A usage metric that averages the number of unique authenticated users across the days in a billing period. It is often a better fit for identity infrastructure because it reflects daily activity patterns, not just monthly presence, and it smooths out short-lived traffic spikes.
Expanded Definition
Average Daily Active Users, or ADAU, is a usage metric that averages the count of unique authenticated users active on each day within a defined billing or reporting period. In NHI and IAM contexts, it is often more operationally useful than a simple monthly active count because it reflects recurring authentication demand, not just one-time presence. That makes it relevant for capacity planning, license modelling, and evaluating how often identities actually interact with tools and services.
Definitions vary across vendors when ADAU is used for workforce identity, customer identity, or agentic AI workloads, so governance teams should verify whether “active” means login, API call, token refresh, or tool execution. The metric is also easy to confuse with total logins, which can overstate real usage when the same identity authenticates repeatedly across multiple systems. For a control-oriented lens, organisations often map ADAU to inventory and monitoring expectations in NIST SP 800-53 Rev 5 Security and Privacy Controls rather than treating it as a pure finance statistic. The most common misapplication is counting every authentication event as a separate user, which occurs when session churn or automated token renewal is mistaken for distinct daily activity.
Examples and Use Cases
Implementing ADAU rigorously often introduces measurement overhead, requiring organisations to weigh better capacity planning against the complexity of defining a true “active” identity.
- A SaaS platform tracks ADAU to size identity provider throughput for weekday peaks instead of provisioning against a monthly average that hides bursty usage.
- An internal platform team compares ADAU by department to identify which groups rely on shared service accounts versus individually issued NHI.
- An agentic AI program measures ADAU by autonomous agents and human operators separately, because tool-use frequency can differ sharply from human login habits.
- A security team reviews ADAU trends alongside secret exposure events in the State of Secrets in AppSec research to understand whether rising activity is accompanied by broader credential distribution.
- A cloud engineering group applies identity telemetry from DeepSeek breach analysis to distinguish legitimate daily usage from suspicious automation against exposed credentials.
For standards-aligned identity operations, ADAU pairs well with service usage telemetry and control monitoring guidance in the NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where reporting must support auditability rather than marketing metrics.
Why It Matters in NHI Security
ADAU matters because it reveals how many identities are actively consuming authentication, secrets, and tool access on a typical day. That matters for NHI security teams because overcounting active usage can hide dormant accounts, inflate license assumptions, and obscure where secrets are actually concentrated. Undercounting can be just as dangerous, because it can mask automated agent activity or shared credential reuse that never appears in annual summaries.
This becomes especially important when organisations are trying to govern autonomous agents and service identities that may authenticate frequently but only appear “present” intermittently. In the secret-management research published by NHIMG, organisations maintained an average of 6 distinct secrets manager instances, a sign that fragmentation can distort operational visibility and make usage metrics harder to trust. When ADAU is measured consistently, it helps separate stable daily demand from anomalous spikes that deserve investigation. The most useful insight usually comes after a credential incident, because teams then need to know which identities were truly active before access was abused.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Activity metrics support NHI inventory and visibility, which underpin governance of non-human identities. |
| NIST CSF 2.0 | DE.CM-1 | Continuous monitoring uses usage telemetry to identify changes in normal identity behavior. |
| NIST SP 800-53 Rev 5 | AU-2 | Audit event definitions determine whether usage counts reflect logins, sessions, or transactions. |
| NIST Zero Trust (SP 800-207) | IA-5 | Zero trust depends on continuous verification, which makes active-usage telemetry operationally relevant. |
| OWASP Agentic AI Top 10 | AGENT-01 | Agentic systems require visibility into how often autonomous identities execute actions and tools. |
Baseline ADAU and alert on deviations that may indicate abuse, automation, or misconfigured access.
Related resources from NHI Mgmt Group
- Who is accountable when SSO leaves users active after offboarding?
- What breaks when non-privileged users can create machine accounts in managed Active Directory?
- How should teams migrate active sessions without forcing users to log in again?
- What happened in the demo account left active in production scenario and what does it reveal?
