Cloud Entitlement Statistics: Unused Permissions, Over-Privilege and Machine Identity Ratios

Cloud identities hold far more permission than they use, and most of those identities are not people, yet the figures quoted to prove it are often stripped of their source, sample and definition. This page collects cloud entitlement statistics only from the publishers' own report pages and press releases: unused permissions, over-privileged and "super" identities, long-lived keys, federation adoption and machine to human identity ratios. Each figure carries the report name, publisher and as-of year, and vendor telemetry and surveys are labelled as such, because a ratio counted from one vendor's customer base is not the same thing as a market-wide fact. Unless a figure is shown from more than one publisher, it comes from a single source and should be quoted as that publisher's finding. It is written for identity, cloud security and CIEM programme owners who need numbers that will survive scrutiny in a business case or board paper. Broader cloud breach and misconfiguration figures sit in the Cloud Security Statistics Guide. Last reviewed: November 2026.

Key takeaways

• Granted permissions are barely used. Microsoft's 2024 State of Multicloud Security Risk Report found only 2% of granted permissions were used in 2023, and 3% for workload identities.
• Machines dominate the identity count. Estimates range from 10 workload identities per human (Microsoft telemetry, 2023) to 82 (CyberArk survey, 2025) and 144 (Entro customer data, H1 2025), depending on what is counted.
• Over-privilege is concentrated in non-human identities. Microsoft reports that more than half of identities are "super identities", with workload identities making up 7 in 10 of them by 2023; CyberArk reports 42% of machine identities have privileged or sensitive access.
• Long-lived keys keep ageing. Datadog's November 2026 report shows the share of AWS IAM users and Google Cloud service accounts with keys older than three years still rising.
• Federation is winning slowly. 63% of organisations in Datadog's 2026 data use only federated identities for AWS console access, up from 55% in 2024.

Headline statistics

Statistics by theme

Unused permissions

Unused permission is the most consistent finding across sources, measured from cloud activity logs rather than surveys.

• Microsoft, 2023 data: more than 51,000 permissions were granted to identities in 2023, up from 40,000 in 2022 (a 22% increase). Only 2% were used, and 3% of workload identity permissions. Microsoft classed 50% of permissions as high risk, meaning misuse could cause data leakage, service disruption or degradation. Source: 2024 State of Multicloud Security Risk Report, drawn from Microsoft Entra Permissions Management customer environments.
• Unit 42, published 2022: 99% of cloud users, roles, services and resources were granted permissions they did not use for 60 days or more, across more than 680,000 identities in 18,000 cloud accounts at 200 organisations. Source: Unit 42 Cloud Threat Report Volume 6, Palo Alto Networks. This is older than the other figures and is best quoted as a historical baseline.

Unused permission is the gap that least privilege techniques close. See the Least Privilege Techniques Guide.

Over-privileged and super identities

• Super identities: Microsoft defines a super identity as one with access to all permissions and resources across the cloud estate. They were more than 50% of all identities in 2023, unchanged from 2022, and the human to workload split among them moved from 4:6 in 2022 to 3:7 in 2023. Source: Microsoft, 2024 State of Multicloud Security Risk Report.
• Privileged machine identities: 42% of machine identities have privileged or sensitive access, while 88% of respondents define a "privileged user" only as a human identity. Source: CyberArk 2025 Identity Security Landscape (Vanson Bourne survey).
• Full admin machine identities: 1 in 20 AWS machine identities carry full administrator privileges. Source: Entro Labs NHI and Secrets Risk Report H1 2025 (customer telemetry).
• AI service roles: 18% of organisations have IAM roles with critical or high excessive permissions that AWS AI services can assume. Source: Tenable Cloud and AI Security Risk Report 2026.
• External access: 53% of organisations have external accounts that can assume critical excessive permissions. Source: Tenable Cloud and AI Security Risk Report 2026.

Inactive identities and long-lived keys

• Inactive workload identities: identities that had not logged in or used any permission in the previous 90 days fell from 80% of workload identities in 2022 to 40% in 2023. Source: Microsoft, 2024 State of Multicloud Security Risk Report.
• New keys that age into risk: 43% of AWS IAM users, 41% of Google Cloud service accounts and 66% of Entra ID app registrations have active keys created in the past year, which then age into risk. Source: Datadog State of Cloud Security, November 2026.
• Keys older than three years: the share of users with access keys older than three years has climbed steadily in AWS and Google Cloud since 2024, while Azure has trended down. Read from Datadog's chart, roughly 30% of AWS IAM users with keys and 29% of Google Cloud service accounts with keys had a key older than three years in 2026, against about 13% of Entra ID applications. Source: Datadog, November 2026 (chart values, approximate).
• Forgotten credentials: 65% of organisations have unused or unrotated keys tied to high-risk identities. Source: Tenable Cloud and AI Security Risk Report 2026.
• AI service keys: nearly half of organisations using Gemini use long-lived Gemini API keys, 17% of organisations using Amazon Bedrock use Bedrock API keys, and 97% of Azure organisations keep the default long-lived keys on Azure Foundry resources. Source: Datadog, November 2026.

