"IdentityId","Source","Type","Name","ObjectId","AppId","Enabled","DetectedBy","WorkloadLocation","Hosts","PasswordNeverExpires","PasswordAgeDays","LastLogon","StaleLead","StaleNote","SpnCount","Spns","Delegation","PrivilegedGroups","HomeTenant","SignInAudience","OwnerCount","OwnerIds","OwnerTypes","ServiceManagementReference","Secrets","Certificates","ExpiredCredentials","NextCredentialExpiry","CredentialKind","FederatedCredentials","FederatedSubjects","GraphAppRoles","HighPrivilegeAppRoles","DelegatedGrants","TenantWideConsent","Risk","RiskReasons","CandidateTarget","Handoff","Note"
"ad:ad000000-0000-4000-8000-000000000001","AD","Traditional","svc-hrsync","ad000000-0000-4000-8000-000000000001",,"True","Spn; PasswordNeverExpires; Naming","OnPremises","","True","2799","2026-10-28","False","","1","HTTP/hrapp.corp.contoso.example","None","","","",,"","","","0","0","0","","Password","0","","","","0","False","HIGH","password never expires; password not changed in 2799 days","gMSA, or a dMSA on a Windows Server 2025 domain (Kerberos service)","",""
"ad:ad000000-0000-4000-8000-000000000002","AD","Traditional","svc-sqlprod","ad000000-0000-4000-8000-000000000002",,"True","Spn; PasswordNeverExpires; Naming","OnPremises","","True","1967","2026-10-29","False","","1","MSSQLSvc/sql01.corp.contoso.example:1433","None","","","",,"","","","0","0","0","","Password","0","","","","0","False","HIGH","password never expires; password not changed in 1967 days","Data Platform plan (SPN MSSQLSvc/sql01.corp.contoso.example:1433): gMSA, or a dMSA on a Windows Server 2025 domain (Kerberos service)","DataPlatform",""
"ad:ad000000-0000-4000-8000-000000000003","AD","Traditional","svc-backup","ad000000-0000-4000-8000-000000000003",,"True","Naming","OnPremises","","False","150","2026-10-29","False","","0","","None","Backup Operators","","",,"","","","0","0","0","","Password","0","","","","0","False","HIGH","member of Backup Operators","Managed identity if the workload runs in Azure; otherwise an app registration with a federated credential or certificate","",""
"ad:ad000000-0000-4000-8000-000000000004","AD","Traditional","svc-oldftp","ad000000-0000-4000-8000-000000000004",,"True","PasswordNeverExpires; Naming","OnPremises","","True","3214","2025-11-02","True","Lead only: confirm against domain controller and Entra sign-in logs before any change. This run retires nothing.","0","","None","","","",,"","","","0","0","0","","Password","0","","","","0","False","HIGH","password never expires; password not changed in 3214 days","Verify use first (stale lead); retirement candidate if unused","",""
"ad:ad000000-0000-4000-8000-000000000005","AD","Traditional","svc-reports","ad000000-0000-4000-8000-000000000005",,"False","Spn; Delegation; Naming","OnPremises","","False","1018","2026-08-30","False","","1","HTTP/reports.corp.contoso.example","Constrained","","","",,"","","","0","0","0","","Password","0","","","","0","False","LOW","disabled","Retirement candidate: confirm against sign-in logs, then the orphan rule or decommission","",""
"ad:ad000000-0000-4000-8000-000000000006","AD","Traditional","sa-printsvc","ad000000-0000-4000-8000-000000000006",,"False","Naming","OnPremises","","False","1731","2024-02-01","False","","0","","None","","","",,"","","","0","0","0","","Password","0","","","","0","False","LOW","disabled","Retirement candidate: confirm against sign-in logs, then the orphan rule or decommission","",""
