Hi Kara Shindle,
This is a great question, and there are actually a few different answers to it depending on your perspective and which accounts you're discussing - OS tier accounts or GIS tier accounts in ArcGIS for Server (specifically).
Let's start with OS tier accounts, since I'm assuming that these is what your IT mandates 3 month rotation.
In terms of OS accounts, the best answer you could have been provided would have been to use a gMSA (Group Managed Service Account). A gMSA is a special account used on Windows domains where password management is handled by the OS, passwords are generated on the fly based on key exchange, and is never actually known by a user.
Using a gMSA can be done already in 10.7.1 and earlier. The use of a gMSA account precludes the need to reset passwords at all. See:
How To: Configure ArcGIS Enterprise to use a group-managed Service Account
More: At 10.8, gMSA is supported at install time. Prior to 10.8, the software needs to be installed under a 'standard' account, then later moved to a gMSA.
You are correct that updating the ArcGIS Account (the os/domain account that 'owns' the ArcGIS processes) will cause a restart of the ArcGIS Server processes - that must happen when rights to files on disk used by a process change. The Configure ArcGIS Account utility handles permission updates for you.
In terms of the web adaptor, that process is typically run under the context of the IIS application pool identity. Updating the ArcGIS account will not change the application pool identity and does not itself require updating the web adaptor.
From the other perspetive, there's the GIS tier. That's the built-in user and role store that ships with ArcGIS Server.
If those passwords should be rotated, I'd recommend integrating ArcGIS Server with your Windows Active Directory, which allows for centralized administration.
We'd also typically recommend disabling the Primary Site Administrator (PSA) account. This is the account that's typically used when configuring the web adaptor. Disabling the PSA will not break communication between the Web Adaptor and the GIS Server. Disabling the PSA would prevent you from changing the user and role store from the built in store to the enterprise store (active directory). You should promote one or more trusted domain accounts to the ArcGIS Server administrator role prior to disabling the PSA.
Another consideration you may need to think about is if using older patterns like embedded passwords in proxy pages that web applications may use to communicate with the GIS Server.
Other than that, I haven't personally run into issues when updating service accounts or built-in accounts. If others out there in GeoNet-land have considerations I haven't thought about for password update workflows, I'd appreciate the dialog in the continued comments.
Best,
Randall
Esri Software Security and Privacy, Esri PSIRT
