Securing the Non-Human Identity Attack Surface
Cybersecurity teams often spend most of their efforts on securing and governing human identities: enforcing Multi-Factor Authentication (MFA), monitoring phishing campaigns, and tightening joiner-mover-leaver processes. Yet, lurking quietly inside every information technology environment is an entirely different population that frequently outnumbers employees: Non-Human Identities (NHI). These workload identities—which encompass applications, service principals, managed identities, CI/CD runners, and automated AI agents—are the connective tissue powering modern IT operations. They run deployment pipelines, automate resource provisioning, and pull data from cloud APIs. Unlike human users, however, they cannot complete an MFA prompt. When an attacker gets their hands on a service principal’s credentials, there is no push notification or phone call standing in the way. The Core Problem: Security & Governance Asymmetry Organizations routinely hold human users to rigorous security standards while letting NHIs operate with sprawling, unmonitored privileges. This disparity turns machine accounts into a high-value attack surface. Once compromised, an identity with broad infrastructure and application permissions grants immediate, high-speed execution capabilities. With AI agents proliferating, automated attacks are evolving. In late 2026, Microsoft published threat intelligence on “Storm-3168: Agentic-driven cloud attacks using compromised service principals” [1]. The immediate danger isn't a science-fiction swarm of sentient rogue AIs. Rather, it is machine-speed execution: scripts and agents performing rapid credential stuffing, instant permission discovery, and automated API reconnaissance through identities that bypass human friction. These modern threats need a modern and comprehensive solution for advanced cyber warfare. The Solution: Microsoft’s multi-layer defense mode: Entra Workload ID Premium + Defender for Cloud (Defender for Resource Manager) + Agent 365 Defending NHIs requires stopping unauthorized access at authentication and monitoring what the identity does once inside. Microsoft tackles this through a multi-layer defense strategy. Layer 1 | Control the Front Door with Microsoft Entra Workload ID Microsoft Entra Workload ID is designed specifically for non-human identities, it focuses on who gets a token and under what conditions: Conditional Access for workload identities — Restricts token issuance to specific public IP ranges and blocks requests when risk thresholds are crossed. Identity Protection for workloads — Detects risky service principals, including leaked credentials, and lets you investigate, confirm compromise, or disable the identity. App Health Recommendations — Flags stale, inactive service principals and expiring secrets before attackers exploit them. Access reviews — Forces scheduled recertification for service principals holding privileged directory roles. Layer 2 | Detect what Non-Human Identities do with Defender for Resource Manager Even with strict front-door checks, a legitimate secret can still be abused. Microsoft Defender for Resource Manager provides a behavioral detection layer for the Azure management plane, analyzing Azure Resource Manager (ARM) operations for suspicious activity that may indicate an identity has been compromised. For Non-Human Identities, Microsoft provides dedicated service-principal behavioral detections that look for suspicious use of high-risk Azure management operations. These detections span the attack lifecycle, including initial access, credential access, execution, persistence, privilege escalation, defense evasion, lateral movement, collection, and impact. This allows Defender to identify scenarios where a service principal may have valid credentials and legitimate Azure RBAC permissions, but begins using those permissions in ways consistent with an attacker. When suspicious behavior is detected, it is surfaced as a Defender for Cloud security alert, providing security teams with information about the detected activity, severity, and associated attack technique. Defender for Resource Manager can also detect surrounding indicators such as activity from suspicious IP addresses or TOR infrastructure, unusual privilege or role changes, abnormal resource creation, persistence activity, and known Azure exploitation techniques. Together, these signals help the SOC move beyond “Was this Non-Human Identity allowed to authenticate?” to the more important question: “After authentication, is this identity behaving like the expected workload or like an attacker?” A full list of the alerts provided by Microsoft Defender for Resource Manager is on the Defender for Cloud alerts reference page. [2] Layer 3 | Give AI agents an identity, governance, and security plane with Microsoft Agent 365 Unlike a traditional application that executes a relatively predictable workflow, an agent can reason, invoke tools, access corporate data, interact with other services, and take actions on behalf of a user or itself. Organizations therefore need controls that extend beyond simply authenticating the underlying application. Microsoft Agent 365 provides a control plane for discovering, governing, and securing agents across the organization: Agent registry and inventory: Establishes centralized visibility into registered agents so security and IT teams can identify agents operating across the environment rather than relying on individual development teams to track them. Connected platforms and the Agent 365 SDK extend visibility and management to agents built outside Microsoft's native agent platforms. Purpose-built agent identity with Microsoft Entra Agent ID: Gives agents a distinct identity foundation instead of treating every agent as an indistinguishable application or service principal. This