default. Leave it on to activate the Service User immediately after creation.

8. Click Create Service User.

The new Service User appears in the listing and is ready for API key generation.

Note Service Users cannot be added to user groups. Tenant roles and Domain role mappings must be assigned directly on the Service User.

Assigning Domain Roles to a Service User

Domain roles control what a Service User can access and do within a specific domain — including viewing assets, running policies, and other domain-level operations. A Service User with the appropriate domain roles can perform the same domain-scoped actions as a regular user with those roles assigned.

Domain role mappings can be configured when creating a new Service User or by editing an existing one. Each mapping associates one domain with one or more roles. You can add multiple domain-role mappings to the same Service User to give it access across multiple domains.

Note Domain roles are separate from Tenant-level roles. A Service User can have both. Tenant-level roles (such as tenant_admin or owner) apply across the entire tenant, while Domain roles apply only within the specified domain.

Edit a Service User

To edit an existing Service User:

1. On the Service Users page, click the vertical ellipsis icon ⋮ next to the Service User you want to modify.

2. Select Edit Service User.

3. Update the Description, Tenant Roles, or Domain role mappings as needed.

4. Use the Enable Service User toggle to enable or disable the account.

5. Click Update Service User.

Note The Service User name cannot be changed after creation.

Disable a Service User

Disabling a Service User immediately revokes its ability to authenticate. Any API keys associated with the account stop working shortly after the account is disabled. The Service User and its keys remain in the system and can be re-enabled at any time.

To disable a Service User, click the ⋮ icon next to the account and select Disable Service User.

Manage API Keys

Each Service User can have one or more API keys for authentication. Administrators manage keys from the Service Users listing page.

Create an API Key

1. Click the ⋮ icon next to the Service User and select Create API Key.

2. Enter a Display Name for the key.

3. Optionally, set a Valid Till date. The API key expires on the selected date. If no date is set, the key does not expire automatically.

4. Click Generate Key.

Important API keys can only be viewed and downloaded at the time of creation. Store the key securely. It cannot be retrieved again after the dialog is closed.

Revoke an API Key

To revoke an API key, open the Service User's detail page and navigate to its API keys list. Disabled or revoked keys lose access shortly after revocation. Revoked keys remain visible in the list for audit purposes but cannot be re-enabled.

Permissions Summary

Audit and Security Controls

All Service User activity is captured in the Audit Logs, including:

• Account creation and deletion.

• Role and Domain role assignment changes.

• API key creation, download, and revocation.

• Enable and disable actions.

Administrators can enable or disable Service Users at any time from the Service Users listing page. Access is revoked shortly after the account is disabled.