User merging is the process of combining multiple records that belong to the same person into one identity view. In SaaS and identity operations, it helps teams reconcile duplicate email addresses, aliases, and app-specific accounts so usage, access, and activity can be governed as a single user profile.
Expanded Definition
User merging is an identity hygiene and governance activity, not just a data cleanup task. It combines duplicate human records into a single operational profile so access, audit history, device context, and application activity can be evaluated consistently across SaaS, IAM, and downstream security tooling. In practice, the term overlaps with identity reconciliation, de-duplication, and account linking, but those adjacent concepts are not always equivalent. Definitions vary across vendors: some tools merge records automatically based on email aliases or directory attributes, while others require human approval because a mistaken merge can overwrite entitlements or obscure audit evidence.
For security teams, the important distinction is that user merging should preserve provenance. A merged profile must retain source-system traces so investigators can see which account originated which action, especially when the environment also includes service accounts or other NHI records. Guidance from the NIST Cybersecurity Framework 2.0 reinforces the need for reliable identity data to support access governance and monitoring. The most common misapplication is merging records solely because they share a name or email fragment, which occurs when teams skip attribute validation and confirmation from source systems.
Examples and Use Cases
Implementing user merging rigorously often introduces review overhead and exception handling, requiring organisations to weigh cleaner governance against the risk of collapsing distinct identities.
- A SaaS admin merges two employee profiles after confirming that a legal name change created a duplicate directory record, then preserves the old account as an alias for audit continuity.
- A security team reconciles app-specific accounts from multiple vendors into one user view so access reviews can assess entitlements across tools instead of treating each login as a separate person.
- An IAM analyst uses event history from the Ultimate Guide to NHIs to distinguish human accounts from adjacent automation records before approving a merge.
- A help desk workflow merges duplicate records only after matching HR data, directory identifiers, and recent login telemetry to reduce the chance of combining accounts that belong to different employees.
- A governance team aligns its merge review process with the NIST Cybersecurity Framework 2.0 so identity data quality supports monitoring and access control decisions.
Why It Matters in NHI Security
User merging matters because identity sprawl weakens both accountability and detection. When duplicate records remain unresolved, access reviews can miss excessive privilege, logs become fragmented, and incident responders may fail to connect activity across systems. That problem is especially dangerous in environments where human accounts sit alongside APIs, service accounts, and other NHIs, because poor identity hygiene can make automated and human actions look interchangeable. NHIMG notes that only 5.7% of organisations have full visibility into their service accounts, and the same visibility gap often affects human identity records that have been duplicated across systems. The Ultimate Guide to NHIs also shows how quickly governance breaks down when identity data is incomplete or stale.
Used correctly, user merging improves access recertification, insider-risk investigations, and offboarding quality because a single identity view is easier to govern than scattered records. Used badly, it can erase evidence, transfer entitlements incorrectly, or hide a shadow account that should have been deprovisioned. Organisations typically encounter the consequences only after a review, audit, or breach investigation reveals duplicate identities, at which point user merging becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM | Identity inventory and data quality depend on accurate record consolidation. |
| NIST SP 800-63 | Identity proofing and lifecycle assurance rely on consistent identity binding. | |
| NIST Zero Trust (SP 800-207) | Zero Trust decisions depend on trustworthy identity context for each access request. | |
| OWASP Non-Human Identity Top 10 | NHI-01 | Identity sprawl and poor visibility are core NHI governance risks. |
| NIST AI RMF | Identity data integrity is part of managing AI-enabled decision risk. |
Keep identity records current and deduplicated so asset and access decisions are based on one reliable user view.
Related resources from NHI Mgmt Group
- When do service accounts become a higher risk than ordinary user accounts?
- How should security teams govern infrastructure identities alongside user identities?
- What is the difference between managing user accounts and managing NHIs?
- What is the difference between service account risk and user account risk in AD?
