Delegated managed service accounts
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit eaab2fb · +3 −6 lines · also on GitHub
11
---
2
−title: Delegated Managed Service Accounts overview in Windows Server 2025 (Preview)
3
−description: Learn about delegated Managed Service Accounts (DMSA) that authenticate specific machine identities mapped in Active Directory along with Credential Guard to ensure device credentials isolation in Windows Server 2025 (Preview).
2
+title: Delegated Managed Service Accounts overview in Windows Server 2025
3
+description: Learn about delegated Managed Service Accounts (DMSA) that authenticate specific machine identities mapped in Active Directory along with Credential Guard to ensure device credentials isolation in Windows Server 2025.
44
ms.topic: conceptual
55
ms.author: alalve
66
author: mariamgewida
7
−ms.date: 09/30/2024
7
+ms.date: 10/25/2024
88
---
99
1010
# Delegated Managed Service Accounts overview
11
−
12
−> [!IMPORTANT]
13
−> Windows Server 2025 is in Preview. This information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
1411
1512
A new account type known as delegated Managed Service Account (dMSA) is introduced in Windows Server 2025 that allows migration from a traditional service account to a machine account with managed and fully randomized keys, while disabling original service account passwords. Authentication for dMSA is linked to the device identity, which means that only specified machine identities mapped in Active Directory (AD) can access the account. Using dMSA helps to prevent harvesting credentials using a compromised account (kerberoasting), which is a common issue with traditional service accounts.
1613
⋯ 89 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:22 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.