---
title: Service Accounts and Groups
slug: service-accounts-and-groups
docTags: 
createdAt: 2025-07-16T01:07:41.989Z
---

This document covers the service accounts and directory groups that Activate requires to function.

To ensure Activate is installed and operates reliably within your environment, several Active Directory (AD) service accounts and a dedicated AD group must be configured with specific permissions. These accounts enable Activate to interact with the systems it manages—such as Active Directory, Exchange, File Servers, and other infrastructure components—on behalf of users and administrators.

This article outlines the purpose of each required account and group, their recommended permission levels, and considerations for environments that cannot grant Domain Admin rights. It also highlights the operational risks of using delegated permissions instead of Domain Admin access, to help you make informed decisions during setup.

# Activate Orchestrator Service Account

- **Purpose:** Runs the Activate Provisioning Server and performs actions across target systems.
- **Recommendation:** Account should be a member of the **Domain Admins** group.
- **If Not Domain Admin:**
  - Add to **Local Administrators** on all Activate Servers.
  - Grant **delegated permissions** across:
    - Active Directory
    - Exchange
    - File Servers
    - SCCM / MECM
    - Office 365
    - Azure
    - Other managed infrastructure

**General Permissions Required**

- **SQL Database:** DBO rights.
- **Active Directory:** Full permissions for creating, updating, deleting users, groups, computers, distribution lists.
- **Exchange:** Manage mailboxes and distribution lists, archiving access.
- **File Servers:** Power User rights for share creation.
- **SCCM / MECM:** As required by provisioning tasks.
- **Folder Manager Module:** Power User access to file servers.

# Activate Web Service Account

- **Purpose:** Runs the Activate Web Portal and handles web-based notifications.
- **Account Setup**
  - **'Send As' rights** on the Orchestrator Service Account.
  - SMTP Relay rights
  - **Local Administrator** on the Activate Web Server.
  - **SQL Server:** Connection rights; added to the Activate Administrator SQL Database Role.
  - **IIS Membership:** Member of `IIS_WPG` or `IIS_IUSRS` local group (depending on OS version).

:::hint{type="info"}
**Tip**
Add Activate Web Portal URLs to Group Policy for client machines to classify the portals as Local Intranet.
:::



# Activate Installation Account

- **Recommendation:** Use the **Activate Orchestrator Service Account** to install Activate.
- **If using a different account, it must have:**
  - Local Administrator on the Activate Server.
  - SQL connection rights with DBO on the Activate Database or rights to create Databases.
  - Membership in the **Activate Administrators AD Group**.

# Activate Administrators Group

- **Purpose:** Defines the AD group for users who administer Activate.
- **Setup:**
  - Must contain **direct members only** — nested groups are not supported.
  - Include the following members:
    - Activate Orchestrator Service Account
    - Activate Web Service Account (if separate)
    - Users administering Activate
    - The installation account (if required)

:::hint{type="info"}
**Best Practice**
Create and maintain a dedicated Activate Administrators group distinct from other admin groups.
:::