Non-human identity sprawl: what it is, why AI made it worse, and how to reduce it.

Directory accounts created for a system rather than a person. Long-lived by design, frequently shared, and often holding privileges granted for a migration that finished years ago.

Application registrations in Entra, IAM roles in AWS, workload identities in Kubernetes. These are the modern, better-designed form — but they still accumulate, and they still expire silently.

Issued in seconds, pasted into a config file, and rarely rotated. The population is larger than any directory shows because many were never issued by the directory at all.

A user consents once; the application holds delegated access indefinitely. This is how a personal AI account acquires standing access to a corporate mailbox.

The identity an agent authenticates as when it calls a connector or another system. The fastest-growing category, and the one least likely to be registered anywhere.

The overlooked case, and the worst one. An agent with no machine identity runs as the person who created it — so every call it makes appears in every downstream log as that human’s activity, and there is nothing to scope, rotate or revoke short of disabling their account.

An integration needs a credential, so one is created. It works, so nobody revisits it. This is the oldest source and the best understood.

Copilot Studio, Power Platform and similar tools let a business user publish something that acts on systems. No security review is required to publish, so none happens, and the resulting identity is invisible to an IAM programme that watches only the directory.

One click grants an external application delegated access. The user believes they have logged in; what they have actually done is provision a long-lived non-human identity into the tenant.

The newest and hardest case. An agent can gain access through tool use, OAuth flows and role assumption while it runs — which means the standing privilege recorded against its credential understates what it can actually reach at any given moment.

Non-human identities divided by human identities. Useful as a trend rather than a target — what matters is whether it is rising faster than your ability to attach owners.

The share with a named accountable person. This is usually the worst number in the set and the most actionable, because it is fixed by a decision rather than by engineering.

Identities whose creator has left, or whose workload no longer exists. Standing access with nobody on the other end of it.

How old the oldest live secret is, how many expire in the next ninety days, and how many have already expired without anyone noticing. An expired credential that still appears in an inventory is a different problem from a rotating one.

The share holding administrative or write access, and how many of those are also inactive. This is where the 1-in-20 admin figure becomes a specific list rather than an industry statistic.

Read the identities out of Entra, the cloud IAM services, the agent platforms and the OAuth grant list. A register people are asked to fill in is stale on the day it is finished, because the teams creating identities fastest are the ones least likely to fill it in.

Do not try to own the whole population at once. Start with the identities that can write, delete or send data outside the tenant, and force a named person against each. Ownership is the control that makes every later control enforceable.

An agent running as its creator cannot be scoped or revoked independently. Issuing a machine identity is what converts the agent from an extension of a person into something governable.

Every new identity gets a scope and an end date when it is created. Retrofitting expiry onto a live population is slow; preventing the next thousand from entering ungoverned is fast.

Identities are created in seconds. A review cadence designed for human joiner-mover-leaver events is structurally unable to keep pace, and a quarterly number is out of date before it is presented.

Non-human identities are read from Entra and the agent platforms together, so the register shows both the credentials that exist and the agents that hold none — which is the population conventional NHI tooling cannot see, because there is no credential to find.

Each identity carries a proposed accountable person drawn from platform data, which a human confirms or rejects. Credential expiry and rotation posture are tracked, so an expired secret is reported as expired rather than quietly counted as present.

Least-privilege decisions compile into Microsoft Purview, Intune, your SASE and your AI gateway rather than into a console of ours. Where a platform exposes a read-back path, the applied state is read back and marked verified — and where it does not, the state is reported as compiled rather than shown green.