YouAttest for Non-Human Identity Reviews
Finally Know Who Is Reviewing Your Machine Accounts
Bots, Service Accounts, APIs, Automation All Have Access
But Who Is Accountable For Them?
Service accounts, app registrations, API credentials, bots and AI agents all have access to your systems, and most have no one accountable for them. YouAttest discovers these non-human identities, scores their risk, ties each one to a real human owner, and brings them into regular access reviews.
What Is a Non-Human Identity?
A non-human identity (NHI) is any account or credential that authenticates without a person behind it, such as a service account, application or service principal, API key, automation bot, or AI agent. NHIs often hold broad permissions, never log in interactively, and have no manager, so they fall outside normal joiner-mover-leaver processes and are rarely reviewed.
Why Non-Human Identities Are Hard to Govern
Most organizations can’t answer basic questions
Basic Questions
- Who owns this service account?
- Why does this bot still have access?
- Who approved this API credential?
- When was this last reviewed?
Reality
- NHIs are orphaned
- Reviews are inconsistent or skipped
- Accountability is non-existent
Result
- Audit failures
- Security gaps
- Uncontrolled access risk
How YouAttest Governs Non-Human Identities
- Discover and classify. In Microsoft Entra ID, YouAttest runs a read-only scan through Microsoft Graph that inventories app registrations, service principals, managed identities, workload identities and likely AI agents. For any other system, export the accounts to a CSV and tag non-human identities with the Identity Type field.
- Score the risk. Each Entra NHI gets a 0–100 risk score (Low, Medium, High or Critical) based on named factors: no assigned owner, overly broad or admin permissions, expired or never-rotated credentials, dormant activity, or an unverified publisher. Every point comes with a plain-language reason and a remediation step. Any NHI holding a standing Global Administrator role is always flagged Critical.
- Attach a human owner. Every NHI is tied to an accountable person, its “heartbeat.” Identities with no owner are flagged as a risk, so nothing stays orphaned.
- Review on a schedule and export the evidence. Schedule recurring NHI reviews, monthly, quarterly or yearly, like any other identity. Reviewers certify, revoke or delegate each NHI, filtering Human vs. Non-Human IDs in the same campaign. Results export with an IdentityType column, giving auditors a record of who reviewed each machine identity and when.
Risk-Score Every NHI
Each NHI gets a 0–100 risk score with a plain-language reason and fix for every point.
Heartbeat (Ownership Validation)
Confirm ownership at every scheduled review
Force a Review
No owner = no approval
No review = no access
YouAttest
Take Control of Your Non-Human Identities
Find Shadow AI Before It Finds Your Data
AI tools and agents often arrive as app registrations and service principals that nobody approved. YouAttest adds an “AI agent probability” layer to Entra discovery. It looks at naming patterns, data-access scope, publisher trust and ownership to surface unsanctioned or ungoverned AI for review.
Frequently Asked Questions: Non-Human Identity Reviews
What counts as a non-human identity?
Any identity that authenticates without a person, including service accounts, application registrations and service principals, managed and workload identities, API keys, automation bots and AI agents.
Does the Entra ID scan change anything in our tenant?
No. The scan is read-only through Microsoft Graph. Nothing is written, changed or deleted, and credential secrets are never read, only metadata such as expiry and rotation age.
What permissions does the Entra ID NHI scan need?
At minimum, Application.Read.All and Directory.Read.All (read-only). Optionally, AuditLog.Read.All (requires Entra ID P1 or P2) enables dormancy detection, and RoleManagement.Read.Directory enables the Global Administrator check.
How is NHI risk scored?
Each identity is scored 0–100 on weighted factors such as missing owner, broad permissions, stale credentials, dormancy and unverified publisher, then rated Low, Medium, High or Critical. Applications, service principals and AI agents are scored independently, so one risky app doesn't inflate an unrelated score.
Can we review non-human identities from systems other than Entra ID?
Yes. Export accounts from any system to CSV, map your non-human ID column to the Identity Type field, and YouAttest separates Human and Non-Human IDs in the review and the exported report.
Who reviews a non-human identity?
Its accountable human owner, such as an application owner, system owner or platform team. You can auto-delegate to managers or assign reviewers individually or in bulk.
How does YouAttest detect AI agents?
It applies a heuristic "probability this is an AI agent" score based on naming patterns, data-access scope, publisher trust, ownership and creation date, so unsanctioned AI tools surface for review.
Can NHI reviews run automatically?
Yes. Schedule recurring campaigns for non-human identities monthly, quarterly, bi-annually or yearly, the same as for human identities.