Service account
A service account is an account used by software or an automated process to authenticate and access resources rather than represent a person's everyday sign-in.
The account needs an owner even when no person signs in
A scheduled job may need to read records or publish a result. Its service account provides an identity for that work. Someone still needs to own its permissions, authentication method, dependencies, and retirement.
The implementation depends on the platform. Google Cloud has a specific service-account resource. Microsoft’s service-account guidance discusses managed identities and service principals, and discourages using ordinary Entra user accounts for services. The term describes the purpose; it does not specify one universal account format.
Workload identity is the broader category. A service account is one way to represent software, not a synonym for every workload identity or every platform’s service principal.
Review who can act as the account
Google Cloud distinguishes the permissions granted to a service account from permissions other identities have over it. Someone able to obtain credentials or impersonate that account may be able to exercise its authority. A quiet sign-in history is not a complete review of those access paths.
The app credential article covers the related risk of changing how an application authenticates while leaving its existing permissions intact. The integration-token guide explains why an incident needs both a credential owner and a business owner who understands the affected job.
Keep account removal separate from credential rotation. Replacing a key does not establish that the account’s permissions are still necessary.