Federation and keyless authentication

In 2026, keyless-only GitHub Actions authentication was 54% for AWS, 22% for Google Cloud and 5% for Azure, where 52% of organisations used keyless and long-lived credentials together. Long-lived-only use was 24% for AWS, 43% for Azure and 65% for Google Cloud. Source: Datadog, November 2026. See the Workload Identity Federation Guide.

Why machine to human ratios differ so much

Ratios between 10:1 and 144:1 are all "correct" for their own method. Quote the ratio together with what was counted.

Three effects drive the spread. Telemetry counts only what a product can see in the clouds it is connected to; surveys capture estimates across the whole organisation; and definitions vary on whether API keys, certificates, secrets, OAuth grants and AI agents each count as an identity. A growing ratio inside one source over time (Entro's 92:1 to 144:1) is more meaningful than comparing one source's ratio with another's.

What the numbers mean for defenders

NHI Mgmt Group recommends the following steps, based on these findings.

• Start with inactive identities: disabling identities with no activity for 90 days is the lowest-risk reduction. Disable first so an identity can be restored if a quarterly job breaks.
• Right-size from logs: generate policies from observed activity over at least one full business cycle, then remove the unused permissions in stages. See the Cloud PAM and CIEM Guide.
• Treat machine identities as privileged users: CyberArk's finding that most organisations define privileged users only as humans explains why service roles escape privileged access review.
• Plan for AI agent identities: respondents to CyberArk's 2025 survey expected AI to create the greatest number of new identities with privileged and sensitive access in 2025, and Tenable's AI service role finding shows the permissions those services can assume are already over-broad in some estates. Give each agent its own identity and include it in the same right-sizing and inactivity reviews. See the Least Privilege Techniques Guide.
• Small and large estates: a single-cloud team can get most of the way with the provider's native access analysis and last-used data. Multi-cloud estates with thousands of roles need a CIEM capability to measure the same metrics consistently across providers. See the CIEM Buyers Guide.

Metrics worth tracking internally, so your own figures can be set against these benchmarks: percentage of granted permissions used per role over 90 days; number of identities with administrator-equivalent access, split human and non-human; percentage of non-human identities inactive for 90 days; percentage of access keys older than one year; and percentage of CI/CD pipelines using keyless federation.

Common failure patterns when using these statistics

• Quoting a ratio without its method: placing 82:1 and 144:1 side by side as if one replaced the other, when one is a survey estimate and the other product telemetry.
• Treating vendor telemetry as market-wide: Microsoft, Datadog, Entro and Tenable figures describe their own customers, who already run the product that measures the problem.
• Using old baselines as current: the Unit 42 99% figure was published in 2022; label it as such.
• Confusing "unused" with "unneeded": permissions used once a quarter look unused in a 60 or 90 day window. Right-sizing on a short window breaks break-glass and year-end jobs.
• Mixing units: "65% of organisations have forgotten credentials" counts organisations, while "40% of workload identities are inactive" counts identities. They cannot be combined.

Methodology notes and caveats

• Datadog: data collected in September 2026 from thousands of organisations using Datadog Infrastructure Monitoring, Logs or Cloud Security. AWS IAM users count if they have at least one active access key; Google-managed service accounts are excluded; Entra ID counts app registrations with active password credentials; console authentication is classified from CloudTrail ConsoleLogin events. Some year-on-year values are read from charts and are approximate.
• Microsoft: data from Microsoft Entra Permissions Management customer environments for 2023, compared with 2022. Microsoft defines inactive as no login or permission use in the last 90 days.
• CyberArk: survey by Vanson Bourne of 2,600 cybersecurity decision makers in public and private sector organisations with 500 or more employees across 20 countries, released 23 April 2025.
• Tenable: the report page does not state the data period or sample, so quote figures as Tenable research.
• Entro Labs: the report page attributes figures to its customer base and does not describe the method or give a publication date beyond the H1 2025 label.
• Unit 42: published 12 April 2022; excessive means unused for 60 days or more.

Practitioner checklist

• Quote every ratio with its publisher, year and whether it is a survey or telemetry.
• Measure your own used-versus-granted permission percentage per role before citing an industry figure.
• Count human and non-human identities separately, and state what you include (keys, certificates, agents).
• Disable non-human identities inactive for 90 days, with a restore path, then delete after a hold period.
• Inventory roles with administrator-equivalent access and move them to just-in-time elevation.
• Track key age and the share of pipelines using keyless federation each quarter.
• Review cross-account and third-party trust for roles with critical permissions.
• Recheck this page's sources annually: Datadog and CyberArk publish recurring editions.

Standards and references

• Datadog: State of Cloud Security
• Microsoft: 2024 State of Multicloud Security Risk Report
• CyberArk: 2025 Identity Security Landscape announcement
• Tenable: Cloud and AI Security Risk Report 2026
• Entro Labs: NHI and Secrets Risk Report H1 2025
• Palo Alto Networks Unit 42: Cloud Threat Report Volume 6, IAM research
• NIST: SP 800-53 Rev. 5
• MITRE ATT&CK: Valid Accounts: Cloud Accounts (T1078.004)

Related NHI Mgmt Group resources: Cloud Security Statistics Guide · Non-Human Identity and Secrets Statistics Guide · Cloud PAM and CIEM Guide · Least Privilege Techniques Guide