# Machine Account Attributes

Machine account attributes are used in provisioning configurations for machine accounts.

After you have [created the required machine account subtypes](<https://documentation.sailpoint.com/saas/help/machine/account_configuration.html#creating-machine-account-subtypes>), you can use the machine account attributes to provision machine accounts in your SailPoint tenant.

Refer to [Machine Identity Security Overview](<https://documentation.sailpoint.com/saas/help/machine/index.html>) for more information.

> [!NOTE]
>
> Attributes marked with an asterisk (\*) are mandatory.

## Machine Account Provisioning Attributes

The following table provides a reference summary of Create Machine Account attributes.

| Create Machine Account Attribute | Description |
| --- | --- |
| ObjectType\* | The Active Directory object class for machine account creation. The default value is `msDS-GroupManagedServiceAccount` (gMSA). |
| distinguishedName\* | The distinguished name (DN) where the machine account is created. For example: `CN=<name>,OU=<container>,DC=<domain>`. |
| sAMAccountName\* | The machine account logon/profile name in Active Directory. |
| dNSHostName\* | The FQDN assigned to the service account. For example: `gMSAName.domain.com`. |
| sn | Surname/last name value for the account object. |
| givenName | Given name/first name value for the account object. |
| msDS-SupportedEncryptionTypes | Supported encryption type(s) for the gMSA. The default is `AES256`. |
| msDS-ManagedPasswordInterval | Password rotation interval (in days) for the managed service account. |
| msDS-GroupMSAMembership | Principals allowed to use the gMSA. Multi-valued attribute. |
| msDS-AllowedToActOnBehalfOfOtherIdentity | Principals allowed to act on behalf of this account. Multi-valued attribute. |
| description | Description/comment for the machine account. |
| servicePrincipalName | Service principal names (SPNs) associated with the machine account. Multi-valued attribute. |