Topic starter
01/07/2026 2:07 am
TL;DR: Microsoft’s 2024 multicloud security data shows one human identity for every 10 workload identities, while more than 83% of the 209 million cloud identities analyzed were non-human, according to Semperis and Microsoft. That scale shifts identity governance from user-centric control to machine identity visibility, privilege, and lifecycle management.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Meet Entra ID Agent Identities (BTW: They’re Not People)”.
By the numbers:
- Microsoft’s 2024 multicloud security data shows one human identity for every 10 workload identities.
- Across customer environments analyzed in 2023, Entra Permissions Management identified 209 million cloud identities.
- More than 83% of those 209 million identities were non-human.
Key questions
Q: What breaks when cloud identities are not centrally governed?
A: Shadow accounts, orphaned credentials and inconsistent role definitions emerge because no single process can see the whole access picture.
Q: Why do non-human identities increase privileged access risk in cloud environments?
A: Non-human identities increase risk because they often outnumber humans, operate continuously, and depend on credentials that are easier to reuse than to govern.
Q: How can security teams tell whether NHI governance is actually working?
A: Look for evidence of ownership, expiry, scope, and rotation across the machine identity estate.
Practitioner guidance
- Build a complete NHI inventory Catalogue workload identities, service principals, automation accounts, and agent identities across cloud estates so ownership and scope are visible.
- Identify and review super identities Find principals with access to all permissions or all resources and require explicit business justification for each exception.
- Assign lifecycle ownership to every machine identity Tie creation, change, review, and offboarding of each non-human identity to a named owner and a documented service purpose.
Bottom line: Cloud identity governance is no longer centred on humans, because workload identities now account for a larger share of the access surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
01/07/2026 2:29 am
Non-human identity is now the primary cloud governance problem: The article is directionally correct that scale has shifted away from human users and toward machine principals. That means the old assumption that users are the main identity risk no longer holds. IAM programmes that still optimise around employee access reviews are governing the smaller half of the estate, not the more exposed one. The practitioner conclusion is simple: cloud identity governance must start with NHIs.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: Why do IAM controls fail when non-human identities outnumber human users?
A: IAM controls fail when NHIs dominate because the governance model was built around stable human accounts with predictable owners, review cycles, and sign-in behaviour. Machine identities are created faster, reused more widely, and forgotten more easily, so the control problem shifts from authentication to lifecycle visibility and revocation discipline.
👉 Read our full editorial: Non-human identities now dominate cloud access and attack surface
This post was modified 1 day ago by NHI Mgmt Group