# Using gMSA as a Service Account

> [!IMPORTANT]
>
> Ensure that the "PowerShell module for Active Directory" is installed on the IQService machine.

To configure IQService to use a Group Managed Service Account (gMSA), follow these steps:

1. Create a gMSA account:

   1. Open PowerShell as an administrator on the domain controller.
   2. Run the following command to create a gMSA user, if not already existing:

      ```text
      New-ADServiceAccount MSAuserName -DNSHostName domainFQDNName  -PrincipalsAllowedToRetrieveManagedPassword "Domain Controllers","Read-only Domain Controllers"
      ```

      For example,

      ```text
      New-ADServiceAccount myMSAAccount -DNSHostName Monday.weekday.lab -PrincipalsAllowedToRetrieveManagedPassword "Domain Controllers","Read-only Domain Controllers"
      ```

      This command creates the gMSA and allows the domain controllers and read only domain controllers to retrieve the password. This is only useful if the IQService is installed on a domain controller.
2. Restart the domain controller or run `klist purge -li 0x3e7` to refresh your credentials.
3. Install the gMSA account in the Active Directory environment by running the following command:

   ```text
   Install-ADServiceAccount -identity 'CN=myMSAAccount,CN=Managed Service Accounts,DC=Weekday,DC=lab'
   ```
4. Add the User Principal Name (UPN) to the gMSA account if not already present, for example:

   ```text
   myMSAAccount@weekday.lab
   ```
5. Configure IQService to run under the gMSA account:

   1. Open **Services.msc** and locate the IQService Instance.
   2. Right-click on the service and select **Properties**.
   3. Go to the **Log On** tab and provide the **Account Name** as `myMSaAccount$`.
   4. Remove any values in the Password fields.
   5. Select **Apply** and then **OK**.
   6. Restart the IQService for the changes to take effect.
6. Grant the service account the capability to retrieve the password by running the following command:

   ```text
   Set-ADServiceAccount -Identity <gMSA-SAMAccountName> -PrincipalsAllowedToRetrieveManagedPassword "<IQService-LogOn-User>"
   ```

   For example,

   ```text
   Set-ADServiceAccount -Identity myMSAAccount$ -PrincipalsAllowedToRetrieveManagedPassword IQserviceuser1
   ```

   The gMSA service account can also be used as the IQService LogOn User (Windows Service LogOn User). In this case, ensure that the gMSA service account has full access to the IQService Instance folder on the registry.

   The gMSA account itself and the IQService server computer account are granted permission to retrieve the gMSA password, eliminating the need to set permissions for the IQService LogOn User.

   > **Note**
   >
   > You cannot use this gMSA as an IQService User during [IQService Settings](<https://documentation.sailpoint.com/connectors/microsoft/active_directory/va/help/connecting.html#iqservice-settings>) configuration, which is required for client authentication. You still need either a domain or local user with a password to achieve the same purpose.
7. Configure Active Directory in SailPoint:

   1. Ensure that you have added the necessary TLS certificate to the Virtual Appliance (VA) before creating the Active Directory connector.

      > **Important**
      >
      > SailPoint recommends adding the necessary TLS certificate to the Virtual Appliance (VA) before creating the Active Directory connector to ensure a smooth configuration process.
   2. Go to the **Domain Settings** in the Active Directory configuration.
   3. Set the **Authentication Type** to strong for Strong (SASL) authentication.
   4. Provide the necessary domain details, such as **Forest Name**, **Domain DN**, **Servers**, and the gMSA account UPN.

   Here's an example of the configuration:

   ```json
   {
       "entry": {
           "value": {
               "List": {
                   "Map": {
                       "entry": [
                           {
                               "key": "authorizationType",
                               "value": "strong"
                           },
                           {
                               "key": "forestName",
                               "value": "weekday.lab"
                           },
                           {
                               "key": "domainDN",
                               "value": "DC=Weekday,DC=lab"
                           },
                           {
                               "key": "password"
                           },
                           {
                               "key": "port",
                               "value": "389"
                           },
                           {
                               "value": {
                                   "Boolean": "true"
                               },
                               "key": "enablePasswordLessAuthenticationForDomain"
                           },
                           {
                               "value": {
                                   "List": {
                                       "String": "myDC.weekday.lab"
                                   }
                               },
                               "key": "servers"
                           },
                           {
                               "value": {
                                   "Boolean": ""
                               },
                               "key": "useSSL"
                           },
                           {
                               "key": "user",
                               "value": "myMSAAccount@weekday.lab"
                           }
                       ]
                   }
               }
           },
           "key": "domainSettings"
       }
   }
   ```

> [!IMPORTANT]
>
> The GMSAPasswordData service is disabled by default. The gMSA password retrieval does not work unless IQService uses TLS and you enable GMSAPasswordData.
>
> To enable GMSAPasswordData after upgrading from a previous version, refer to [Configuring TLS and Client Authentication for IQService](<https://documentation.sailpoint.com/connectors/iqservice/help/security/secure_communication.html>).
>
> For other IQService service and service status, refer to [Option to Enable/Disable Services](<https://documentation.sailpoint.com/connectors/iqservice/help/option_to_disable.html>).

## Opening Port 88 for gMSA Communication

When you use a gMSA account, open port 88 on the firewall for communication between the Virtual Appliance (VA), the IQService server, and Active Directory. If this port is not open, the test connection fails with a timeout error.

## Using Non-TLS LDAP Ports with Strong (SASL) Authentication

For domain and forest settings, use a non-TLS LDAP port. TLS is not supported for Strong (SASL) authentication with gMSA, so you cannot use gMSA with simple bind, with or without Transport Layer Security (TLS).

> [!NOTE]
>
> This restriction applies only to the LDAP connection between SailPoint and Active Directory. IQService can still use TLS for its own communication.

## Configuring Forest Settings for gMSA

After IQService runs under the gMSA account, configure the Active Directory source forest settings the same way as the domain settings: provide the gMSA account UPN, set the authentication type to Strong (SASL), and use a non-TLS port. For field-level guidance, refer to [Forest Settings](<https://documentation.sailpoint.com/connectors/microsoft/active_directory/va/help/connecting.html#forest-settings>) and [Domain Settings](<https://documentation.sailpoint.com/connectors/microsoft/active_directory/va/help/connecting.html#domain-settings>).