# Non-Human Identity Discovery Resources

## Microsoft Entra AI Agent Resource

| Field | Value |
| --- | --- |
| Resource ID | `azure-as-agent` |
| Resource type | `std:agent` |
| Identity attribute | id |
| Display attribute | name |

The following table lists schema attributes for the Microsoft Entra AI Agent resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| agentType | Constant discriminator supplied by SailPoint NHI Discovery (for example, `SaaS Agent`). | string | No | No |
| appUrl | Application URL in the source system (for example, an Azure portal app URL). | string | No | No |
| classification | Pre-filled classification enum (for example, `Third-party` or `Homegrown`). | string | No | No |
| detectionMethod | Detection method used by SailPoint NHI Discovery (for example, `Azure Service Principal`). | string | No | No |
| environment | Environment name from the source account. | string | No | No |
| id | Stable identity for the agent (Azure service principal ID). | string | No | No |
| insights | Human-readable insight descriptions from SailPoint NHI Discovery policy evaluation. | string | No | Yes |
| integrationType | Integration type reported by the source (for example, `AZURE`). | string | No | No |
| isVerifiedPublisher | Whether Microsoft has verified the publisher. Returns null when verification status is unavailable. | boolean | No | No |
| lastSeen | ISO-8601 timestamp for the most recent usage or update. | string | No | No |
| name | Normalized AI client name (for example, `m365-mcp-server-for-copilot`). | string | No | No |
| ownerEmail | Flattened owner email used for owner correlation. | string | No | No |
| rawName | Original name from the source system (for example, `M365 MCP Server for Copilot`). | string | No | No |
| riskBand | Severity band from SailPoint NHI Discovery (for example, `BENIGN`, `LOW`, `MEDIUM`, or `HIGH`). | string | No | No |
| sourceAccount | Account display name (falls back to account or tenant ID when a display name is unavailable). | string | No | No |
| sourceUrl | Deep link to the source object (for example, an Azure portal URL). | string | No | No |
| tags | Tags from the source account. | string | No | Yes |
| verifiedPublisherName | Verified publisher display name, when present. | string | No | No |

## Microsoft Entra App Token Resources

| Field | Value |
| --- | --- |
| Resource ID | `azure:app-token` |
| Resource type | `std:credential` |
| Identity attribute | id |
| Display attribute | id |

The following table lists schema attributes for the Microsoft Entra App Token resource:

<table class="span-table"> <tr> <td>Attribute</td> <td>Description</td> <td>Type</td> <td>Entitlement</td> <td>Multi-valued</td> </tr> <tr> <td>complianceBreach</td> <td>Compliance control IDs the token fails.</td> <td>string</td> <td colspan="1" rowspan="8">No</td> <td>Yes</td> </tr> <tr> <td>exposed</td> <td>Whether the token is externally exposed.</td> <td>boolean</td> <td>No</td> </tr> <tr> <td>id</td> <td>Stable token identifier from SailPoint NHI Discovery.</td> <td>string</td> <td>No</td> </tr> <tr> <td>lastUsedService</td> <td>Downstream service most recently used by the token.</td> <td>string</td> <td>No</td> </tr> <tr> <td>ownerEmail</td> <td>Flattened primary owner email used for owner correlation.</td> <td>string</td> <td>No</td> </tr> <tr> <td>riskSeverity</td> <td>Severity band from SailPoint NHI Discovery (for example, <code>LOW</code> or <code>HIGH</code>).</td> <td>string</td> <td>No</td> </tr> <tr> <td>suspiciousActivity</td> <td>Whether SailPoint NHI Discovery has flagged suspicious activity for the token.</td> <td>boolean</td> <td>No</td> </tr> <tr> <td>tags</td> <td>Tags carried through from the source account.</td> <td>string</td> <td>Yes</td> </tr> </table>

## Microsoft Entra Hybrid Service Account Resource

| Field | Value |
| --- | --- |
| Resource ID | `azure:hybrid-service-account` |
| Resource type | `std:account` |
| Identity attribute | id |
| Display attribute | id |

The following table lists schema attributes for the Microsoft Entra Hybrid Service Account resource:

<table class="span-table"> <tr> <td>Attribute</td> <td>Description</td> <td>Type</td> <td>Entitlement</td> <td>Multi-valued</td> </tr> <tr> <td>complianceBreach</td> <td>Compliance control IDs the account fails.</td> <td>string</td> <td colspan="1" rowspan="8">No</td> <td>Yes</td> </tr> <tr> <td>exposed</td> <td>Whether the account is externally exposed.</td> <td>boolean</td> <td>No</td> </tr> <tr> <td>id</td> <td>Stable account identifier from SailPoint NHI Discovery.</td> <td>string</td> <td>No</td> </tr> <tr> <td>lastUsedService</td> <td>Downstream service most recently used by the account.</td> <td>string</td> <td>No</td> </tr> <tr> <td>ownerEmail</td> <td>Flattened primary owner email used for owner correlation.</td> <td>string</td> <td>No</td> </tr> <tr> <td>riskSeverity</td> <td>Severity band from SailPoint NHI Discovery (for example, <code>LOW</code> or <code>HIGH</code>).</td> <td>string</td> <td>No</td> </tr> <tr> <td>suspiciousActivity</td> <td>Whether SailPoint NHI Discovery has flagged suspicious activity for the account.</td> <td>boolean</td> <td>No</td> </tr> <tr> <td>tags</td> <td>Tags carried through from the source account.</td> <td>string</td> <td>Yes</td> </tr> </table>

