[
  {
    "IdentityId": "ad:ad000000-0000-4000-8000-000000000001",
    "Source": "AD",
    "Type": "Traditional",
    "Name": "svc-hrsync",
    "ObjectId": "ad000000-0000-4000-8000-000000000001",
    "AppId": null,
    "Enabled": true,
    "DetectedBy": "Spn; PasswordNeverExpires; Naming",
    "WorkloadLocation": "OnPremises",
    "Hosts": "",
    "PasswordNeverExpires": true,
    "PasswordAgeDays": 2798,
    "LastLogon": "2026-10-28",
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 1,
    "Spns": "HTTP/hrapp.corp.contoso.example",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "Password",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "HIGH",
    "RiskReasons": "password never expires; password not changed in 2798 days",
    "CandidateTarget": "gMSA, or a dMSA on a Windows Server 2025 domain (Kerberos service)",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "ad:ad000000-0000-4000-8000-000000000002",
    "Source": "AD",
    "Type": "Traditional",
    "Name": "svc-sqlprod",
    "ObjectId": "ad000000-0000-4000-8000-000000000002",
    "AppId": null,
    "Enabled": true,
    "DetectedBy": "Spn; PasswordNeverExpires; Naming",
    "WorkloadLocation": "OnPremises",
    "Hosts": "",
    "PasswordNeverExpires": true,
    "PasswordAgeDays": 1966,
    "LastLogon": "2026-10-29",
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 1,
    "Spns": "MSSQLSvc/sql01.corp.contoso.example:1433",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "Password",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "HIGH",
    "RiskReasons": "password never expires; password not changed in 1966 days",
    "CandidateTarget": "Data Platform plan (SPN MSSQLSvc/sql01.corp.contoso.example:1433): gMSA, or a dMSA on a Windows Server 2025 domain (Kerberos service)",
    "Handoff": "DataPlatform",
    "Note": ""
  },
  {
    "IdentityId": "ad:ad000000-0000-4000-8000-000000000003",
    "Source": "AD",
    "Type": "Traditional",
    "Name": "svc-backup",
    "ObjectId": "ad000000-0000-4000-8000-000000000003",
    "AppId": null,
    "Enabled": true,
    "DetectedBy": "Naming",
    "WorkloadLocation": "OnPremises",
    "Hosts": "",
    "PasswordNeverExpires": false,
    "PasswordAgeDays": 149,
    "LastLogon": "2026-10-29",
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "Backup Operators",
    "HomeTenant": "",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "Password",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "HIGH",
    "RiskReasons": "member of Backup Operators",
    "CandidateTarget": "Managed identity if the workload runs in Azure; otherwise an app registration with a federated credential or certificate",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "ad:ad000000-0000-4000-8000-000000000004",
    "Source": "AD",
    "Type": "Traditional",
    "Name": "svc-oldftp",
    "ObjectId": "ad000000-0000-4000-8000-000000000004",
    "AppId": null,
    "Enabled": true,
    "DetectedBy": "PasswordNeverExpires; Naming",
    "WorkloadLocation": "OnPremises",
    "Hosts": "",
    "PasswordNeverExpires": true,
    "PasswordAgeDays": 3213,
    "LastLogon": "2025-11-02",
    "StaleLead": true,
    "StaleNote": "Lead only: confirm against domain controller and Entra sign-in logs before any change. This run retires nothing.",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "Password",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "HIGH",
    "RiskReasons": "password never expires; password not changed in 3213 days",
    "CandidateTarget": "Verify use first (stale lead); retirement candidate if unused",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "ad:ad000000-0000-4000-8000-000000000005",
    "Source": "AD",
    "Type": "Traditional",
    "Name": "svc-reports",
    "ObjectId": "ad000000-0000-4000-8000-000000000005",
    "AppId": null,
    "Enabled": false,
    "DetectedBy": "Spn; Delegation; Naming",
    "WorkloadLocation": "OnPremises",
    "Hosts": "",
    "PasswordNeverExpires": false,
    "PasswordAgeDays": 1017,
    "LastLogon": "2026-08-30",
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 1,
    "Spns": "HTTP/reports.corp.contoso.example",
    "Delegation": "Constrained",
    "PrivilegedGroups": "",
    "HomeTenant": "",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "Password",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "disabled",
    "CandidateTarget": "Retirement candidate: confirm against sign-in logs, then the orphan rule or decommission",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "ad:ad000000-0000-4000-8000-000000000006",
    "Source": "AD",
    "Type": "Traditional",
    "Name": "sa-printsvc",
    "ObjectId": "ad000000-0000-4000-8000-000000000006",
