Alternative authentication method for environments where Primary Site Admin has been disabled to align with Hardening Guidelines published by Esri

RachaelWebster13

Following a malicious attack on our ArcGIS Enterprise environment, we have disabled the primary site admin account that was compromised during the attack.  Since we disabled the account, Monitor is no longer reporting metrics on services tied to the server site.  I would like to have an alternative authentication method that allows us to keep the primary site admin account disabled to meet the recommendations in Esri's Hardening Guide.

lvargas

Hello,

I would like Esri to consider one or more of the following improvements in a future ArcGIS Monitor release:

1. Allow ArcGIS Server registration using a Portal for ArcGIS administrator account

ArcGIS Monitor should support registering and monitoring a federated ArcGIS Server site by using a Portal for ArcGIS administrator account instead of requiring the ArcGIS Server PSA account.

This would allow organizations to keep the PSA account disabled while still allowing ArcGIS Monitor to collect the required metrics from the federated server.

1. Add support for a custom Portal role for ArcGIS Monitor

It would be helpful to provide specific privileges in Portal for ArcGIS that can be assigned to a custom role for ArcGIS Monitor.

This would allow organizations to create a dedicated Monitor service account with only the minimum required privileges, instead of requiring a full Portal administrator or the ArcGIS Server PSA account.

Ideally, this custom role would allow ArcGIS Monitor to collect health, performance, service, machine, log, and availability metrics without granting unnecessary administrative permissions.

1. Provide an ArcGIS Enterprise identity-based option for ArcGIS Data Store registration

ArcGIS Monitor should also provide a supported way to register and monitor ArcGIS Data Store using an ArcGIS Enterprise identity, delegated credential, or Monitor-specific service account model.

This would reduce the need to manage separate native Data Store administrative credentials only for monitoring purposes.

This request is especially relevant for organizations with strict security policies where built-in administrator accounts must be disabled, and monitoring tools must use dedicated service accounts with controlled privileges.