Configuring service accounts for services and utilities

Typically, there are two different account types used to configure each service,

A Windows domain or local computer account that you to be used to run this service.
An Azure account that has the appropriate access in Cohesity Alta SaaS Protection.

For ease of use, the following service accounts are created as part of the Cohesity Alta SaaS Protection provisioning process.

Connector service account
Retrieval service account
Full admin account

This information will be provided by the Cohesity Alta SaaS Protection support team during the post-provisioning call.

If you do not want to use the default service accounts, you can create your own accounts with the correct permissions as described in the Authorizations required for the service account table. If you create your own accounts, you could use the same account to run the service and connect to Cohesity Alta SaaS Protection.

Authorizations required for the service account in Cohesity Alta SaaS Protection

The service account must be authorized with the following permissions Cohesity Alta SaaS Protection:

Table: Authorizations required for the service account Cohesity Alta SaaS Protection

Services and utilities	Authorizations in Cohesity Alta SaaS Protection	Authorizations in the customer's domain
Connector service	API Add Content.	Read permission. Write Attributes permission.
Export service	API API Impersonation Access All Items
Retrieval service	API API Impersonation Access All Items
Export utility	For the administrator: API Access All Items For the end user: End-User Retrieval End-User Portal Export Utility
Apps Consent Grant utility		Global Administrator

Table: Authorizations required for the service accounts in Windows

Services and utilities	Windows Permissions when running the service
Connector service	Log on as a service permission If running a Connector for File System Archiving: Standard Read permissions Write Attributes permission The Write Attributes permission is required as Cohesity Alta SaaS Protection suppresses updating the Last Accessed time. Write permission is also required when using the `.Hubstorinfo` file, which is enabled by default.
Export service	Log on as a service permission Modify permissions to the export locations
Retrieval service	Log on as a service permission Full control permissions

To configure a service account for services and utilities

Open a web browser and access the Administration portal.
Click Administration.
On the left, expand Permissions > Users and groups.
Click Refine search.
In the Refine search window, enter the user account, and then click Run search.
Click Manage permissions.
In the Manage permissions window, select the required permissions for the service account and then click Assign.

Configuring service accounts for services and utilities

Feedback

Feedback