    "AppId": null,
    "Enabled": false,
    "DetectedBy": "Naming",
    "WorkloadLocation": "OnPremises",
    "Hosts": "",
    "PasswordNeverExpires": false,
    "PasswordAgeDays": 1730,
    "LastLogon": "2024-02-01",
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "Password",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "disabled",
    "CandidateTarget": "Retirement candidate: confirm against sign-in logs, then the orphan rule or decommission",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "ad:ad000000-0000-4000-8000-000000000007",
    "Source": "AD",
    "Type": "Traditional",
    "Name": "jdoe",
    "ObjectId": "ad000000-0000-4000-8000-000000000007",
    "AppId": null,
    "Enabled": true,
    "DetectedBy": "PasswordNeverExpires",
    "WorkloadLocation": "OnPremises",
    "Hosts": "",
    "PasswordNeverExpires": true,
    "PasswordAgeDays": 331,
    "LastLogon": "2026-10-29",
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "Password",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "HIGH",
    "RiskReasons": "password never expires",
    "CandidateTarget": "Managed identity if the workload runs in Azure; otherwise an app registration with a federated credential or certificate",
    "Handoff": "",
    "Note": "Detected only by a password that never expires: may be a person; confirm it is a service account"
  },
  {
    "IdentityId": "ad:ad000000-0000-4000-8000-000000000008",
    "Source": "AD",
    "Type": "Traditional",
    "Name": "svc-ldapbind",
    "ObjectId": "ad000000-0000-4000-8000-000000000008",
    "AppId": null,
    "Enabled": true,
    "DetectedBy": "Naming",
    "WorkloadLocation": "OnPremises",
    "Hosts": "",
    "PasswordNeverExpires": false,
    "PasswordAgeDays": 57,
    "LastLogon": "2026-10-29",
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "Password",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "MEDIUM",
    "RiskReasons": "stored password",
    "CandidateTarget": "Data Platform plan (name matches *ldapbind*): Managed identity if the workload runs in Azure; otherwise an app registration with a federated credential or certificate",
    "Handoff": "DataPlatform",
    "Note": ""
  },
  {
    "IdentityId": "ad:ad000000-0000-4000-8000-000000000009",
    "Source": "AD",
    "Type": "Traditional",
    "Name": "svc-webfront",
    "ObjectId": "ad000000-0000-4000-8000-000000000009",
    "AppId": null,
    "Enabled": true,
    "DetectedBy": "Spn; Delegation; Naming",
    "WorkloadLocation": "OnPremises",
    "Hosts": "",
    "PasswordNeverExpires": false,
    "PasswordAgeDays": 180,
    "LastLogon": "2026-10-30",
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 1,
    "Spns": "HTTP/web.corp.contoso.example",
    "Delegation": "Unconstrained",
    "PrivilegedGroups": "",
    "HomeTenant": "",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "Password",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "HIGH",
    "RiskReasons": "trusted for unconstrained delegation",
    "CandidateTarget": "gMSA, or a dMSA on a Windows Server 2025 domain (Kerberos service)",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "ad:ad000000-0000-4000-8000-000000000012",
    "Source": "AD",
    "Type": "Traditional",
    "Name": "svc-intranet",
    "ObjectId": "ad000000-0000-4000-8000-000000000012",
    "AppId": null,
    "Enabled": true,
    "DetectedBy": "Spn; Delegation; Naming",
    "WorkloadLocation": "OnPremises",
    "Hosts": "",
    "PasswordNeverExpires": false,
    "PasswordAgeDays": 210,
    "LastLogon": "2026-10-29",
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 1,
    "Spns": "HTTP/intranet.corp.contoso.example",
    "Delegation": "ProtocolTransition",
    "PrivilegedGroups": "",
    "HomeTenant": "",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "Password",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "MEDIUM",
    "RiskReasons": "stored password",
    "CandidateTarget": "gMSA, or a dMSA on a Windows Server 2025 domain (Kerberos service)",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "ad:ad000000-0000-4000-8000-000000000021",
    "Source": "AD",
    "Type": "MSA",
    "Name": "msa-print01$",
    "ObjectId": "ad000000-0000-4000-8000-000000000021",
    "AppId": null,
    "Enabled": true,
    "DetectedBy": "ManagedServiceAccount",
    "WorkloadLocation": "OnPremises",
    "Hosts": "PRINT01",
    "PasswordNeverExpires": false,
    "PasswordAgeDays": null,
    "LastLogon": "2026-10-29",
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "ManagedByAD",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "MEDIUM",
    "RiskReasons": "MSA",
