Microsoft Defender XDR
Identity protectionNon-human identities in Microsoft Defender - Microsoft Defender XDR | Microsoft Learn
In brief
The page now documents inventory insights for new, highly privileged, risky, unused, overprivileged, externally unverified, and AI-agent-used identities. It also clarifies that Salesforce inventory includes Connected Apps and External Client Apps.
What Defender admins need to know
Administrators can use these insights to filter identities needing review, including Salesforce apps and ECAs.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Non-human identities in Microsoft Defender (Preview) - Microsoft Defender XDR | Microsoft Learn
Non-human identities are accounts and applications that operate without direct human interaction. In Microsoft Defender, non-human identities include service principals registered in Microsoft Entra ID, Active Directory service accounts, and OAuth apps connected to Google Workspace and Salesforce. These identities often have elevated privileges and access to sensitive resources, which makes them a priority for security monitoring.
Actionable insights
Actionable insights appear at the top of the non-human identities inventory. Select an insight to filter the list to identities that need review.
| Insight | Description | Available for |
|---|---|---|
| New identities | Identities added in the last 30 days. | Microsoft 365 |
| Highly privileged identities | Identities with powerful permissions that allow them to access data or change important settings. For Salesforce, includes Connected Apps and External Client Apps (ECAs) whose granted permissions are classified as High. | Microsoft 365, Google Workspace, Salesforce |
| Risky identities | Identities with a high risk score. | Microsoft 365, Google Workspace, Salesforce |
| Unused identities | Identities that haven't signed in within the last 90 days. For Salesforce, includes Connected Apps and ECAs that haven't been used for more than 90 days based on the last used date. | Microsoft 365, Google Workspace, Salesforce |
| Overprivileged identities | Identities with unused permissions. | Microsoft 365 |
| Identities from external unverified publishers | Identities that originated from an external unverified publisher tenant. | Microsoft 365 |
| Used by AI Agents | Identities identified as being used by AI agent platforms. | Microsoft 365 |
Types of non-human identities
Microsoft Defender organizes non-human identities into the following categories, each shown as a tab in the identity inventory:
- Entra ID: Service principals registered in Microsoft Entra ID. These apps authenticate using OAuth and access resources through Microsoft Graph and other APIs.
- Active Directory: Service accounts from on-premises Active Directory. These specialized accounts run applications, services, and automated tasks, and often have elevated privileges.
- Google Workspace: OAuth apps connected through Google Workspace. Users authorize these apps, which have varying levels of access to Google Workspace resources.
- Salesforce: OAuth apps connected through Salesforce.
Users authorize these apps to access Salesforce dataThe inventory includes both Connected Apps andresources.External Client Apps (ECAs).
Investigate identity details
@@ -1,6 +1,6 @@ --- layout: Conceptual-title: Non-human identities in Microsoft Defender (Preview) - Microsoft Defender XDR | Microsoft Learn+title: Non-human identities in Microsoft Defender - Microsoft Defender XDR | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/defender-xdr/investigate-non-human-identities breadcrumb_path: /defender-xdr/breadcrumb/toc.json permissioned-type: public@@ -8,14 +8,14 @@ feedback_system: Standard feedback_product_url: https://techcommunity.microsoft.com/t5/microsoft-365-defender/bd-p/MicrosoftThreatProtection uhfHeaderId: MSDocsHeader-MicrosoftDefender manager: orspodek-description: Learn about non-human identities in Microsoft Defender, including OAuth apps, service accounts, and SaaS apps. Understand identity types and where to investigate them.-ms.author: abbyweisberg-author: AbbyMSFT+description: Learn about non-human identities in Microsoft Defender, including OAuth apps, service accounts, SaaS apps, identity types, and how to investigate them.