The following table lists schema attributes for the Microsoft Entra AI Agent resource:
Attribute
Description
Type
Entitlement
Multi-valued
agentType
Constant discriminator supplied by SailPoint NHI Discovery (for example, SaaS Agent).
string
No
No
appUrl
Application URL in the source system (for example, an Azure portal app URL).
string
No
No
classification
Pre-filled classification enum (for example, Third-party or Homegrown).
string
No
No
detectionMethod
Detection method used by SailPoint NHI Discovery (for example, Azure Service Principal).
string
No
No
environment
Environment name from the source account.
string
No
No
id
Stable identity for the agent (Azure service principal ID).
string
No
No
insights
Human-readable insight descriptions from SailPoint NHI Discovery policy evaluation.
string
No
Yes
integrationType
Integration type reported by the source (for example, AZURE).
string
No
No
isVerifiedPublisher
Whether Microsoft has verified the publisher. Returns null when verification status is unavailable.
boolean
No
No
lastSeen
ISO-8601 timestamp for the most recent usage or update.
string
No
No
name
Normalized AI client name (for example, m365-mcp-server-for-copilot).
string
No
No
ownerEmail
Flattened owner email used for owner correlation.
string
No
No
rawName
Original name from the source system (for example, M365 MCP Server for Copilot).
string
No
No
riskBand
Severity band from SailPoint NHI Discovery (for example, BENIGN, LOW, MEDIUM, or HIGH).
string
No
No
sourceAccount
Account display name (falls back to account or tenant ID when a display name is unavailable).
string
No
No
sourceUrl
Deep link to the source object (for example, an Azure portal URL).
string
No
No
tags
Tags from the source account.
string
No
Yes
verifiedPublisherName
Verified publisher display name, when present.
string
No
No
Microsoft Entra App Token Resources
Field
Value
Resource ID
azure:app-token
Resource type
std:credential
Identity attribute
id
Display attribute
id
The following table lists schema attributes for the Microsoft Entra App Token resource:
Attribute
Description
Type
Entitlement
Multi-valued
complianceBreach
Compliance control IDs the token fails.
string
No
Yes
exposed
Whether the token is externally exposed.
boolean
No
id
Stable token identifier from SailPoint NHI Discovery.
string
No
lastUsedService
Downstream service most recently used by the token.
string
No
ownerEmail
Flattened primary owner email used for owner correlation.
string
No
riskSeverity
Severity band from SailPoint NHI Discovery (for example, LOW or HIGH).
string
No
suspiciousActivity
Whether SailPoint NHI Discovery has flagged suspicious activity for the token.
boolean
No
tags
Tags carried through from the source account.
string
Yes
Microsoft Entra Hybrid Service Account Resource
Field
Value
Resource ID
azure:hybrid-service-account
Resource type
std:account
Identity attribute
id
Display attribute
id
The following table lists schema attributes for the Microsoft Entra Hybrid Service Account resource:
Attribute
Description
Type
Entitlement
Multi-valued
complianceBreach
Compliance control IDs the account fails.
string
No
Yes
exposed
Whether the account is externally exposed.
boolean
No
id
Stable account identifier from SailPoint NHI Discovery.
string
No
lastUsedService
Downstream service most recently used by the account.
string
No
ownerEmail
Flattened primary owner email used for owner correlation.
string
No
riskSeverity
Severity band from SailPoint NHI Discovery (for example, LOW or HIGH).
string
No
suspiciousActivity
Whether SailPoint NHI Discovery has flagged suspicious activity for the account.
boolean
No
tags
Tags carried through from the source account.
string
Yes
Microsoft Entra SAML Certificate Resource
Field
Value
Resource ID
azure-saml-certificate
Resource type
std:credential
Identity attribute
id
Display attribute
id
The following table lists schema attributes for the Microsoft Entra SAML Certificate resource:
Attribute
Description
Type
Entitlement
Multi-valued
complianceBreach
Compliance control IDs the certificate fails.
string
No
Yes
exposed
Whether the certificate is externally exposed.
boolean
No
id
Stable certificate identifier from SailPoint NHI Discovery.
string
No
lastUsedService
Downstream service most recently used by the certificate.
string
No
ownerEmail
Flattened primary owner email used for owner correlation.
string
No
riskSeverity
Severity band from SailPoint NHI Discovery (for example, LOW or HIGH).
string
No
suspiciousActivity
Whether SailPoint NHI Discovery has flagged suspicious activity for the certificate.
