Best method to change IAA and PSA passwords

Question

I’m working on improving our security practices and ensuring our systems remain well‑protected. I’m interested in learning how the broader ESRI community manages their IAA and PSA accounts, particularly in situations where an administrator leaves or when a password change is required to maintain tighter security.

If I decide to update the IAA password, I know I need to update it across all scripts that reference it, including the Portal Admin PostgreSQL endpoint, the WebGISDR script, and the built‑in Portal admin account. Are there any other locations where this password must be updated to ensure that we won’t be prompted for the previous password during an upgrade?

I would also appreciate feedback on whether your organizations use the same password for the IAA and PSA accounts. This seems convenient from an administrative standpoint, but also potentially risky from a security perspective.

Thank you in advance for any insights or recommendations.

RandallWilliams · Answer

There are a few, limited workflows that require the built-in IAA and PSA accounts, but those are few and far between. I'd suggest moving users to organization specific logins like SAML, which support MFA. Like @JoshuaBixby mentioned, you can then promote members to admin and disable the IAA and PSA accounts. That way password and user management functions are centralized.

LavanyaVasudevanNES · Answer

Thankyou.  This is what got me thinking maybe the IAA and the PSA shouldnt be the same credentials.

JoshuaBixby · Answer

Assuming you already have seen the following, so I am posting this for others that may find this question and am looking for "best practice" from Esri.

From ArcGIS Enterprise implementation guidance—ArcGIS Trust Center | Documentation:

* Disable the ArcGIS Server Primary Site Administrator (PSA) account, and demote or delete the Portal for ArcGIS Initial Administrator Account (IAA).* Disabling the default accounts ensures a singular access path for administrators identified in the enterprise identity store and provides additional accountability.