    "CandidateTarget": "Upgrade to a gMSA (an MSA or gMSA can't be migrated to a dMSA)",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "ad:ad000000-0000-4000-8000-000000000022",
    "Source": "AD",
    "Type": "gMSA",
    "Name": "gmsa-web$",
    "ObjectId": "ad000000-0000-4000-8000-000000000022",
    "AppId": null,
    "Enabled": true,
    "DetectedBy": "ManagedServiceAccount",
    "WorkloadLocation": "OnPremises",
    "Hosts": "WEB01; WEB02",
    "PasswordNeverExpires": false,
    "PasswordAgeDays": null,
    "LastLogon": "2026-10-30",
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 1,
    "Spns": "HTTP/web2.corp.contoso.example",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "ManagedByAD",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "MEDIUM",
    "RiskReasons": "gMSA",
    "CandidateTarget": "Keep for on-premises Kerberos; workload identity federation or a managed identity when the workload moves",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "ad:ad000000-0000-4000-8000-000000000023",
    "Source": "AD",
    "Type": "gMSA",
    "Name": "gmsa-sql$",
    "ObjectId": "ad000000-0000-4000-8000-000000000023",
    "AppId": null,
    "Enabled": true,
    "DetectedBy": "ManagedServiceAccount",
    "WorkloadLocation": "OnPremises",
    "Hosts": "SQL02",
    "PasswordNeverExpires": false,
    "PasswordAgeDays": null,
    "LastLogon": "2026-10-30",
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 1,
    "Spns": "MSSQLSvc/sql02.corp.contoso.example:1433",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "ManagedByAD",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "MEDIUM",
    "RiskReasons": "gMSA",
    "CandidateTarget": "Data Platform plan (SPN MSSQLSvc/sql02.corp.contoso.example:1433): Keep for on-premises Kerberos; workload identity federation or a managed identity when the workload moves",
    "Handoff": "DataPlatform",
    "Note": ""
  },
  {
    "IdentityId": "ad:ad000000-0000-4000-8000-000000000024",
    "Source": "AD",
    "Type": "gMSA",
    "Name": "gmsa-ops$",
    "ObjectId": "ad000000-0000-4000-8000-000000000024",
    "AppId": null,
    "Enabled": true,
    "DetectedBy": "ManagedServiceAccount",
    "WorkloadLocation": "OnPremises",
    "Hosts": "OPS01",
    "PasswordNeverExpires": false,
    "PasswordAgeDays": null,
    "LastLogon": "2026-10-30",
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "Domain Admins",
    "HomeTenant": "",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "ManagedByAD",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "HIGH",
    "RiskReasons": "member of Domain Admins",
    "CandidateTarget": "Keep for on-premises Kerberos; workload identity federation or a managed identity when the workload moves",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "ad:ad000000-0000-4000-8000-000000000025",
    "Source": "AD",
    "Type": "dMSA",
    "Name": "dmsa-hrsync$",
    "ObjectId": "ad000000-0000-4000-8000-000000000025",
    "AppId": null,
    "Enabled": true,
    "DetectedBy": "ManagedServiceAccount",
    "WorkloadLocation": "OnPremises",
    "Hosts": "HR01",
    "PasswordNeverExpires": false,
    "PasswordAgeDays": null,
    "LastLogon": "2026-10-30",
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "ManagedByAD",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "Keep the dMSA",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "app:1a000000-0000-4000-8000-000000000001",
    "Source": "Entra",
    "Type": "AppRegistration",
    "Name": "Payroll Export",
    "ObjectId": "0a000000-0000-4000-8000-000000000001",
    "AppId": "1a000000-0000-4000-8000-000000000001",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMyOrg",
    "OwnerCount": 2,
    "OwnerIds": "5a000000-0000-4000-8000-000000000001; 5a000000-0000-4000-8000-000000000002",
    "OwnerTypes": "user; user",
    "ServiceManagementReference": "CMDB-1042",
    "Secrets": 1,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "2027-03-01",
    "CredentialKind": "Secret",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "User.Read.All",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 1,
    "TenantWideConsent": false,
    "Risk": "MEDIUM",
    "RiskReasons": "holds a client secret",
    "CandidateTarget": "Replace the client secret: managed identity, then federated credential, then certificate",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "app:1a000000-0000-4000-8000-000000000002",
    "Source": "Entra",
    "Type": "AppRegistration",
    "Name": "HR Connector",
    "ObjectId": "0a000000-0000-4000-8000-000000000002",
    "AppId": "1a000000-0000-4000-8000-000000000002",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMyOrg",
    "OwnerCount": 1,
    "OwnerIds": "5a000000-0000-4000-8000-000000000001",
