Service account requirements
Azure DevOps Server 2022 | Azure DevOps Server 2020 | Azure DevOps Server 2019 | TFS 2018
You must use service accounts to install any of the following Azure DevOps on-premises servers:
- Azure DevOps Server
- Team Foundation Server (TFS)
- Team Foundation Build
- Team Foundation Server Proxy.
Also, if you use SQL Server Reporting Services, you also must have a report reader account when you install Azure DevOps on-premises. Azure DevOps servers require multiple identities for installation, but you can use a single account for all the identities if that account meets the requirements for all the identities for which you use it.
Tip
Confused about accounts? A tutorial is available that covers how to create accounts and groups for a single-server installation. For more information, see Set up groups for use in Azure DevOps.
Best practices for working with service accounts
Here are some best practices for working with Azure DevOps service accounts:
- If you use domain accounts for your service accounts, use a different identity for the report reader account.
- If you are installing a component in a workgroup, you must use local accounts for user accounts.
Note
To make it easier to discuss the different accounts that Azure DevOps on-premises requires, this article uses example placeholder names. You don't have to use these placeholder names for any accounts that you might create. 2.
Network Service or built-in accounts
Azure DevOps Server, Team Foundation Server, Team Foundation Build, and Team Foundation Server Proxy all require a service account. These service accounts become the identity for the installed component. By default, every component uses a built-in account (such as Network Service) as its service account. You can change this account to a user account when you install the component, but you must ensure that any user accounts that you use have Log on as a service permissions.
Tip
Built-in accounts don't use passwords. Built-in accounts already have Log on as a service permissions, so they're easier to manage, especially in a domain environment.
Azure DevOps service accounts
The service accounts in the following table are the identities for Azure DevOps Server or Team Foundation Server and their components. The service account for Azure DevOps Server is also used in Internet Information Services (IIS) as the identity of the application pool for Azure DevOps Server.
Component
Sample user logon name
Requirements
Azure DevOps Server
AzureDevOpsService
You can specify a built-in account or a user account. If you specify a user account, it must have Log on as a service permissions.
You must not use the account that you use to install Azure DevOps Server as the account for AzureDevOpsService. For example, if you are logged in as domain\user1 when you install Azure DevOps Server, don't use domain\user1 as the account for AzureDevOpsService.
Default: Network Service
Team Foundation Build
TFSBUILD
You can specify a built-in account or a user account. If you use a user account, it must have Log on as a service permissions.
Azure DevOps Server Proxy
AzureDevOpsServerProxy
You can specify a built-in account or a user account. If you use a user account, it must have Log on as a service permissions.
SQL Server service account
The SQL Server service account is an identity that runs Windows services for SQL Server. In the following example, SQLSERVICE is a placeholder name.
| Sample user logon name | Requirements |
|---|---|
| SQLSERVICE | You can use a built-in system account or set up an account before you install SQL Server. Azure DevOps Server and Team Foundation Server has no requirements for this account. |
Report reader account
The report reader account is the identity that's used to gather information for reports. If you use SQL Server Reporting, you must specify a report reader account when you install Azure DevOps Server.
| Feature | Sample user logon name | Requirements |
|---|---|---|
| Reporting | AzureDevOpsServerReports | You must specify a user account that has Allow log on locally permissions. Default: You're prompted for this account. You can't use a built-in account for the report reader account. |
See also SQL Server Reporting Services roles.