allows security teams to apply controls to the agent itself and better understand which agent is requesting access. Agent ownership and sponsorship: Associates agents with accountable human sponsors. This creates an ownership model for non-human identities so an agent can be reviewed, governed, and ultimately disabled or removed when its sponsor, business purpose, or lifecycle changes. Lifecycle governance: Applies identity governance controls to agents so access does not have to become permanent simply because an agent was deployed. Organizations can govern the lifecycle from onboarding and access assignment through review and eventual removal. Governed resource access: Microsoft Entra governance capabilities such as access packages can be used to define which resources an agent should receive access to, who can request or approve that access, and how long the entitlement should remain. Conditional Access for agents: Agent-specific Conditional Access gives organizations another policy enforcement point for controlling how agent identities access protected resources. This helps move agent security away from implicit trust toward policy-based access. Agent-aware protection across Microsoft security: Agent 365 integrates the agent into Microsoft's broader security and compliance ecosystem, including Microsoft Defender and Microsoft Purview, so organizations can investigate agent-related threats, apply data security controls, and incorporate agents into existing security operations rather than creating a separate security program for AI. Activity and observability: Centralized agent visibility helps security and operations teams understand which agents exist, who sponsors them, what resources they can reach, and how they are interacting with the enterprise environment. This is critical when autonomous actions occur without a person directly initiating every transaction. Beyond outlining Microsoft's multi-layer defense controls that organizations can implement to protect their NHIs from modern threats, below are practical principles and actionable steps, alongside Microsoft's official mitigation and protection guidance for Storm-3168. Core Principles to Harden Non-Human Identities: Prefer secretless authentication — Use managed identities for Azure workloads, and Workload Identity Federation (OIDC) to swap short-lived tokens instead of storing static credentials. Apply least privilege — Give service principals only the specific roles and scopes they need. Avoid broad Owner or Contributor assignments. Own and review them — Assign clear owners. Regularly review privileged service principals and clean up unused apps and credentials. Watch for risk signals — Use Entra Workload ID Identity Protection features to detect leaked credentials and risky sign-in behavior, and pair that with monitoring of Azure resource operations. Treat them like privileged accounts — Even though they’re not people, high-privilege workload identities deserve the same rigor you apply to admin accounts: inventory, review, and rapid response. Practical Steps to Harden Entra Workload Identities: Secure access with adaptive policies: Apply Conditional Access policies to service principals using Conditional Access for workload identities. Enable real-time enforcement of Conditional Access location and risk policies using Continuous access evaluation for workload identities. Manage custom security attributes for an app Intelligently detect compromised identities: Detect risks (like leaked credentials), contain threats, and reduce risk to workload identities and agents using Microsoft Entra ID Protection. Simplify lifecycle management: Access Microsoft Entra protected resources without needing to manage secrets for workloads that run on Azure using managed identities. Access Microsoft Entra protected resources without needing to manage secrets using workload identity federation for supported scenarios such as GitHub Actions, workloads running on Kubernetes, or workloads running in compute platforms outside of Azure. Review service principals and applications that are assigned to privileged directory roles in Microsoft Entra ID using access reviews for service principals. Mitigation and Protection Guidance for Storm-3168: “Agentic-driven cloud attacks using compromised service principals” Enable appropriate Microsoft Defender for Cloud plans for critical Azure workloads. Consider enabling workload protections relevant to the resources in your environment, including Defender for Resource Manager, Defender for Storage, Defender for Key Vault, Defender for App Service and Defender for Databases. Learn more in the Microsoft Defender for Cloud overview. Protect and continuously assess application credentials and secrets. Avoid storing service principal credentials, storage keys, connection strings, and other secrets in source code, configuration files, public repositories, issues, or other locations where they might be inadvertently exposed. Learn more in the Microsoft Entra Workload ID documentation. Rotate compromised or exposed credentials immediately and establish credential lifecycle practices. Treat credentials that have been publicly exposed as compromised, even if the original location has subsequently been edited or deleted. Removing the content does not invalidate the credential or eliminate copies retained in edit history, caches, archives, logs, or other systems. Immediately revoke or rotate the affected credentials and investigate their historical use. Where supported, organizations should favor mechanisms that reduce reliance on long-lived credentials. Learn more about protecting secrets with Defender for Cloud. Apply least privilege to service principals and other workload identities. Review the Azure RBAC permissions assigned to service principals and restrict their privileges to the resources and operations