    "OwnerTypes": "user",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 1,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "2027-01-15",
    "CredentialKind": "Certificate",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "Certificate on the rotation schedule; federated credential where the host has an issuer",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "app:1a000000-0000-4000-8000-000000000003",
    "Source": "Entra",
    "Type": "AppRegistration",
    "Name": "Legacy Reports",
    "ObjectId": "0a000000-0000-4000-8000-000000000003",
    "AppId": "1a000000-0000-4000-8000-000000000003",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMyOrg",
    "OwnerCount": 0,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 1,
    "Certificates": 1,
    "ExpiredCredentials": 1,
    "NextCredentialExpiry": "2027-06-30",
    "CredentialKind": "SecretAndCertificate",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "MEDIUM",
    "RiskReasons": "holds a client secret",
    "CandidateTarget": "Replace the client secret: managed identity, then federated credential, then certificate",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "app:1a000000-0000-4000-8000-000000000004",
    "Source": "Entra",
    "Type": "AppRegistration",
    "Name": "Build Pipeline",
    "ObjectId": "0a000000-0000-4000-8000-000000000004",
    "AppId": "1a000000-0000-4000-8000-000000000004",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMyOrg",
    "OwnerCount": 2,
    "OwnerIds": "5a000000-0000-4000-8000-000000000003; 5b000000-0000-4000-8000-000000000007",
    "OwnerTypes": "user; servicePrincipal",
    "ServiceManagementReference": "Owners aliases: Build team @ build@contoso.example;",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "Federated",
    "FederatedCredentials": 1,
    "FederatedSubjects": "https://token.actions.githubusercontent.com | repo:contoso/build:ref:refs/heads/main",
    "GraphAppRoles": "Application.ReadWrite.OwnedBy",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "Keep: federated credential",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "app:1a000000-0000-4000-8000-000000000005",
    "Source": "Entra",
    "Type": "AppRegistration",
    "Name": "Vendor Portal",
    "ObjectId": "0a000000-0000-4000-8000-000000000005",
    "AppId": "1a000000-0000-4000-8000-000000000005",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMultipleOrgs",
    "OwnerCount": 2,
    "OwnerIds": "5a000000-0000-4000-8000-000000000004; 5a000000-0000-4000-8000-000000000005",
    "OwnerTypes": "user; user",
    "ServiceManagementReference": "CMDB-2001",
    "Secrets": 0,
    "Certificates": 1,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "2026-11-20",
    "CredentialKind": "Certificate",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "Certificate on the rotation schedule; federated credential where the host has an issuer",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "app:1a000000-0000-4000-8000-000000000006",
    "Source": "Entra",
    "Type": "AppRegistration",
    "Name": "Mail Automation",
    "ObjectId": "0a000000-0000-4000-8000-000000000006",
    "AppId": "1a000000-0000-4000-8000-000000000006",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMyOrg",
    "OwnerCount": 2,
    "OwnerIds": "5a000000-0000-4000-8000-000000000006; 5a000000-0000-4000-8000-000000000001",
    "OwnerTypes": "user; user",
    "ServiceManagementReference": "CMDB-1100",
    "Secrets": 1,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "2027-05-01",
    "CredentialKind": "Secret",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "Directory.ReadWrite.All; Mail.Send",
    "HighPrivilegeAppRoles": "Directory.ReadWrite.All",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "HIGH",
    "RiskReasons": "holds Directory.ReadWrite.All",
    "CandidateTarget": "Replace the client secret: managed identity, then federated credential, then certificate",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "app:1a000000-0000-4000-8000-000000000008",
    "Source": "Entra",
    "Type": "AgentIdentityBlueprint",
    "Name": "Benefits Agent Blueprint",
    "ObjectId": "0a000000-0000-4000-8000-000000000008",
    "AppId": "1a000000-0000-4000-8000-000000000008",
    "Enabled": null,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMyOrg",
    "OwnerCount": 1,
    "OwnerIds": "5a000000-0000-4000-8000-000000000001",
    "OwnerTypes": "user",
    "ServiceManagementReference": "CMDB-4001",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "None",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "AI agent identity blueprint: Chapter 09",
    "Handoff": "",
