Least-privilege account in Web Client installation

When prompted to provide a service account during the Web Client installation, you can use a least-privilege account. The least-privilege account you provide is then configured to run the microservices for the Web Client. This user account should have access to the AVEVA Production Management Web API, which means it should be part of a user group with permission to the Web API endpoints.

In the installation process, the least-privilege account is given required access to the Web Client-related installation folders and resources. When using a least-privilege account for running the services, you need to grant read permissions to the root CA's private key of the certificate to be used during Web Client configuration. If the root CA is not available locally, grant read permissions to the certificate itself.

The certificate is a self-signed SSL trusted certificate, which should be assigned with a friendly name during its generation. This ensures that the certificate appears in the Web Client configuration tool's list of certificates. For more information on certificates requirements, see IT certificate requirements.

For more information about least-privilege account, see Installing AVEVA Production Management with least-privilege account in the AVEVA Production Management Installation Guide.