Auto Adjust is a sync control that automatically updates tracked license quantity to match what the connected integration reports from the vendor side. It protects against stale counts when seats are added or removed outside the internal system. When disabled, quantity changes require manual correction to remain accurate.
Expanded Definition
Auto Adjust is a reconciliation control, not an access control, and that distinction matters in NHI governance. It keeps a tracked license or entitlement count aligned to what the connected vendor integration reports, reducing drift when seats are added, removed, or reassigned outside the internal workflow. In practice, the control sits between inventory accuracy and financial or compliance reporting, which makes it adjacent to provisioning logic but narrower in scope than a full lifecycle automation rule.
Definitions vary across vendors, because some products use “auto adjust” for license reconciliation while others apply similar language to usage-based metering or subscription billing. In NHI and IAM programs, the safest interpretation is that the control should reflect the authoritative source of truth for the external service, not an internal guess. That makes it relevant when service accounts, API keys, or machine users are tied to purchased capacity. For background on the broader NHI lifecycle and why visibility is often incomplete, see the Ultimate Guide to NHIs and the NIST SP 800-53 Rev 5 Security and Privacy Controls guidance on auditability and configuration management.
The most common misapplication is treating auto adjust as a substitute for entitlement review, which occurs when teams assume synced counts are the same as verified ownership and privilege.
Examples and Use Cases
Implementing auto adjust rigorously often introduces a governance tradeoff: it improves count accuracy, but it can also hide upstream data quality problems if the integration source is wrong or delayed. Organisations have to weigh operational convenience against the need to detect unexpected movement in machine identities and licenses.
- A SaaS platform automatically reduces the tracked seat count when an external directory revokes a service account, keeping procurement records aligned with actual use.
- A CI/CD tool updates its machine-user inventory after the vendor reports a deleted token, preventing phantom licenses from persisting in internal reporting.
- An organisation uses auto adjust for API consumer records, then cross-checks changes against manual approval logs to distinguish legitimate churn from abnormal activity, as recommended in the broader Ultimate Guide to NHIs.
- A security team ties auto-adjusted license counts to periodic access validation, using NIST SP 800-53 Rev 5 Security and Privacy Controls to ensure the reconciliation process is logged and reviewable.
- A managed service provider enables auto adjust for customer-specific integrations where counts change frequently, but keeps exceptions manual when the source system is known to lag.
Where third-party integrations expose incomplete or delayed state, auto adjust should be paired with exception handling rather than trusted as a complete record of NHI reality.
Why It Matters in NHI Security
Auto adjust matters because inaccurate counts often become security debt. When tracked quantities stay stale, organisations can miss orphaned service accounts, overrun license limits, or believe a control is working when the underlying NHI estate has already drifted. That is especially risky in environments where machine identities outnumber human identities and changes happen outside standard HR-led workflows. NHIMG data shows that only 5.7% of organisations have full visibility into their service accounts, underscoring how easy it is for reconciliation controls to be mistaken for true inventory control.
Used properly, auto adjust supports cleaner governance by keeping vendor-reported state visible and reducing manual correction lag. Used poorly, it can mask gaps in offboarding, rotation, and exception review, especially when connected systems are loosely trusted or poorly instrumented. The broader risk landscape is detailed in the Ultimate Guide to NHIs, where recurring visibility and lifecycle failures are tied to compromised or mismanaged NHIs. Organisations typically encounter the cost of stale counts only after an audit, a renewal dispute, or a security incident, at which point auto adjust becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Reconciliation controls depend on accurate NHI inventory and lifecycle visibility. |
| NIST CSF 2.0 | CM-8 | Asset inventories must stay accurate when external systems change counts automatically. |
| NIST SP 800-63 | Digital identity assurance depends on authoritative state, not merely synced seat counts. | |
| NIST Zero Trust (SP 800-207) | SC.IAM-2 | Zero trust requires continuous verification of identity and access state across systems. |
Use auto adjust to support continuous state awareness, then verify access changes through zero-trust controls.
Related resources from NHI Mgmt Group
- How does OneDrive auto-sync create secrets exposure in SharePoint?
- How should organisations stop auto-sync from turning desktops into repositories of credentials?
- Should security teams disable OneDrive auto-sync by default?
- What breaks when remote images are auto-fetched inside AI assistant responses?