"ad:ad000000-0000-4000-8000-000000000007","AD","Traditional","jdoe","ad000000-0000-4000-8000-000000000007",,"True","PasswordNeverExpires","OnPremises","","True","332","2026-10-29","False","","0","","None","","","",,"","","","0","0","0","","Password","0","","","","0","False","HIGH","password never expires","Managed identity if the workload runs in Azure; otherwise an app registration with a federated credential or certificate","","Detected only by a password that never expires: may be a person; confirm it is a service account"
"ad:ad000000-0000-4000-8000-000000000008","AD","Traditional","svc-ldapbind","ad000000-0000-4000-8000-000000000008",,"True","Naming","OnPremises","","False","58","2026-10-29","False","","0","","None","","","",,"","","","0","0","0","","Password","0","","","","0","False","MEDIUM","stored password","Data Platform plan (name matches *ldapbind*): Managed identity if the workload runs in Azure; otherwise an app registration with a federated credential or certificate","DataPlatform",""
"ad:ad000000-0000-4000-8000-000000000009","AD","Traditional","svc-webfront","ad000000-0000-4000-8000-000000000009",,"True","Spn; Delegation; Naming","OnPremises","","False","181","2026-10-30","False","","1","HTTP/web.corp.contoso.example","Unconstrained","","","",,"","","","0","0","0","","Password","0","","","","0","False","HIGH","trusted for unconstrained delegation","gMSA, or a dMSA on a Windows Server 2025 domain (Kerberos service)","",""
"ad:ad000000-0000-4000-8000-000000000012","AD","Traditional","svc-intranet","ad000000-0000-4000-8000-000000000012",,"True","Spn; Delegation; Naming","OnPremises","","False","211","2026-10-29","False","","1","HTTP/intranet.corp.contoso.example","ProtocolTransition","","","",,"","","","0","0","0","","Password","0","","","","0","False","MEDIUM","stored password","gMSA, or a dMSA on a Windows Server 2025 domain (Kerberos service)","",""
"ad:ad000000-0000-4000-8000-000000000021","AD","MSA","msa-print01$","ad000000-0000-4000-8000-000000000021",,"True","ManagedServiceAccount","OnPremises","PRINT01","False",,"2026-10-29","False","","0","","None","","","",,"","","","0","0","0","","ManagedByAD","0","","","","0","False","MEDIUM","MSA","Upgrade to a gMSA (an MSA or gMSA can't be migrated to a dMSA)","",""
"ad:ad000000-0000-4000-8000-000000000022","AD","gMSA","gmsa-web$","ad000000-0000-4000-8000-000000000022",,"True","ManagedServiceAccount","OnPremises","WEB01; WEB02","False",,"2026-10-30","False","","1","HTTP/web2.corp.contoso.example","None","","","",,"","","","0","0","0","","ManagedByAD","0","","","","0","False","MEDIUM","gMSA","Keep for on-premises Kerberos; workload identity federation or a managed identity when the workload moves","",""
"ad:ad000000-0000-4000-8000-000000000023","AD","gMSA","gmsa-sql$","ad000000-0000-4000-8000-000000000023",,"True","ManagedServiceAccount","OnPremises","SQL02","False",,"2026-10-30","False","","1","MSSQLSvc/sql02.corp.contoso.example:1433","None","","","",,"","","","0","0","0","","ManagedByAD","0","","","","0","False","MEDIUM","gMSA","Data Platform plan (SPN MSSQLSvc/sql02.corp.contoso.example:1433): Keep for on-premises Kerberos; workload identity federation or a managed identity when the workload moves","DataPlatform",""
"ad:ad000000-0000-4000-8000-000000000024","AD","gMSA","gmsa-ops$","ad000000-0000-4000-8000-000000000024",,"True","ManagedServiceAccount","OnPremises","OPS01","False",,"2026-10-30","False","","0","","None","Domain Admins","","",,"","","","0","0","0","","ManagedByAD","0","","","","0","False","HIGH","member of Domain Admins","Keep for on-premises Kerberos; workload identity federation or a managed identity when the workload moves","",""
