# Ensure Service Account Was Used Within the Configured Maximum Unused Period

- Source: https://support.icompaas.com/support/solutions/articles/a_1788888305532128-ensure-service-account-was-used-within-the-configured-maximum-unused-period
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that service accounts which have not authenticated at all within a configured maximum unused period (for example, 90 days) are identified and disabled or deleted, reducing the number of dormant identities with standing IAM permissions in the environment.

**Rationale**

A service account is classified as unused when it has not authenticated for an extended period, commonly 90 days; a dormant service account still holds whatever IAM roles have been granted to it, and if compromised (for example, through a leaked key or misconfigured impersonation permission), it can be used for lateral movement or privilege escalation without anyone noticing, since it is not part of normal operational activity. Regularly identifying and disabling unused service accounts reduces the number of dormant identities that represent unmonitored risk in the environment.

**Impact**

-   Reduces the number of dormant identities with standing IAM permissions in the environment
    
-   Limits opportunities for lateral movement or privilege escalation via forgotten service accounts
    
-   Requires confirmation that a flagged account is not used for a legitimate, infrequent process before disabling
    

**Default Value**

GCP does not automatically disable or delete unused service accounts; identification relies on the Recommender API's service account insights, which flag accounts with no authentication in the past 90 days, or a custom threshold defined via Activity Analyzer.

**Pre-Requisites**

-   The Recommender API enabled for the project
    
-   IAM permissions to view service account insights and manage service accounts (e.g., Project IAM Admin)
    
-   A documented maximum unused period approved by the organization
    

**Test Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to IAM & Admin > Service Accounts.
    
4.  Review the Recommendations tab for service account insights identifying accounts unused beyond the configured period.
    
5.  Cross-reference with Cloud Monitoring service account usage metrics to confirm the account is genuinely inactive and not used via delegated or external authentication paths.
    
6.  If a service account exceeds the maximum unused period, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to IAM & Admin > Service Accounts and select the flagged service account.
    
4.  As a precaution, disable the service account first rather than deleting it immediately.
    
5.  Monitor for any failures from systems or workflows that may have depended on the account.
    
6.  After a defined observation period with no reported issues, delete the service account if it is confirmed unnecessary.
    
7.  Document the service account name, justification, and disposition (disabled or deleted) for audit purposes.
    

**Backout Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to IAM & Admin > Service Accounts and select the affected service account.
    
4.  If the account was only disabled (not deleted), select Enable to restore it.
    
5.  If the account was deleted, note that it can be undeleted within 30 days of deletion using the Undelete option; after 30 days it is permanently removed and must be recreated with its IAM bindings reconfigured.
    

**Reference**

-   [https://cloud.google.com/policy-intelligence/docs/service-account-insights](https://cloud.google.com/policy-intelligence/docs/service-account-insights)
    
-   [https://cloud.google.com/iam/docs/service-account-overview](https://cloud.google.com/iam/docs/service-account-overview)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.