Azure ATP Group Managed Service Account (gMSA)

Question

Hello,&nbsp;We are switching our service account for ATP to a gMSA.&nbsp; &nbsp;We are following the&nbsp; gMSA guidance in this article: https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-prerequisites&nbsp;Do you have any guidance for the&nbsp;following gMSA properties, or any other gMSA properties:-ServicePrincipalNames &lt;string[]&gt;-KerberosEncryptionType AES128,AES256-ManagedPasswordIntervalInDays xx&nbsp;&nbsp;I assume the PrincipalsAllowedToRetrieveManagedPassword will be set to the built-in Group “Domain Controllers”, correct?&nbsp;&nbsp;Thank you

or tsemah · Answer

bryanb&nbsp;The main requirement for the creation of the gMSA is indeed the&nbsp;PrincipalsAllowedToRetrieveManagedPassword&nbsp;attribute which points to a group that contains the computer accounts with the sensor installed (you can use the Domain Controller group or a dedicated group for that).

bryanb · Answer

Or Tsemah&nbsp;Thanks for the response.&nbsp; &nbsp;Something else we found during testing.&nbsp; &nbsp;We have read-only domain controllers so that is a different group that needs to be added to gmsa properties.We had to grant the gMSA logon rights as&nbsp; service to each domain controller.&nbsp; &nbsp;A standard account&nbsp; did not require this OS right on the ADDS servers.&nbsp;

or tsemah · Answer

Yes, that's why you should consider using dedicated groups

Regarding the log in as a Service permission, you can view possible workaround in here: https://techcommunity.microsoft.com/t5/azure-advanced-threat-protection/azure-atp-service-not-starting/m-p/1368747#M1175

bryanb · Answer

Or Tsemah&nbsp;Thanks, that is probably the same issue we have with the logon rights.&nbsp;Dedicated groups work also.&nbsp; The disadvantage for us is remembering to add the computers to that group as part of a ADDS server deployment.&nbsp;&nbsp;

or tsemah · Answer

We are also evaluating putting sensors on additional components, which is another (future) reason for dedicated groups

Forum Discussion

Azure ATP Group Managed Service Account (gMSA)

Resources