boolean
No
tags
Tags carried through from the source account.
string
Yes
Microsoft 365 Copilot Chat Resource
Field
Value
Resource ID
azure:copilot-enterprise-chat
Resource type
std:agent
Identity attribute
id
Display attribute
name
The following table lists schema attributes for the Microsoft 365 Copilot Chat resource:
Attribute
Description
Type
Entitlement
Multi-valued
agentType
Discriminator from SailPoint NHI Discovery (for example, Microsoft Copilot License).
string
No
No
classification
Prettified classification enum (for example, Third-party or Homegrown).
string
No
No
connectedServices
Connected Microsoft 365 services (for example, SharePoint, Office, or Outlook).
string
No
Yes
detectionMethod
Detection method used by SailPoint NHI Discovery (for example, Microsoft 365 Copilot License Assignment).
string
No
No
environment
Environment name from the source account (for example, Production).
string
No
No
id
Stable identity for the Copilot chat or license assignment (GUID from SailPoint NHI Discovery).
string
No
No
insights
Human-readable insight descriptions from SailPoint NHI Discovery policy evaluation.
string
No
Yes
integrationType
Integration type reported by the source (for example, AZURE).
string
No
No
lastSeen
ISO-8601 timestamp for the most recent usage or update signal.
string
No
No
name
Normalized name (for example, microsoft 365 copilot).
string
No
No
ownerEmail
Flattened owner email used for owner correlation. Returns null when SailPoint NHI Discovery provides only userPrincipalName.
string
No
No
rawName
Original name from the source system (for example, M365 BizChat).
string
No
No
riskBand
Severity band from SailPoint NHI Discovery (for example, BENIGN, LOW, MEDIUM, HIGH, CRITICAL, or UNKNOWN).
string
No
No
sessionCount
Total Copilot session count reported by SailPoint NHI Discovery.
int
No
No
sourceAccount
Account display name (falls back to account or tenant ID when a display name is unavailable).
string
No
No
sourceUrl
Deep link to the source object. Returns null when SailPoint NHI Discovery has no URL.
string
No
No
suspiciousSessionCount
Count of Copilot sessions SailPoint NHI Discovery marked as suspicious.
int
No
No
tags
Tags from the source account.
string
No
Yes
userPrincipalName
User principal name (UPN) of the licensed or chat user. Used as the primary owner correlation key when owner email is null.
string
No
No
Microsoft Entra Application Credentials Resources
The Microsoft Entra Application Credentials dataset includes the following resources, which are collected together during dataset aggregation. These credentials belong to app registrations and SAML enterprise applications.
Application credential native IDs use {application.appId}:{credential.keyId}. The SAML token signing certificate native ID uses {SP object id}:{Sign keyId}.
The following table lists schema attributes for the Microsoft Entra App Client Secret resource:
Attribute
Description
Type
Entitlement
Multi-valued
LastRotated
The last rotation time. This value matches startDateTime.
String
No
No
NHIType
The non-human identity type. Always set to AZURE_APP_TOKEN.
String
No
No
ResourceUrl
The Microsoft Entra admin center Credentials blade URL.
String
No
No
appDisplayName
The display name of the app registration. This value comes from Microsoft Graph application.displayName.
String
No
No
creationDate
The credential start time (startDateTime).
String
No
No
credentialId
The keyId of the Microsoft Graph passwordCredential.
String
No
No
credentialType
The Certificates & secrets tab name in the Microsoft Entra admin center. Always set to Client secrets.
String
No
No
daysSinceLastUse
The number of full days from lastUsed to the current time. This attribute is omitted when the credential is expired or the last-used time is unknown.
Integer
No
No
daysUntilExpiry
The number of full days from the current time to the end date. This attribute is omitted when the credential is expired.
Integer
No
No
discoveredAt
The time the connector aggregated the credential.
String
No
No
expirationDate
The credential end time (endDateTime).
String
No
No
extendedPermissions
A JSON object of extended permissions, stored as a string.
String
No
No
isActive
Indicates whether the credential is not expired, has been created, and was last used within 90 days (true or false).
Boolean
No
No
isAdmin
Indicates whether the parent service principal has an Azure Resource Manager (ARM) role with the exact scope * (true or false).
Boolean
No
No
isIdle
Indicates whether the credential meets the 30-day unused rule (true or false).
Boolean
No
No
lastUsed
The last sign-in time for this keyId. This value comes from Microsoft Graph appCredentialSignInActivities lastSignInDateTime.