"ad:ad000000-0000-4000-8000-000000000025","AD","dMSA","dmsa-hrsync$","ad000000-0000-4000-8000-000000000025",,"True","ManagedServiceAccount","OnPremises","HR01","False",,"2026-10-30","False","","0","","None","","","",,"","","","0","0","0","","ManagedByAD","0","","","","0","False","LOW","","Keep the dMSA","",""
"app:1a000000-0000-4000-8000-000000000001","Entra","AppRegistration","Payroll Export","0a000000-0000-4000-8000-000000000001","1a000000-0000-4000-8000-000000000001","True","","","",,,,"False","","0","","None","","Own","AzureADMyOrg","2","5a000000-0000-4000-8000-000000000001; 5a000000-0000-4000-8000-000000000002","user; user","CMDB-1042","1","0","0","2027-03-01","Secret","0","","User.Read.All","","1","False","MEDIUM","holds a client secret","Replace the client secret: managed identity, then federated credential, then certificate","",""
"app:1a000000-0000-4000-8000-000000000002","Entra","AppRegistration","HR Connector","0a000000-0000-4000-8000-000000000002","1a000000-0000-4000-8000-000000000002","True","","","",,,,"False","","0","","None","","Own","AzureADMyOrg","1","5a000000-0000-4000-8000-000000000001","user","","1","1","0","2027-01-15","SecretAndCertificate","0","","","","0","False","MEDIUM","holds a client secret","Replace the client secret: managed identity, then federated credential, then certificate","",""
"app:1a000000-0000-4000-8000-000000000003","Entra","AppRegistration","Legacy Reports","0a000000-0000-4000-8000-000000000003","1a000000-0000-4000-8000-000000000003","True","","","",,,,"False","","0","","None","","Own","AzureADMyOrg","0","","","","1","1","1","2027-06-30","SecretAndCertificate","0","","","","0","False","MEDIUM","holds a client secret","Replace the client secret: managed identity, then federated credential, then certificate","",""
"app:1a000000-0000-4000-8000-000000000004","Entra","AppRegistration","Build Pipeline","0a000000-0000-4000-8000-000000000004","1a000000-0000-4000-8000-000000000004","True","","","",,,,"False","","0","","None","","Own","AzureADMyOrg","2","5a000000-0000-4000-8000-000000000003; 5b000000-0000-4000-8000-000000000007","user; servicePrincipal","Owners aliases: Build team @ build@contoso.example;","1","0","0","2027-10-30","Secret+Federated","1","https://token.actions.githubusercontent.com | repo:contoso/build:ref:refs/heads/main","Application.ReadWrite.OwnedBy","","0","False","MEDIUM","holds a client secret","Replace the client secret: managed identity, then federated credential, then certificate","",""
"app:1a000000-0000-4000-8000-000000000005","Entra","AppRegistration","Vendor Portal","0a000000-0000-4000-8000-000000000005","1a000000-0000-4000-8000-000000000005","True","","","",,,,"False","","0","","None","","Own","AzureADMultipleOrgs","2","5a000000-0000-4000-8000-000000000004; 5a000000-0000-4000-8000-000000000005","user; user","CMDB-2001","0","1","0","2027-04-28","Certificate","0","","","","0","False","LOW","","Certificate on the rotation schedule; federated credential where the host has an issuer","",""
"app:1a000000-0000-4000-8000-000000000006","Entra","AppRegistration","Mail Automation","0a000000-0000-4000-8000-000000000006","1a000000-0000-4000-8000-000000000006","True","","","",,,,"False","","0","","None","","Own","AzureADMyOrg","2","5a000000-0000-4000-8000-000000000006; 5a000000-0000-4000-8000-000000000001","user; user","CMDB-1100","1","0","0","2027-05-01","Secret","0","","Directory.ReadWrite.All; Mail.Send","Directory.ReadWrite.All","1","True","HIGH","holds Directory.ReadWrite.All","Replace the client secret: managed identity, then federated credential, then certificate","",""