    "Note": "An agent identity blueprint; its sponsors and agent identities are read in Chapter 09"
  },
  {
    "IdentityId": "app:1a000000-0000-4000-8000-000000000007",
    "Source": "Entra",
    "Type": "AppRegistration",
    "Name": "Deploy Bot",
    "ObjectId": "0a000000-0000-4000-8000-000000000007",
    "AppId": "1a000000-0000-4000-8000-000000000007",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMyOrg",
    "OwnerCount": 2,
    "OwnerIds": "5a000000-0000-4000-8000-000000000003; 5a000000-0000-4000-8000-000000000008",
    "OwnerTypes": "user; user",
    "ServiceManagementReference": "CMDB-1300",
    "Secrets": 0,
    "Certificates": 1,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "2027-02-01",
    "CredentialKind": "Certificate",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "Certificate on the rotation schedule; federated credential where the host has an issuer",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "sp:5b000000-0000-4000-8000-000000000001",
    "Source": "Entra",
    "Type": "ServicePrincipal",
    "Name": "Payroll Export",
    "ObjectId": "5b000000-0000-4000-8000-000000000001",
    "AppId": "1a000000-0000-4000-8000-000000000001",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMyOrg",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "OnAppRegistration",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "Governed through its app registration",
    "Handoff": "",
    "Note": "Permissions, owners and credentials are on its app registration row"
  },
  {
    "IdentityId": "sp:5b000000-0000-4000-8000-000000000002",
    "Source": "Entra",
    "Type": "ServicePrincipal",
    "Name": "HR Connector",
    "ObjectId": "5b000000-0000-4000-8000-000000000002",
    "AppId": "1a000000-0000-4000-8000-000000000002",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMyOrg",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "OnAppRegistration",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "Governed through its app registration",
    "Handoff": "",
    "Note": "Permissions, owners and credentials are on its app registration row"
  },
  {
    "IdentityId": "sp:5b000000-0000-4000-8000-000000000003",
    "Source": "Entra",
    "Type": "ServicePrincipal",
    "Name": "Legacy Reports",
    "ObjectId": "5b000000-0000-4000-8000-000000000003",
    "AppId": "1a000000-0000-4000-8000-000000000003",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMyOrg",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "OnAppRegistration",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "Governed through its app registration",
    "Handoff": "",
    "Note": "Permissions, owners and credentials are on its app registration row"
  },
  {
    "IdentityId": "sp:5b000000-0000-4000-8000-000000000004",
    "Source": "Entra",
    "Type": "ServicePrincipal",
    "Name": "Build Pipeline",
    "ObjectId": "5b000000-0000-4000-8000-000000000004",
    "AppId": "1a000000-0000-4000-8000-000000000004",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMyOrg",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "OnAppRegistration",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "Governed through its app registration",
    "Handoff": "",
    "Note": "Permissions, owners and credentials are on its app registration row"
  },
  {
    "IdentityId": "sp:5b000000-0000-4000-8000-000000000005",
    "Source": "Entra",
    "Type": "ServicePrincipal",
    "Name": "Vendor Portal",
    "ObjectId": "5b000000-0000-4000-8000-000000000005",
    "AppId": "1a000000-0000-4000-8000-000000000005",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMultipleOrgs",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "OnAppRegistration",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "Governed through its app registration",
    "Handoff": "",
    "Note": "Permissions, owners and credentials are on its app registration row"
  },
  {
    "IdentityId": "sp:5b000000-0000-4000-8000-000000000006",
    "Source": "Entra",
    "Type": "ServicePrincipal",
    "Name": "Mail Automation",
    "ObjectId": "5b000000-0000-4000-8000-000000000006",
    "AppId": "1a000000-0000-4000-8000-000000000006",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMyOrg",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "OnAppRegistration",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "Governed through its app registration",
    "Handoff": "",
    "Note": "Permissions, owners and credentials are on its app registration row"
  },
  {
    "IdentityId": "sp:5b000000-0000-4000-8000-000000000007",
    "Source": "Entra",
    "Type": "ServicePrincipal",
    "Name": "Deploy Bot",
    "ObjectId": "5b000000-0000-4000-8000-000000000007",