String
No
No
lifetimeDays
The number of full days from the start date to the end date. This attribute is omitted when the credential is expired.
Integer
No
No
name
The list display name, in the form {appDisplayName}:{credentialId}.
String
No
No
ownerEmail
The email address of the first owner object.
String
No
No
owners
A JSON array of owner objects, stored as a string.
String
No
No
parentAppId
The application (client) ID (appId).
String
No
No
permissions
A JSON array of API permissions, stored as a string.
String
No
No
riskFlags
A JSON array of SailPoint policy flags, stored as a string. The array includes EXPIRED when the current time is past endDateTime.
String
No
No
sailpointId
The native ID, in the form {application.appId}:{credential.keyId}.
String
No
No
secretHint
The password hint. This value comes from Microsoft Graph passwordCredential.hint.
String
No
No
spDescription
The display name of the Microsoft Graph passwordCredential.
String
No
No
tags
A JSON array of Microsoft Graph application tags, stored as a string.
String
No
No
tenant
The tenant domain of the connection.
String
No
No
tokenAgeDays
The number of full days from the start date to aggregation. This attribute is omitted when the credential is expired.
Integer
No
No
tokenName
The parent application ID (appId).
String
No
No
Microsoft Entra App Certificate
Field
Value
Resource ID
azure:app-certificate
Resource type
std:credential
The following table lists schema attributes for the Microsoft Entra App Certificate resource:
Attribute
Description
Type
Entitlement
Multi-valued
LastRotated
The last rotation time. This value matches startDateTime.
String
No
No
NHIType
The non-human identity type. Always set to AZURE_APP_TOKEN.
String
No
No
ResourceUrl
The Microsoft Entra admin center Credentials blade URL.
String
No
No
appDisplayName
The display name of the app registration. This value comes from Microsoft Graph application.displayName.
String
No
No
certificateThumbprint
The certificate thumbprint. This value comes from Microsoft Graph customKeyIdentifier.
String
No
No
creationDate
The credential start time (startDateTime).
String
No
No
credentialId
The keyId of the Microsoft Graph keyCredential.
String
No
No
credentialType
The Certificates & secrets tab name in the Microsoft Entra admin center. Always set to Certificates.
String
No
No
daysSinceLastUse
The number of full days from lastUsed to the current time. This attribute is omitted when the credential is expired or the last-used time is unknown.
Integer
No
No
daysUntilExpiry
The number of full days from the current time to the end date. This attribute is omitted when the credential is expired.
Integer
No
No
discoveredAt
The time the connector aggregated the credential.
String
No
No
expirationDate
The credential end time (endDateTime).
String
No
No
extendedPermissions
A JSON object of extended permissions, stored as a string.
String
No
No
isActive
Indicates whether the credential is not expired, has been created, and was last used within 90 days (true or false).
Boolean
No
No
isAdmin
Indicates whether the parent service principal has an Azure Resource Manager (ARM) role with the exact scope * (true or false).
Boolean
No
No
isIdle
Indicates whether the credential meets the 30-day unused rule (true or false).
Boolean
No
No
lastUsed
The last sign-in time for this keyId. This value comes from Microsoft Graph appCredentialSignInActivities lastSignInDateTime.
String
No
No
lifetimeDays
The number of full days from the start date to the end date. This attribute is omitted when the credential is expired.
Integer
No
No
name
The list display name, in the form {appDisplayName}:{credentialId}.
String
No
No
ownerEmail
The email address of the first owner object.
String
No
No
owners
A JSON array of owner objects, stored as a string.
String
No
No
parentAppId
The application (client) ID (appId).
String
No
No
permissions
A JSON array of API permissions, stored as a string.
String
No
No
riskFlags
A JSON array of SailPoint policy flags, stored as a string. The array includes EXPIRED when the current time is past endDateTime.
String
No
No
sailpointId
The native ID, in the form {application.appId}:{credential.keyId}.
String
No
No
secretHint
The password hint. This attribute is empty for certificates.
String
No
No
spDescription
The display name of the Microsoft Graph keyCredential.
String
No
No
tags
A JSON array of Microsoft Graph application tags, stored as a string.
String
No
No
tenant
The tenant domain of the connection.
String
No
No
tokenAgeDays
The number of full days from the start date to aggregation. This attribute is omitted when the credential is expired.
Integer
No
No
tokenName
The parent application ID (appId).
