Best practices for service accounts using Entra ID as an SSO

Products

• VMware vSphere ESXi

Issue/Introduction

• Entra ID is set as the primary SSO for vSphere.
• Best practices for handling service accounts.
• Workflow for enforcing MFA with Entra ID.
• Information about using service accounts as local accounts or accounts in Entra ID.

Environment

vSphere 8.x

VCF 9.x

Resolution

When configuring vCenter Server Identity Provider Federation with Microsoft Entra ID, the MFA requirement is applied to all users by default. Because non-interactive service accounts cannot respond to MFA prompts, these integrations may fail to authenticate.

To maintain functionality and security, use one of the following methods:

1. Conditional Access Policies (Recommended): Create an exclusion policy in the Microsoft Entra admin center targeting the vCenter application to explicitly exclude service accounts from the MFA requirement.

   Note: With this method, service accounts still authenticate through Entra ID. If Entra ID experiences an outage or there is an internet connectivity issue, these accounts will fail to authenticate.

2. Dedicated Local Accounts: If organizational policies restrict Conditional Access exclusions, or if service accounts must remain functional during an Entra ID outage, create dedicated local vCenter accounts on the vsphere.local domain with the minimum necessary privileges. These accounts authenticate locally and are not impacted by Entra ID availability.

   Note: Management of accounts created in vsphere.local will need to be maintained in vCenter. In VCF 9 when vCenter Linking is being used instead of ELM, then vsphere.local local service accounts will need to be maintained per vCenter. vsphere.local will not replicate when vCenter Linking is used.

Note: Ensure proper security hardening. After configuring Entra ID as a valid identity source, logging in via the Sign in with local account option can potentially allow users to bypass Entra ID SSO.

Additional Information

Knowledge base articles to reference.

"Configuring Microsoft Entra ID for vCenter Server"

"After configuring Entra ID as a valid identity source, login via "Sign in with local account" allows login bypassing Entra ID."