I am sure this is easier said than done, but is there a more secure way to provide ArcGIS Monitor access to ArcGIS for Portal and ArcGIS Server other than using the primary service account? Esri's own documentation recommends disabling the primary service accounts after the initial setup is complete.
What I have in mind is being able to use an account (ArcGIS built-in, SAML, etc.) that has read only access to all content in ArcGIS for Portal and ArcGIS Server. That probably requires enhancements to both ArcGIS for Portal and ArcGIS Server because I do not think that permission is available in that software.
A ready only account that has headless access to everything in my environment is much less scary to me than a headless read/write account that has access to everything.