## Microsoft Entra SAML Certificate Resource

| Field | Value |
| --- | --- |
| Resource ID | `azure-saml-certificate` |
| Resource type | `std:credential` |
| Identity attribute | id |
| Display attribute | id |

The following table lists schema attributes for the Microsoft Entra SAML Certificate resource:

<table class="span-table"> <tr> <td>Attribute</td> <td>Description</td> <td>Type</td> <td>Entitlement</td> <td>Multi-valued</td> </tr> <tr> <td>complianceBreach</td> <td>Compliance control IDs the certificate fails.</td> <td>string</td> <td colspan="1" rowspan="8">No</td> <td>Yes</td> </tr> <tr> <td>exposed</td> <td>Whether the certificate is externally exposed.</td> <td>boolean</td> <td>No</td> </tr> <tr> <td>id</td> <td>Stable certificate identifier from SailPoint NHI Discovery.</td> <td>string</td> <td>No</td> </tr> <tr> <td>lastUsedService</td> <td>Downstream service most recently used by the certificate.</td> <td>string</td> <td>No</td> </tr> <tr> <td>ownerEmail</td> <td>Flattened primary owner email used for owner correlation.</td> <td>string</td> <td>No</td> </tr> <tr> <td>riskSeverity</td> <td>Severity band from SailPoint NHI Discovery (for example, <code>LOW</code> or <code>HIGH</code>).</td> <td>string</td> <td>No</td> </tr> <tr> <td>suspiciousActivity</td> <td>Whether SailPoint NHI Discovery has flagged suspicious activity for the certificate.</td> <td>boolean</td> <td>No</td> </tr> <tr> <td>tags</td> <td>Tags carried through from the source account.</td> <td>string</td> <td>Yes</td> </tr> </table>

## Microsoft 365 Copilot Chat Resource

| Field | Value |
| --- | --- |
| Resource ID | `azure:copilot-enterprise-chat` |
| Resource type | `std:agent` |
| Identity attribute | id |
| Display attribute | name |

The following table lists schema attributes for the Microsoft 365 Copilot Chat resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| agentType | Discriminator from SailPoint NHI Discovery (for example, `Microsoft Copilot License`). | string | No | No |
| classification | Prettified classification enum (for example, `Third-party` or `Homegrown`). | string | No | No |
| connectedServices | Connected Microsoft 365 services (for example, SharePoint, Office, or Outlook). | string | No | Yes |
| detectionMethod | Detection method used by SailPoint NHI Discovery (for example, `Microsoft 365 Copilot License Assignment`). | string | No | No |
| environment | Environment name from the source account (for example, `Production`). | string | No | No |
| id | Stable identity for the Copilot chat or license assignment (GUID from SailPoint NHI Discovery). | string | No | No |
| insights | Human-readable insight descriptions from SailPoint NHI Discovery policy evaluation. | string | No | Yes |
| integrationType | Integration type reported by the source (for example, `AZURE`). | string | No | No |
| lastSeen | ISO-8601 timestamp for the most recent usage or update signal. | string | No | No |
| name | Normalized name (for example, `microsoft 365 copilot`). | string | No | No |
| ownerEmail | Flattened owner email used for owner correlation. Returns null when SailPoint NHI Discovery provides only `userPrincipalName`. | string | No | No |
| rawName | Original name from the source system (for example, `M365 BizChat`). | string | No | No |
| riskBand | Severity band from SailPoint NHI Discovery (for example, `BENIGN`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`, or `UNKNOWN`). | string | No | No |
| sessionCount | Total Copilot session count reported by SailPoint NHI Discovery. | int | No | No |
| sourceAccount | Account display name (falls back to account or tenant ID when a display name is unavailable). | string | No | No |
| sourceUrl | Deep link to the source object. Returns null when SailPoint NHI Discovery has no URL. | string | No | No |
| suspiciousSessionCount | Count of Copilot sessions SailPoint NHI Discovery marked as suspicious. | int | No | No |
| tags | Tags from the source account. | string | No | Yes |
| userPrincipalName | User principal name (UPN) of the licensed or chat user. Used as the primary owner correlation key when owner email is null. | string | No | No |

## Microsoft Entra Application Credentials Resources

The Microsoft Entra Application Credentials dataset includes the following resources, which are collected together during dataset aggregation. These credentials belong to app registrations and SAML enterprise applications.

Application credential native IDs use `{application.appId}:{credential.keyId}`. The SAML token signing certificate native ID uses `{SP object id}:{Sign keyId}`.