"app:1a000000-0000-4000-8000-000000000008","Entra","AgentIdentityBlueprint","Benefits Agent Blueprint","0a000000-0000-4000-8000-000000000008","1a000000-0000-4000-8000-000000000008",,"","","",,,,"False","","0","","None","","Own","AzureADMyOrg","1","5a000000-0000-4000-8000-000000000001","user","CMDB-4001","0","0","0","","None","0","","","","0","False","LOW","","AI agent identity blueprint: Chapter 09","","An agent identity blueprint; its sponsors and agent identities are read in Chapter 09"
"app:1a000000-0000-4000-8000-000000000007","Entra","AppRegistration","Deploy Bot","0a000000-0000-4000-8000-000000000007","1a000000-0000-4000-8000-000000000007","True","","","",,,,"False","","0","","None","","Own","AzureADMyOrg","2","5a000000-0000-4000-8000-000000000003; 5a000000-0000-4000-8000-000000000008","user; user","CMDB-1300","0","2","0","2027-02-01","Certificate","0","","","","0","False","LOW","","Certificate on the rotation schedule; federated credential where the host has an issuer","",""
"app:1a000000-0000-4000-8000-000000000009","Entra","AppRegistration","Survey Tool","0a000000-0000-4000-8000-000000000009","1a000000-0000-4000-8000-000000000009","True","","","",,,,"False","","0","","None","","Own","AzureADMyOrg","1","5a000000-0000-4000-8000-000000000007","user","","0","0","0","","None","0","","","","0","False","LOW","","No credential: confirm it is still needed","",""
"sp:5b000000-0000-4000-8000-000000000001","Entra","ServicePrincipal","Payroll Export","5b000000-0000-4000-8000-000000000001","1a000000-0000-4000-8000-000000000001","True","","","",,,,"False","","0","","None","","Own","AzureADMyOrg",,"","","","1","0","0","2027-10-30","OnAppRegistration+ServicePrincipalSecret","0","","","","0","False","MEDIUM","holds a client secret","Governed through its app registration","","Permissions, owners and credentials are on its app registration row"
"sp:5b000000-0000-4000-8000-000000000002","Entra","ServicePrincipal","HR Connector","5b000000-0000-4000-8000-000000000002","1a000000-0000-4000-8000-000000000002","True","","","",,,,"False","","0","","None","","Own","AzureADMyOrg",,"","","","0","0","0","","OnAppRegistration","0","","","","0","False","LOW","","Governed through its app registration","","Permissions, owners and credentials are on its app registration row"
"sp:5b000000-0000-4000-8000-000000000003","Entra","ServicePrincipal","Legacy Reports","5b000000-0000-4000-8000-000000000003","1a000000-0000-4000-8000-000000000003","True","","","",,,,"False","","0","","None","","Own","AzureADMyOrg",,"","","","0","0","0","","OnAppRegistration","0","","","","0","False","LOW","","Governed through its app registration","","Permissions, owners and credentials are on its app registration row"
"sp:5b000000-0000-4000-8000-000000000004","Entra","ServicePrincipal","Build Pipeline","5b000000-0000-4000-8000-000000000004","1a000000-0000-4000-8000-000000000004","True","","","",,,,"False","","0","","None","","Own","AzureADMyOrg",,"","","","0","0","0","","OnAppRegistration","0","","","","0","False","LOW","","Governed through its app registration","","Permissions, owners and credentials are on its app registration row"
"sp:5b000000-0000-4000-8000-000000000005","Entra","ServicePrincipal","Vendor Portal","5b000000-0000-4000-8000-000000000005","1a000000-0000-4000-8000-000000000005","True","","","",,,,"False","","0","","None","","Own","AzureADMultipleOrgs",,"","","","0","0","0","","OnAppRegistration","0","","","","0","False","LOW","","Governed through its app registration","","Permissions, owners and credentials are on its app registration row"
