Machine Identities
Last updated
A machine identity is a non-human account: a service account, automation credential, shared mailbox, or integration login. It can hold access and act, but no single person is its user.
AOH Sync tracks machine identities separately from people because they follow different rules. A service account should outlive any individual, but never outlive its accountability.
AOH Sync identifies machine identities using configurable rules defined per connector: naming patterns, account types, source-system flags. Because rules are per connector, a service account in one system can be detected differently than in another.
Every machine identity has an owner: a human identity accountable for it. Ownership can be inherited through a chain, so an account owned by someone who reports to a manager has a fallback path if the direct owner is unavailable. A machine identity is never just floating.
When an owner triggers a leaver event, AOH Sync runs an ownership transfer cascade:
The leaver's machine identities are identified.
Ownership moves to the next party in the chain (typically the manager fallback).
The transfer is recorded in the audit trail.
A machine identity can track inheritors: the parties who would take ownership next. This makes the accountability chain visible before any transfer happens.
The questions differ. For a user you ask "should this person still have access?" For a machine identity you ask "who is responsible for this, and what happens to it when that person is gone?"
Last updated