required by their applications. Learn more about best practices for Azure RBAC. Protect backup and recovery infrastructure as part of ransomware resilience. Restrict access to backup and recovery resources and closely monitor attempts to modify or remove their protection controls. Learn more about Azure Backup security best practices. Scale investigation and response with agentic defenses. Use Project Perception to help defenders deploy AI agents that investigate and respond across large, complex environments at machine speed. Strengthen security posture for AI applications and agentic systems. Use Microsoft Defender for AI Security (codename MDASH) to discover AI assets, identify vulnerabilities and misconfigurations, and reduce exposure to AI-related attack paths. The Bottom Line Non-Human Identities are no longer just “service accounts.” They are first-class identities that attackers actively target. Because they can’t use MFA and often lack strong lifecycle management, a single leaked secret or compromised pipeline can give an attacker lasting, high-impact access. Microsoft provides the multi-layer security controls to inventory, review, risk-assess, and restrict these non-human identities. Combined with least-privilege access, secretless authentication, and monitoring of what NHIs actually do in Azure, organizations can significantly reduce their risk to these identity-based attacks. For additional details or assistance, please reach out to your Microsoft Representative. Learn More: For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog. Review our documentation to learn how to prevent identity attacks, ensure least privilege access, unify access controls, and see how to enable them within your organization. Learn more about securing Copilot Studio agents with Microsoft Defender Evaluate your AI readiness with our latest Zero Trust for AI workshop. Microsoft 365 Copilot AI security documentation How Microsoft discovers and mitigates evolving attacks against AI guardrails Prompt injection protection in Microsoft Defender for Office 365 – official documentation of the prompt injection protection in Microsoft Defender for Office 365. How Microsoft discovers and mitigates evolving attacks against AI guardrails | Microsoft Security Blog Manipulating AI memory for profit: The rise of AI Recommendation Poisoning | Microsoft Security Blog – a related example of an AI-era technique observed in email traffic Defending the inbox against prompt injection attacks | Microsoft Defender for Office 365 Blog – feature announcement introducing prompt injection protection in Microsoft Defender for Office 365. Learn how Microsoft is reimagining the SOC for the agentic era with ISOC in Microsoft Defender Microsoft Entra News and Insights | Microsoft Security Blog Microsoft Entra documentation | Microsoft Learn References: [1] Microsoft Corporation. Storm-3168: Agentic-driven cloud attacks using compromised service principals | Microsoft Security Blog 2 Microsoft Corporation. Alerts for Resource Manager - Microsoft Defender for Cloud | Microsoft LearnSeamless and Secure Access to Digital Healthcare Records with Microsoft Entra Suite
Healthcare professionals who dedicate their skills to saving lives must also manage operational and safety challenges inherent to their roles. If you’re in charge of cybersecurity for a healthcare organization, you’re intimately familiar with the need to comply with government healthcare regulations that, for example, require securing access to systems that house patient health information (PHI), are used for overseeing controlled substances, or are necessary to enable the secure consumption of AI. Every year, hundreds of U.S. healthcare institutions fall victim to ransomware attacks, resulting in network closures and critical systems going offline, not to mention delayed medical operations and appointments.[i] Sensitive healthcare systems are very attractive targets for cyberattacks and internal misuse. Many cybercriminals gain initial access by compromising identities. Thus, the first line of defense against bad actors, whether internal or external, is to protect identities and to closely govern access permissions based on Zero Trust principles: Verify explicitly. Confirm that the individual signing into a system used to electronically prescribe controlled substances is actually the care provider they say they are. Use least privilege access. Limit a care giver’s access to systems they need to use for their job Assume breach. Discover unauthorized access and block it before an adversary can deploy ransomware. This blog is the first in a series of how Microsoft Entra Suite and the power of cloud-based security tools can protect access to sensitive healthcare assets while improving the user experience for care teams and staff. On-premises healthcare applications and cloud-based security Some of the most widely adopted healthcare applications, such as electronic health records (EHRs), began decades ago as on-premises solutions that used LDAP (Lightweight Directory Access Protocol) and Active Directory to authenticate users. As enterprises shifted from on-premises networks protected by firewalls at the network perimeter to hybrid environments that enabled “anytime, anywhere access,” these solutions became vulnerable to attackers who gained unauthorized access to hospital networks via the Internet. Cloud-based security tools introduced advantages such as centralized visibility and control, continuous monitoring, automated threat detection and response, and advanced threat intelligence based on trillions of security signals. Many existing healthcare applications, however, didn’t support the new protocols necessary to take advantage of all these benefits. Over the past several years, Microsoft has worked closely with software vendors to integrate their applications with