Exam AZ-800 topic 6 question 3 discussion

Missing a step to install gMSA on the Web servers. “Configure the IIS application pool to run as a specified user account" can be understood as "run as the gMSA account."

technically gMSA is not a user account, it is more of a computer account. it has the $ symbol in its SamAccount

1. Configure the IIS app pool to run as Network Service 2. Create gMSA 3. Create the key

Coorecto

https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/getting-started-with-group-managed-service-accounts https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/create-the-key-distribution-services-kds-root-key?source=recommendations Answer is correct

the last one why is run as a specified user account and not as netowrk service?

This is correct only because the GMSA is created in local AD- because we have that as the root domain- this GMSA has to be created in the root domain- See cross domain usage- when you create a on Prem GMSA - it will work in the child domain if you have network ATP- which is a new name for Defender if you look it up https://azurecloudai.blog/2020/04/15/create-a-group-managed-service-account-gmsa/

It seems to be correct: https://shellgeek.com/group-managed-service-accounts/#Create_Group_Managed_Service_Account_gMSA_using_PowerShell