String
No
No
Microsoft Entra App Federated Credential
Field
Value
Resource ID
azure:app-federated-credential
Resource type
std:credential
The following table lists schema attributes for the Microsoft Entra App Federated Credential resource:
Attribute
Description
Type
Entitlement
Multi-valued
NHIType
The non-human identity type. Always set to AZURE_FEDERATED_CREDENTIAL.
String
No
No
ResourceUrl
The Microsoft Entra admin center Certificates & secrets blade URL.
String
No
No
appDisplayName
The display name of the app registration. This value comes from Microsoft Graph application.displayName.
String
No
No
audiences
A JSON array of audiences, stored as a string. A typical value is api://AzureADTokenExchange.
String
No
No
credentialId
The ID of the Microsoft Graph federatedIdentityCredential.
String
No
No
credentialType
The Certificates & secrets tab name in the Microsoft Entra admin center. Always set to Federated credentials.
String
No
No
extendedPermissions
A JSON object of extended permissions from the parent application, stored as a string.
String
No
No
issuer
The issuer of the Microsoft Graph federatedIdentityCredential.
String
No
No
name
The list display name, in the form {appDisplayName}:{FIC name}. FIC is the federated identity credential.
String
No
No
ownerEmail
The email address of the first owner object.
String
No
No
owners
A JSON array of owner objects, stored as a string.
String
No
No
parentAppId
The application (client) ID (appId).
String
No
No
permissions
The parent application's requiredResourceAccess, stored as a string. This value is copied from the parent application and is not stored on the federated identity credential.
String
No
No
sailpointId
The native ID, in the form {application.appId}:{federatedIdentityCredential.id}.
String
No
No
spDescription
The description of the Microsoft Graph federatedIdentityCredential.
String
No
No
subject
The subject of the Microsoft Graph federatedIdentityCredential. This value is an OpenID Connect (OIDC) subject or a managed identity object ID.
String
No
No
tags
A JSON array of Microsoft Graph application tags, stored as a string.
String
No
No
tenant
The tenant domain of the connection.
String
No
No
Microsoft Entra SAML Token Signing Certificate
Field
Value
Resource ID
azure:saml-cert
Resource type
std:credential
The following table lists schema attributes for the Microsoft Entra SAML Token Signing Certificate resource:
Attribute
Description
Type
Entitlement
Multi-valued
LastRotated
The last rotation time. This value matches startDateTime.
String
No
No
NHIType
The non-human identity type. Always set to AZURE_SAML_CERTIFICATE.
String
No
No
ResourceUrl
The Microsoft Entra admin center Single sign-on blade URL.
String
No
No
appDisplayName
The display name of the enterprise application.
String
No
No
certificateThumbprint
The certificate thumbprint. This value comes from Microsoft Graph customKeyIdentifier.
String
No
No
creationDate
The certificate start time (startDateTime).
String
No
No
credentialId
The Sign keyId from Microsoft Graph.
String
No
No
credentialType
The portal credential kind. Always set to Saml Certificate.
String
No
No
daysSinceLastUse
The number of full days since last use. This attribute is omitted because lastUsed is empty for SAML certificates.
Integer
No
No
daysUntilExpiry
The number of full days from aggregation to endDateTime. This attribute is omitted when the certificate is expired.
Integer
No
No
expirationDate
The certificate end time (endDateTime).
String
No
No
lifetimeDays
The number of full days from startDateTime to endDateTime. This attribute is omitted when the certificate is expired.
Integer
No
No
name
The list display name, in the form {appDisplayName}:{credentialId}.
String
No
No
ownerEmail
The email address of the first owner object.
String
No
No
owners
A JSON array of owner objects, stored as a string.
String
No
No
parentAppId
The application (client) ID (appId).
String
No
No
riskFlags
A JSON array of SailPoint policy flags based on Microsoft Graph dates and isAdmin, stored as a string. The array includes EXPIRED when the current time is past endDateTime. These flags are not Microsoft risk indicators.
String
No
No
sailpointId
The native ID, in the form {SP object id}:{Sign keyId}.
String
No
No
spDescription
The display name of the Microsoft Graph keyCredential.
String
No
No
tags
A JSON array of Microsoft Graph service principal tags, stored as a string.
String
No
No
tenant
The tenant domain of the connection.
String
No
No
tokenAgeDays
The number of full days from startDateTime to aggregation. This attribute is omitted when the certificate is expired.
Integer
No
No
usage
The certificate key usage. Set to Sign or Verify.
String
No
No
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.