    "AppId": "1a000000-0000-4000-8000-000000000007",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMyOrg",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "OnAppRegistration",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "Governed through its app registration",
    "Handoff": "",
    "Note": "Permissions, owners and credentials are on its app registration row"
  },
  {
    "IdentityId": "sp:5b000000-0000-4000-8000-000000000011",
    "Source": "Entra",
    "Type": "ExternalServicePrincipal",
    "Name": "Partner CRM",
    "ObjectId": "5b000000-0000-4000-8000-000000000011",
    "AppId": "1b000000-0000-4000-8000-000000000011",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "External",
    "SignInAudience": "AzureADMultipleOrgs",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "HomeTenant",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 1,
    "TenantWideConsent": true,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "Credentials are in the home tenant: review consent and permissions",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "sp:5b000000-0000-4000-8000-000000000012",
    "Source": "Entra",
    "Type": "LegacyServicePrincipal",
    "Name": "Old SAML Connector",
    "ObjectId": "5b000000-0000-4000-8000-000000000012",
    "AppId": "1b000000-0000-4000-8000-000000000012",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "",
    "OwnerCount": 0,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 1,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "2027-08-01",
    "CredentialKind": "Secret",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "MEDIUM",
    "RiskReasons": "holds a client secret",
    "CandidateTarget": "Replace with an app registration and service principal",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "mi:5b000000-0000-4000-8000-000000000013",
    "Source": "Entra",
    "Type": "ManagedIdentitySystemAssigned",
    "Name": "vm-batch01",
    "ObjectId": "5b000000-0000-4000-8000-000000000013",
    "AppId": "1b000000-0000-4000-8000-000000000013",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "Azure",
    "Hosts": "/subscriptions/11111111-1111-4111-8111-111111111111/resourceGroups/rg-batch/providers/Microsoft.Compute/virtualMachines/vm-batch01",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "ManagedByAzure",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "User.Read.All",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "Keep: managed identity; scope its role assignments (Chapter 07)",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "mi:5b000000-0000-4000-8000-000000000014",
    "Source": "Entra",
    "Type": "ManagedIdentityUserAssigned",
    "Name": "id-deploy",
    "ObjectId": "5b000000-0000-4000-8000-000000000014",
    "AppId": "1b000000-0000-4000-8000-000000000014",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "Azure",
    "Hosts": "/subscriptions/11111111-1111-4111-8111-111111111111/resourceGroups/rg-identity/providers/Microsoft.ManagedIdentity/userAssignedIdentities/id-deploy",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "ManagedByAzure+Federated",
    "FederatedCredentials": 1,
    "FederatedSubjects": "https://token.actions.githubusercontent.com | repo:contoso/infra:environment:production",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "Keep: managed identity; join it to a record, since it outlives its resources",
    "Handoff": "",
    "Note": ""
  },
  {
    "IdentityId": "sp:5b000000-0000-4000-8000-000000000015",
    "Source": "Entra",
    "Type": "AgentIdentity",
    "Name": "Benefits Q&A Agent",
    "ObjectId": "5b000000-0000-4000-8000-000000000015",
    "AppId": "1b000000-0000-4000-8000-000000000015",
    "Enabled": true,
    "DetectedBy": "",
    "WorkloadLocation": "",
    "Hosts": "",
    "PasswordNeverExpires": null,
    "PasswordAgeDays": null,
    "LastLogon": null,
    "StaleLead": false,
    "StaleNote": "",
    "SpnCount": 0,
    "Spns": "",
    "Delegation": "None",
    "PrivilegedGroups": "",
    "HomeTenant": "Own",
    "SignInAudience": "AzureADMyOrg",
    "OwnerCount": null,
    "OwnerIds": "",
    "OwnerTypes": "",
    "ServiceManagementReference": "",
    "Secrets": 0,
    "Certificates": 0,
    "ExpiredCredentials": 0,
    "NextCredentialExpiry": "",
    "CredentialKind": "",
    "FederatedCredentials": 0,
    "FederatedSubjects": "",
    "GraphAppRoles": "",
    "HighPrivilegeAppRoles": "",
    "DelegatedGrants": 0,
    "TenantWideConsent": false,
    "Risk": "LOW",
    "RiskReasons": "",
    "CandidateTarget": "AI agent identity: Chapter 09",
    "Handoff": "",
    "Note": "An agent identity (servicePrincipalType ServiceIdentity); sponsors and blueprint are read in Chapter 09"
  }
]
