Least Privileged for SharePoint

1. SQL Server Service Account (sp_sql): run mssql server, mssql agent svc
- Standard Domain User Account

2. SharePoint Setup User (sp_admin): run as logon account when install SP or configure SP
- Standard Domain User Account
- Local admin group of every sp server of the farm
- SQL role: db server security, db creator, db admin

3. Server Farm/DB Access Account (sp_farm) 
- Standard Domain User Account

Create account for every services
-App Pool Account
-App Pool Account for BDC service app, excel app, ..