our comprehensive identity security platform, Entra ID—which is built on modern open security standards. As a result, many healthcare applications, including the most widely deployed EHR systems, can now benefit from the advanced security capabilities available through Microsoft Entra Suite, including single sign-on (SSO), multifactor authentication (MFA), Conditional Access, Identity Protection, and Network Protection. Securing access to healthcare applications with Microsoft Entra Suite Healthcare organizations can standardize on Microsoft Entra to enable single sign-on (SSO) to their most commonly used Healthcare applications and resources, including the most widely used EHR vendors, whether they’re on-premises or in clouds from Microsoft, Amazon, Google, or Oracle. Care teams, who may use dozens of different applications during their workday, benefit from seamless and secure access to all their resources with Microsoft’s built-in advanced identity and network security controls. Not only does Microsoft Entra offer a holistic view of all users and their access permissions, but it also employs a centralized access policy engine, called Conditional Access, that combines trillions of signals from multiple sources, including identities and devices, to detect anomalous user behavior, assess risk, and make real-time access and data protection decisions that adhere to regulatory mandates and Zero Trust principles. In simple terms, this enables controls that verify who a user is and what device they are using – including when using kiosks, remote, or many-to-one workstations - to decide if it is safe to enable access. This ability to support modern authentication successfully maps the clinicians to their cloud identity and in turn, unlocks powerful user-based models for data protection with Microsoft Purview. With Microsoft Entra, healthcare organizations can enforce MFA at the application level for more granular control. They can strengthen security by requiring phishing-resistant authentication for staff, contractors, and partners, and by evaluating device health before authorizing access to resources. They can even require additional verification steps for IT admins performing sensitive actions. Moreover, Microsoft Entra ID Protection processes a vast array of signals to identify suspicious behaviors that may indicate an identity compromise. It can raise risk levels to trigger risk-based Conditional Access policies that protect users and resources from unauthorized access. For more details about risk detections in Entra ID Protection, visit our documentation. Seamless and secure access for healthcare professionals Integrating applications with Microsoft Entra ID makes it possible for healthcare professionals to work more securely with fewer disruptions when they access medical records and treat patients, even when they’re working offsite, such as at a patient’s home or as part of a mobile medical unit. Microsoft Entra supports the strict protocols for electronic prescribing of controlled substances (EPCS). The EPCS mandate requires that healthcare providers authenticate their identities before they can prescribe controlled substances electronically. This means that each provider must have a unique user identity that can be verified through secure methods such as Multi-Factor Authentication (MFA). This helps prevent unauthorized access and ensures that only authorized individuals can issue prescriptions. The Health Insurance Portability and Accountability Act (HIPAA) also has specific obligations for access and identity to ensure the security and privacy of protected health information (PHI). Microsoft Entra Suite has a variety of controls to help meet these obligations that we will explore in additional blogs. Phishing-resistant authentication methods, which rely on biometrics and hardware tokens, significantly reduce the risk of unauthorized access to sensitive systems and data. These methods, which include passkeys, are practically impossible for cybercriminals to compromise, unlike passwords or SMS-based MFA. By eliminating passwords altogether, healthcare providers can better protect patient data, reduce the risk of violating HIPAA regulations, and prevent cyber and ransomware attacks that could disrupt healthcare operations. You can experience the benefits of Microsoft Entra ID, MFA, Conditional Access, and Entra ID Protection as part of the Microsoft Entra Suite, the industry’s most comprehensive Zero Trust access solution for the workforce. The Microsoft Entra Suite provides everything needed to verify users, prevent overprivileged permissions, improve detections, and enforce granular access controls for all users and resources. Get started with the Microsoft Entra Suite with a free 90-day trial. For additional details, please reach out to your Microsoft Representative. Read more on this topic Electronic Prescriptions for Controlled Substances (EPCS) - Azure Compliance | Microsoft Learn Conditional Access adaptive session lifetime policies - Microsoft Entra ID | Microsoft Learn Overview of Microsoft Entra authentication strength - Microsoft Entra ID | Microsoft Learn Microsoft Entra ID Epic Connector – Edgile Use data connectors to import and archive third-party data in Microsoft 365 | Microsoft Learn Learn more about Microsoft Entra Prevent identity attacks, ensure least privilege access, unify access controls, and improve the experience for users with comprehensive identity and network access solutions across on-premises and clouds. Microsoft Entra News and Insights | Microsoft Security Blog Microsoft Entra blog | Tech Community Microsoft Entra documentation | Microsoft Learn Microsoft Entra discussions | Microsoft Community [i] Microsoft Corporation. Microsoft Digital Defense Report 2024: The foundations and new frontiers of cybersecurity. p.3. Microsoft, October 2024.