+ms.author: andeshpande+author: anandd512 ms.reviewer: maelgami-ms.date: 2026-03-17T00:00:00.0000000Z+ms.date: 2026-09-28T00:00:00.0000000Z ms.topic: concept-article ms.service: microsoft-defender-for-identity-ms.custom: msecd-doc-authoring-106+ms.custom: msecd-doc-authoring-1016 ai-usage: ai-assisted locale: en-us document_id: 06529557-eb8b-ea52-899c-e46895927a54@@ -34,16 +34,16 @@ item_type: Content source_path: defender-xdr/investigate-non-human-identities.md cmProducts: - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/c671beaa-a830-4c9f-aceb-97379ee031ca+- https://authoring-docs-microsoft.poolparty.biz/devrel/1dd701e0-441f-4b0a-9806-aa47decc4e35 - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/1433a524-c01f-4b87-beab-670c040dea4f-- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/37da4cc9-0cfc-42a9-ba5e-805706b01ef8 spProducts: - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/8921374c-4dbe-4ed0-b011-a39e18bfbd98+- https://authoring-docs-microsoft.poolparty.biz/devrel/0a2fc935-5977-4aa6-9f55-0be03bd2acb8 - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/312f1f05-a431-4193-8a4d-e6245d5966de-- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/3661fb96-d414-4a4e-b7ad-9370637790dd platformId: 26953eb8-54e0-211a-5cea-41e5afc496b6 --- -# Non-human identities in Microsoft Defender (Preview) - Microsoft Defender XDR | Microsoft Learn+# Non-human identities in Microsoft Defender - Microsoft Defender XDR | Microsoft Learn Non-human identities are accounts and applications that operate without direct human interaction. In Microsoft Defender, non-human identities include service principals registered in Microsoft Entra ID, Active Directory service accounts, and OAuth apps connected to Google Workspace and Salesforce. These identities often have elevated privileges and access to sensitive resources, which makes them a priority for security monitoring.
@@ -51,6 +51,20 @@ You can view and investigate non-human identities from the [Identity inventory](
+## Actionable insights
+
+Actionable insights appear at the top of the non-human identities inventory. Select an insight to filter the list to identities that need review.
+
+| Insight | Description | Available for |
+| --- | --- | --- |
+| **New identities** | Identities added in the last 30 days. | Microsoft 365 |
+| **Highly privileged identities** | Identities with powerful permissions that allow them to access data or change important settings. For Salesforce, includes Connected Apps and External Client Apps (ECAs) whose granted permissions are classified as **High**. | Microsoft 365, Google Workspace, Salesforce |
+| **Risky identities** | Identities with a high risk score. | Microsoft 365, Google Workspace, Salesforce |
+| **Unused identities** | Identities that haven't signed in within the last 90 days. For Salesforce, includes Connected Apps and ECAs that haven't been used for more than 90 days based on the last used date. | Microsoft 365, Google Workspace, Salesforce |
+| **Overprivileged identities** | Identities with unused permissions. | Microsoft 365 |
+| **Identities from external unverified publishers** | Identities that originated from an external unverified publisher tenant. | Microsoft 365 |
+| **Used by AI Agents** | Identities identified as being used by AI agent platforms. | Microsoft 365 |
+
## Types of non-human identities
Microsoft Defender organizes non-human identities into the following categories, each shown as a tab in the identity inventory:
@@ -58,7 +72,7 @@ Microsoft Defender organizes non-human identities into the following categories, - **Entra ID**: Service principals registered in Microsoft Entra ID. These apps authenticate using OAuth and access resources through Microsoft Graph and other APIs.
- **Active Directory**: Service accounts from on-premises Active Directory. These specialized accounts run applications, services, and automated tasks, and often have elevated privileges.
- **Google Workspace**: OAuth apps connected through Google Workspace. Users authorize these apps, which have varying levels of access to Google Workspace resources.
-- **Salesforce**: OAuth apps connected through Salesforce. Users authorize these apps to access Salesforce data and resources.
+- **Salesforce**: OAuth apps connected through Salesforce. The inventory includes both Connected Apps and External Client Apps (ECAs).
## Investigate identity details