Solutions / Non-human identity
Most of the identities in your tenant are not people.
Service principals, app registrations, managed identities, CI/CD credentials and the agent identities arriving with Copilot now outnumber staff accounts in most Microsoft 365 tenants, often by a wide margin. None of them can complete multifactor authentication, most were created for a project and never reviewed, and many still authenticate with a client secret sitting in a pipeline variable. Identra inventories what you have, removes the credentials that can be stolen, puts Conditional Access and risk detection around what remains, and leaves behind an ownership record that survives the person who built it.
- Products
- Entra Workload ID, Conditional Access, ID Protection, Access Reviews
- License requirement
- Workload ID Premium for CA, ID Protection and app health
- Delivery mode
- Remote-first, US timezone
- Delivery
- Fixed scope, fixed price
01 / What we configure
Four workstreams, in the order they have to happen.
- 01
Inventory and ownership
Every service principal, app registration and managed identity in the tenant, listed with its credential type, credential age, Graph permissions, Azure role assignments, last sign-in and consent grant. Each one gets a named human owner and a stated purpose. The ones nobody claims are the finding: dormant identities holding live permissions are the most common way an old project becomes this year’s incident.
DiscoveryOwnershipDormant identities - 02
Credential elimination
Client secrets are the credential a person can copy. Azure-hosted workloads move to managed identities, which have no secret to steal. Workloads outside Azure, including GitHub Actions and other CI/CD, move to workload identity federation, so the pipeline presents its own token instead of holding a secret. Where neither fits, secrets become certificates with a documented rotation owner and expiry alerting.
Managed identityFederationCertificate credentials - 03
Least privilege
Graph application permissions compared against what each identity has actually called. The pattern we find repeatedly is a one-purpose integration holding Directory.ReadWrite.All because it was quicker at the time. Permissions cut to observed usage, admin consent re-approved against a stated business case, and Azure role assignments scoped to a resource group instead of a subscription.
Graph permissionsConsent reviewScope reduction - 04
Enforcement and monitoring
Conditional Access for workload identities blocks single-tenant service principals authenticating from outside your known IP ranges or at a detected risk level. ID Protection raises service principal risk on leaked credentials and anomalous sign-ins. Access reviews run on the identities holding privileged roles. Sentinel alerts on new credential creation and consent grants, which is how takeover attempts announce themselves.
Conditional AccessID ProtectionSentinel alerts
02 / What it looks like
Three non-human identity engagements.
The same four workstreams, weighted differently by what the tenant grew into.
Head of Platform at a SaaS company on Azure
Situation. Several hundred service principals accumulated across product teams with no register. A secret expired over a weekend and took a production integration down. Nobody could say which team owned it or what else was about to expire.
Outcome. Full inventory with named owners. Azure-hosted workloads moved to managed identities, removing the expiry problem outright. Remaining secrets replaced with certificates and expiry alerting into the platform team’s channel. Dormant principals disabled after an owner-confirmation window, then deleted.
CISO at a financial services firm
Situation. An examiner asked how privileged non-human access is reviewed. The tenant had privileged Graph permissions on integrations created years earlier, no review process, and no way to show who approved the original consent.
Outcome. Graph permissions cut to observed usage. Access reviews configured on every service principal holding a privileged role, with the application business owner as reviewer. Conditional Access restricting those principals to known ranges. Review decisions and consent history export as examiner evidence.
IT Director preparing for Copilot and agent rollout
Situation. Agent identities were about to be created at a pace the existing joiner and leaver process was never designed for, with no standard for what an agent may reach or who answers for it.
Outcome. A standard applied before rollout: every agent identity gets a named owner, a scoped permission set, an expiry date and a review cycle. Application management policies enforce credential rules at creation. Sentinel alerts on any agent identity granted permissions beyond the approved set.
03 / Frequently asked
What buyers ask first.
- What is a non-human identity?
- A non-human identity is any account that authenticates without a person behind it. In a Microsoft tenant that means service principals and app registrations, managed identities for Azure resources, workload identities federated from CI/CD systems, and the agent identities created by Copilot and similar tooling. They differ from staff accounts in three ways that matter: they cannot complete multifactor authentication, they often have no joiner, mover or leaver process, and their credentials have to be stored somewhere a process can read them.
- Why can we not just apply our existing Conditional Access policies?
- Because they do not apply. A Conditional Access policy assigned to a group containing a service principal is not enforced for that service principal; it has to be assigned directly to the policy as a workload identity. The available conditions are also narrower: location and service principal risk, with block as the only grant control, because there is no second factor to require. Managed identities are not covered by Conditional Access at all, which is why they belong in access reviews instead.
- What does Workload ID Premium cost, and do we need one per identity?
- Microsoft lists Workload ID Premium at $3 per workload identity per month. It is a standalone product, not included in Microsoft 365 E5 or the Entra Suite. The licensing detail most people expect to be worse than it is: assignment is not required, and one licence in the tenant unlocks the features, though Microsoft asks you to hold licences matching the number of identities using premium features. Only enterprise apps and service principals eligible for the premium features need licensing. Microsoft applications and managed identities are not eligible for Conditional Access or ID Protection. A 90-day trial is available.
- Which parts are free?
- Creating and managing workload identities, managed identities, workload identity federation, sign-in activity and audit logs, and application management policies all come with an Azure or Microsoft 365 subscription. The premium tier adds Conditional Access for workload identities, ID Protection for workload identities, access reviews for privileged service principals, and app health recommendations that surface unused identities. A meaningful amount of this work, particularly moving off client secrets, needs no premium licence at all.
- Should every service principal become a managed identity?
- Every one that can. A managed identity has no credential to leak, which removes an entire class of incident, and Azure handles rotation. The constraint is that managed identities only work for workloads running on Azure resources that support them. Workloads elsewhere, including GitHub Actions and other external CI/CD, should use workload identity federation so the pipeline presents a token from its own provider rather than holding a secret. Certificates with documented rotation are the fallback, and a client secret should be the last resort with a short expiry.
- How long does an engagement take?
- A tenant inventory with an ownership register and a prioritised finding list runs 2 to 3 weeks. Full remediation depends on how many workloads move to managed identity or federation, since each one is a change to someone’s deployment pipeline and needs their release window: 6 to 12 weeks is typical. Conditional Access for workload identities is deployed in report-only mode first, because blocking a service principal breaks a process rather than inconveniencing a person.
04 / Related