> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/3.0/harness-platform-resources/platform-access-control/heirarchichal-support-for-service-accounts.md).

# Hierarchical Support for Service Accounts

{% hint style="info" %}
**FEATURE AVAILABILITY**

This feature is behind the `PL_ENABLE_SERVICE_ACCOUNT_HIERARCHY` feature flag. Contact [Harness Support](mailto:support@harness.io) to enable it.
{% endhint %}

Service accounts can be created at a higher scope and inherited by lower scopes with the necessary permissions, eliminating the need to create separate accounts for each organization or project.

The following example shows how to use an account-level service account in a project. You can apply the same process to use account-level service accounts in organizations.

{% tabs %}
{% tab title="Interactive" %}
{% embed url="<https://app.tango.us/app/embed/d998701a-487a-4dd3-b2f2-45869a797143>" %}
{% endtab %}

{% tab title="Manual" %}

#### Step 1: Create account-level service account <a href="#step-1-create-account-level-service-account" id="step-1-create-account-level-service-account"></a>

Create a [Service Account](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-and-manage-service-account.md#create-a-service-account) at the account level. This service account can then be inherited by organizations or projects.

#### Step 2: Create project-level role and resource group <a href="#step-2-create-project-level-role-and-resource-group" id="step-2-create-project-level-role-and-resource-group"></a>

In your target project:

* Create a [Role](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-manage-roles.md#create-a-role) with the required permissions
* Create a [Resource Group](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-resource-groups.md#create-a-resource-group) defining what resources can be accessed

{% hint style="info" %}
Roles and resource groups can only be modified at the scope where they were originally assigned. Inherited roles and resource groups are visible at lower scopes but cannot be edited there.
{% endhint %}

#### Step 3: Inherit and assign permissions <a href="#step-3-inherit-and-assign-permissions" id="step-3-inherit-and-assign-permissions"></a>

1. Navigate to **Project Settings** → **Access Control** → **Service Accounts**
2. Select **Inherit Service Account & Assign Roles**
3. Choose your account-level service account
4. Assign the project-level role and resource group
5. Select **Apply**

The service account is now available for this project.
{% endtab %}
{% endtabs %}

{% hint style="info" %}
When a service account is inherited from the account scope to a project scope, the system automatically assigns the Organization Viewer role to that service account for the organization containing the project. The role assignment is also recorded in the Audit Logs.

If this role assignment is removed, the service account may lose access to the Organization.
{% endhint %}

### Benefits <a href="#benefits" id="benefits"></a>

* **Centralized Service Account Management**: Reduces the need to create and manage multiple service accounts for each project.
* **Simplified Permissions**: Easily manage permissions at the project level by assigning roles to service accounts created at the account or organization level.
* **Seamless Pipeline Execution**: One or more service accounts can be given the necessary permissions, if required, to execute pipelines from multiple projects.

### Additional Resources <a href="#additional-resources" id="additional-resources"></a>

For more information on how to manage service accounts, create roles, and assign permissions in Harness, refer to the following documentation on Harness Developer Hub:

* [Managing Service Accounts](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-and-manage-service-account.md)
* [Creating and Managing Roles](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-manage-roles.md)
* [Assigning Roles and Permissions](/harness-ai/use-harness-platform/platform-access-control.md)