---
title: "Service accounts description"
canonical: "https://docs.cuesystem.com/space/M3SG/255918215/Service%20accounts%20description"
format: markdown
---
The service account is a typical **user email** account with **reading and writing access to the calendars of resource accounts**. The CUE system uses the service account for accessing the room's calendars. That is because the original room accounts cannot administrate themselves. 

> ℹ️ The service account **must have a Microsoft 365 user license**. Exchange Online (Plan 1) is sufficient for it.

> 📝 When using **ROPC**, [Multi-Factor Authentication](https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide) (MFA) for service account must be disabled and the service accounts must be configured to authenticate using Microsoft Identity and not your [Active Directory Federation Services](https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services) (AD FS).

# Limitations

Since there is a **limitation in access** to Microsoft 365 using Microsoft Graph to a maximum of **10 000 communication transactions per 10 minutes** for a unique combination of registered application and service account, one service account used together with the one registered application (i.e. one connection agent for units) is suitable for up to **50 touchONE devices**. 

If you need to use more devices, use another service account or create another registered application for units for every 50 devices. 

The **number of service accounts can be reduced**. In the standard configuration, one common service account can be used for sending emails, for import resources and users, and for API operations.

- If you use less than 50 CUE Solution Units, you can also use this one service account for units.
- If you use **event confirmation or orders** in CUE Assist or you **collect analytical data**, we strongly recommend that you have **a dedicated service account for API operations**.

# Service accounts for individual connection agents  

The following table provides an overview of service accounts.

| **Connection agent** | **Service account** | **Description** |
| --- | --- | --- |
| For sending email | Required | Service account with a password on behalf of which the emails are sent. |
| For import resources and users | Required | Service account with a password on behalf of which the lists of user and resource accounts are read. |
| For API operations | Required | Service account with a password on whose behalf the requested API operations are performed. The service account needs full access to resource calendars. |
| For units | Required | Service account to work with resource calendars and send emails on behalf of. The service account needs full access to resource calendars. |
| For CUE Assist | **Not** **required** | Service account is not required for this connection agent because CUE Assist users log in with their own account. |