Learn how to identify service accounts within your Reltio environment, a critical step in transitioning to client credentials.

1. Identify non-SSO Users
   Review your user list to identify users who were manually created in Reltio and are currently non-SSO users.

   • From the UI, see Managing User Accounts to review all your users and identify non-SSO users by looking at the SSO column (SSO=N).
   • From API, with Get Users, you can get all your users with a single API call. You will see a JSON definition for each user. Users with the attribute externalUser=false are your non-SSO users.
2. Review each user to determine if they are service accounts
   Manually review the identified non-SSO users to confirm if they are service accounts.
3. Track and document service accounts manually
   We recommend adding each identified service account to the group SERVICE_ACCOUNTS for tracking and allowing for a temporary MFA exemption.

   • From the UI, follow the steps described in Working with Existing User Accounts and assign the user to the group “SERVICE_ACCOUNTS”.
     • If the group does not exist, you can create a new group called SERVICE_ACCOUNTS. Make sure you don’t add any roles to this group. We will use it only as a reference to exclude these service accounts from MFA.
   • From API:

     • Get the current user definition as described in View User.

     • Identify the groups attribute and add SERVICE_ACCOUNTS in it.
     • Update the user definition with this API endpoint.
4. Review temporary exemption process
   Note: We plan to enhance our UI to flag service accounts, but this feature is currently under development.

   Note:

   ROLE_ADMIN_CUSTOMER is required to perform these operations.