Examples of non-human identities
- Service accounts in your directory
- App registrations and service principals in Entra ID
- API keys and personal access tokens
- OAuth grants that let one app act inside another
- AI agents and the tokens they hold
Why do non-human identities matter?
There are far more of them than there are people. CyberArk's 2025 Identity Security Landscape put machine identities at 82 for every human one.
They also lack the controls people have. Most cannot use MFA. Many have no owner, and their secrets often outlive the project that created them. An attacker who finds a working key gets everything it was allowed to do.
How do you govern non-human identities?
- Keep an inventory, with the app or person that depends on each one.
- Give each identity a named owner.
- Remove permissions it has not used.
- Set an expiry on keys and secrets, and replace them before it passes.
- Review them in the same campaigns as human access.
Frequently asked questions
Is a service account a non-human identity?
Yes. A service account runs a job or an integration instead of a person. App registrations, API keys, tokens and AI agents count too.
Can a non-human identity use MFA?
Most cannot. They prove who they are with keys, certificates or tokens. Protect those with an expiry date, narrow permissions and a named owner.
Who should own a non-human identity?
The person or team that depends on it. When that owner leaves, the identity needs a new owner the same week, or it should be switched off.