"sp:5b000000-0000-4000-8000-000000000006","Entra","ServicePrincipal","Mail Automation","5b000000-0000-4000-8000-000000000006","1a000000-0000-4000-8000-000000000006","True","","","",,,,"False","","0","","None","","Own","AzureADMyOrg",,"","","","0","0","0","","OnAppRegistration","0","","","","0","False","LOW","","Governed through its app registration","","Permissions, owners and credentials are on its app registration row"
"sp:5b000000-0000-4000-8000-000000000007","Entra","ServicePrincipal","Deploy Bot","5b000000-0000-4000-8000-000000000007","1a000000-0000-4000-8000-000000000007","True","","","",,,,"False","","0","","None","","Own","AzureADMyOrg",,"","","","0","0","0","","OnAppRegistration","0","","","","0","False","LOW","","Governed through its app registration","","Permissions, owners and credentials are on its app registration row"
"sp:5b000000-0000-4000-8000-000000000009","Entra","ServicePrincipal","Survey Tool","5b000000-0000-4000-8000-000000000009","1a000000-0000-4000-8000-000000000009","True","","","",,,,"False","","0","","None","","Own","AzureADMyOrg",,"","","","0","0","0","","OnAppRegistration","0","","","","0","False","LOW","","Governed through its app registration","","Permissions, owners and credentials are on its app registration row"
"sp:5b000000-0000-4000-8000-000000000011","Entra","ExternalServicePrincipal","Partner CRM","5b000000-0000-4000-8000-000000000011","1b000000-0000-4000-8000-000000000011","True","","","",,,,"False","","0","","None","","External","AzureADMultipleOrgs",,"","","","0","0","0","","HomeTenant","0","","","","1","True","LOW","","Credentials are in the home tenant: review consent and permissions","",""
"sp:5b000000-0000-4000-8000-000000000012","Entra","LegacyServicePrincipal","Old SAML Connector","5b000000-0000-4000-8000-000000000012","1b000000-0000-4000-8000-000000000012","True","","","",,,,"False","","0","","None","","Own","","0","","","","1","0","0","2027-08-01","Secret","0","","","","0","False","MEDIUM","holds a client secret","Replace with an app registration and service principal","",""
"mi:5b000000-0000-4000-8000-000000000013","Entra","ManagedIdentitySystemAssigned","vm-batch01","5b000000-0000-4000-8000-000000000013","1b000000-0000-4000-8000-000000000013","True","","Azure","/subscriptions/11111111-1111-4111-8111-111111111111/resourceGroups/rg-batch/providers/Microsoft.Compute/virtualMachines/vm-batch01",,,,"False","","0","","None","","Own","",,"","","","0","0","0","","ManagedByAzure","0","","User.Read.All","","0","False","LOW","","Keep: managed identity; scope its role assignments (Chapter 07)","",""
"mi:5b000000-0000-4000-8000-000000000014","Entra","ManagedIdentityUserAssigned","id-deploy","5b000000-0000-4000-8000-000000000014","1b000000-0000-4000-8000-000000000014","True","","Azure","/subscriptions/11111111-1111-4111-8111-111111111111/resourceGroups/rg-identity/providers/Microsoft.ManagedIdentity/userAssignedIdentities/id-deploy",,,,"False","","0","","None","","Own","",,"","","","0","0","0","","ManagedByAzure+Federated","1","https://token.actions.githubusercontent.com | repo:contoso/infra:environment:production","","","0","False","LOW","","Keep: managed identity; join it to a record, since it outlives its resources","",""
"sp:5b000000-0000-4000-8000-000000000015","Entra","AgentIdentity","Benefits Q&A Agent","5b000000-0000-4000-8000-000000000015","1b000000-0000-4000-8000-000000000015","True","","","",,,,"False","","0","","None","","Own","AzureADMyOrg",,"","","","0","0","0","","","0","","","","0","False","LOW","","AI agent identity: Chapter 09","","An agent identity (servicePrincipalType ServiceIdentity); sponsors and blueprint are read in Chapter 09"
