> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Service accounts should be inventoried and owned

> Checks that Nebius service accounts are enumerated and attributable to an owner.

Checks that Nebius service accounts are enumerated and attributable to an owner.

## About

When you connect Nebius to DSALTA, the platform lists the service accounts in your tenant using read-only IAM access and verifies that each is named and has an identifiable owner. DSALTA evaluates this control on every sync.

## Why This Matters

Unowned service accounts are a common source of standing, unmonitored access — no one is accountable for their credentials or the resources they can reach. Maintaining an inventory of service accounts with clear ownership is expected by frameworks including SOC 2, ISO 27001:2022, NIST CSF, and CIS.

## How to Fix

**Before you begin**

* Review the service accounts flagged as unowned or unattributed in the DSALTA check details.
* Ensure you have **tenant admin** rights in the Nebius Console.

**Review service accounts**

1. In the **Nebius Console**, go to **IAM → Service accounts**.
2. For each flagged account, assign a clear owner and a descriptive name.
3. Remove any service account that is no longer in use.

Once every service account is inventoried and has an identifiable owner, DSALTA retrieves the change on the next sync and sets the check status to **Passing**.

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="How often does this check run?">
    This check runs automatically every 24 hours while the Nebius integration is connected. You can also trigger a manual sync from **Integrations** in the sidebar.
  </Accordion>

  <Accordion title="What happens if it keeps failing?">
    A failing check appears in your **Data Library → Tests** dashboard. Work through the steps above; once the underlying configuration is fixed, the status updates automatically on the next sync.
  </Accordion>

  <Accordion title="Can I exclude this check?">
    Yes. If it does not apply to your environment, mark it as **Not Applicable** with a justification. The exclusion is documented for auditors.
  </Accordion>

  <Accordion title="Does DSALTA change my Nebius configuration?">
    No. DSALTA uses **read-only IAM access** and never modifies, creates, or deletes resources. All remediation is performed by your team directly in Nebius.
  </Accordion>
</AccordionGroup>