Create a service account for an application

What you'll achieve

A service account — a machine login for an application — with the right permissions for its job, and its credentials stored in your business unit's Azure Key Vault, ready to hand to the application team.

Before you start

• This is admin territory: the Access Management section only appears in the sidebar for admins. If you don't see it, ask your team's admin to do this (or to grant you the role).
• Know what the application does — that decides the Type: writing data (Producer), reading data (Consumer), both plus stateful processing (Stream Processor), running Flink SQL (Flink Developer), or monitoring only (Metrics).
• A Key Vault is set up for your context — if the sidebar entry is greyed out with "Key Vault not configured for this context", contact the platform team first.

Steps

1. Click Service Accounts in the sidebar (under Access Management), then Add Service Account.
2. On the Single tab, pick the Type — the box below the dropdown shows exactly which permissions ("Role Bindings") it grants.
3. In Name, type a short identifier for the application — for example order-producer. The Display Name Preview shows the final account name with your unit and stage added automatically.
4. If a Topic Prefix field appears, you can narrow which topics the account may touch (e.g. payments*); leaving it empty allows all of your team's topics.
5. Click Create Service Account.

What success looks like

A "Service Account Created" card shows the account's Name, ID and Type, and an API Key card shows which Key Vault the credentials were stored in, plus the Key Vault Key Name and Key Vault Secret Name. The secret value itself is deliberately never shown — it went straight into Key Vault. Hand the application team those three things (vault + two secret names); they fetch the values with the Azure CLI or Portal.

Something went wrong?

• A red box saying "Key Vault storage failed — copy this secret NOW" — the vault write failed, so this screen is the only time the secret is ever shown. Copy it somewhere safe immediately, then tell the platform team the Key Vault write failed.
• "Service account created with warnings" — part of the setup (a permission or the vault write) didn't complete; check the details on the card and contact the platform team before handing anything over.
• The key got lost later? Nothing is lost: the secret lives in Key Vault — open the account, go to the API Keys tab and use the secret names shown there. If the vault copy is really gone, use Rotate Key there instead: it makes a fresh secret (stored in Key Vault) and the old one stops working, so warn the application team to switch.
• Deleting a service account is admin-only — the delete will be refused for anyone else, even where the button is visible.

Background — all account types, naming, and bulk creation? Read the Service Accounts guide. Prefer logins without stored secrets? Consider an identity pool instead.