Isolate VMs using service accounts