A system for impersonating a target account of a service accessed by a client application, the system comprising: one or more computer readable storage media; and program instructions stored on the one or more computer readable storage media that, when executed by at least one processor, cause the at least one processor to at least: receive, at a service , a request for granting an administrator access rights to a target account of the service, wherein the request is issued from a temporary account of the service via a client application, wherein the administrator has access to the service via the temporary account; determine whether the temporary account is stored in a mapping table comprising one or more temporary accounts mapped to corresponding impersonation tokens; when it is determined that the temporary account is stored in the mapping table, identify the corresponding impersonation token mapped to the temporary account, wherein the corresponding impersonation token grants the administrator access rights to the target account; and process the request in an impersonation mode based on the identified impersonation token, including processing the request as if the administrator has access rights to the target account. one or more computer readable storage media; and program instructions stored on the one or more computer readable storage media that, when executed by at least one processor, cause the at least one processor to at least: receive, at a service , a request for granting an administrator access rights to a target account of the service, wherein the request is issued from a temporary account of the service via a client application, wherein the administrator has access to the service via the temporary account; determine whether the temporary account is stored in a mapping table comprising one or more temporary accounts mapped to corresponding impersonation tokens; when it is determined that the temporary account is stored in the mapping table, identify the corresponding impersonation token mapped to the temporary account, wherein the corresponding impersonation token grants the administrator access rights to the target account; and process the request in an impersonation mode based on the identified impersonation token, including processing the request as if the administrator has access rights to the target account. receive, at a service , a request for granting an administrator access rights to a target account of the service, wherein the request is issued from a temporary account of the service via a client application, wherein the administrator has access to the service via the temporary account; determine whether the temporary account is stored in a mapping table comprising one or more temporary accounts mapped to corresponding impersonation tokens; when it is determined that the temporary account is stored in the mapping table, identify the corresponding impersonation token mapped to the temporary account, wherein the corresponding impersonation token grants the administrator access rights to the target account; and process the request in an impersonation mode based on the identified impersonation token, including processing the request as if the administrator has access rights to the target account. <EOS>