Least-privilege credentials for collectors

What access a collector actually needs for discovery, SNMP, and credentialed checks — and what to avoid granting.

Updated Aug 24, 2026Product 2026.96 minMSP operator, Internal IT, Platform admin

Overview

A collector uses two separate kinds of trust: its own identity with the AssurIQ control plane (the collector credential issued at enrollment), and any target credentials stored in the Credential Vault that it uses to authenticate to devices during discovery and assessment. Treat both with least privilege.

Credentialed checks (WinRM/SSH) described in this article are not active in the current v0.1 collector, which performs uncredentialed TCP-connect discovery only. This article documents the intended least-privilege model for when credentialed modules ship. See What the v0.1 collector does today.

What the v0.1 collector does today
A plain list of what the native v0.1 collector supports right now versus what is designed but not yet active, and what the DEV build badge means.

Collector identity

The collector's own credential only authorizes it to talk to the AssurIQ control plane; it grants no direct access to any customer system by itself. It can be revoked independently of any target credential, and revocation takes effect immediately — the collector cannot authenticate again until re-enrolled with a new token.

Scope target credentials narrowly

Module	Minimum access needed
SNMP Discovery	Read-only SNMPv3 (or v2c community as a fallback) — never a write community string
Host Inventory / Vulnerability Probe	A local account with read access to installed software, patch level and configuration; not a full domain admin
Configuration Collection	Read-only device management access (show/display commands only)
Active Directory Assessment	A read-only service account with directory-read permissions; no write or reset rights
Local Evidence Collection	Read access to the specific artifacts the module collects, not full filesystem access

Avoid domain admin

Never store a domain administrator or enterprise administrator account as the credentialed-scan account. A read-scoped account dramatically reduces blast radius if the credential is ever compromised, without reducing what AssurIQ can assess.

Rotation and lifecycle

Rotate stored target credentials on the same cadence as any other privileged account at the customer.
Update the Credential Vault entry immediately after rotation — a stale credential causes authenticated checks to fail without affecting network-level discovery.
Remove credentials for decommissioned service accounts promptly.

Auditability

Every use of a stored credential during a job is attributable to the job run and timestamp. Review the collector audit log periodically to confirm credential use lines up with expected scan schedules.

Troubleshooting

Credential-related scan failures surface as AIQ-CRD-001 (rejected credential) rather than a collector health issue — the collector itself can be perfectly healthy while a specific target credential has expired or been locked out.

AIQ-CRD-001Credentials failing
Stored credentials were rejected by one or more targets.

Was this helpful?

collector credentials least-privilege

Proxy Configuration

Upgrade Collector