<table class="span-table"> <tr> <td>Resource name</td> <td>Resource type</td> <td>Resource ID</td> </tr> <tr> <td><a href="#microsoft-entra-app-client-secret">Microsoft Entra App Client Secret</a></td> <td colspan="1" rowspan="4">Credential</td> <td><code>azure:app-client-secret</code></td> </tr> <tr> <td><a href="#microsoft-entra-app-certificate">Microsoft Entra App Certificate</a></td> <td><code>azure:app-certificate</code></td> </tr> <tr> <td><a href="#microsoft-entra-app-federated-credential">Microsoft Entra App Federated Credential</a></td> <td><code>azure:app-federated-credential</code></td> </tr> <tr> <td><a href="#microsoft-entra-saml-token-signing-certificate">Microsoft Entra SAML Token Signing Certificate</a></td> <td><code>azure:saml-cert</code></td> </tr> </table>

### Microsoft Entra App Client Secret

| Field | Value |
| --- | --- |
| Resource ID | `azure:app-client-secret` |
| Resource type | `std:credential` |

The following table lists schema attributes for the Microsoft Entra App Client Secret resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| LastRotated | The last rotation time. This value matches startDateTime. | String | No | No |
| NHIType | The non-human identity type. Always set to `AZURE_APP_TOKEN`. | String | No | No |
| ResourceUrl | The Microsoft Entra admin center Credentials blade URL. | String | No | No |
| appDisplayName | The display name of the app registration. This value comes from Microsoft Graph application.displayName. | String | No | No |
| creationDate | The credential start time (startDateTime). | String | No | No |
| credentialId | The keyId of the Microsoft Graph passwordCredential. | String | No | No |
| credentialType | The Certificates &amp; secrets tab name in the Microsoft Entra admin center. Always set to `Client secrets`. | String | No | No |
| daysSinceLastUse | The number of full days from lastUsed to the current time. This attribute is omitted when the credential is expired or the last-used time is unknown. | Integer | No | No |
| daysUntilExpiry | The number of full days from the current time to the end date. This attribute is omitted when the credential is expired. | Integer | No | No |
| discoveredAt | The time the connector aggregated the credential. | String | No | No |
| expirationDate | The credential end time (endDateTime). | String | No | No |
| extendedPermissions | A JSON object of extended permissions, stored as a string. | String | No | No |
| isActive | Indicates whether the credential is not expired, has been created, and was last used within 90 days (`true` or `false`). | Boolean | No | No |
| isAdmin | Indicates whether the parent service principal has an Azure Resource Manager (ARM) role with the exact scope `*` (`true` or `false`). | Boolean | No | No |
| isIdle | Indicates whether the credential meets the 30-day unused rule (`true` or `false`). | Boolean | No | No |
| lastUsed | The last sign-in time for this keyId. This value comes from Microsoft Graph appCredentialSignInActivities lastSignInDateTime. | String | No | No |
| lifetimeDays | The number of full days from the start date to the end date. This attribute is omitted when the credential is expired. | Integer | No | No |
| name | The list display name, in the form `{appDisplayName}:{credentialId}`. | String | No | No |
| ownerEmail | The email address of the first owner object. | String | No | No |
| owners | A JSON array of owner objects, stored as a string. | String | No | No |
| parentAppId | The application (client) ID (appId). | String | No | No |
| permissions | A JSON array of API permissions, stored as a string. | String | No | No |
| riskFlags | A JSON array of SailPoint policy flags, stored as a string. The array includes `EXPIRED` when the current time is past endDateTime. | String | No | No |
| sailpointId | The native ID, in the form `{application.appId}:{credential.keyId}`. | String | No | No |
| secretHint | The password hint. This value comes from Microsoft Graph passwordCredential.hint. | String | No | No |
| spDescription | The display name of the Microsoft Graph passwordCredential. | String | No | No |
| tags | A JSON array of Microsoft Graph application tags, stored as a string. | String | No | No |
| tenant | The tenant domain of the connection. | String | No | No |
| tokenAgeDays | The number of full days from the start date to aggregation. This attribute is omitted when the credential is expired. | Integer | No | No |
| tokenName | The parent application ID (appId). | String | No | No |

### Microsoft Entra App Certificate

| Field | Value |
| --- | --- |
| Resource ID | `azure:app-certificate` |
| Resource type | `std:credential` |

The following table lists schema attributes for the Microsoft Entra App Certificate resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| LastRotated | The last rotation time. This value matches startDateTime. | String | No | No |
| NHIType | The non-human identity type. Always set to `AZURE_APP_TOKEN`. | String | No | No |
| ResourceUrl | The Microsoft Entra admin center Credentials blade URL. | String | No | No |
| appDisplayName | The display name of the app registration. This value comes from Microsoft Graph application.displayName. | String | No | No |
| certificateThumbprint | The certificate thumbprint. This value comes from Microsoft Graph customKeyIdentifier. | String | No | No |
| creationDate | The credential start time (startDateTime). | String | No | No |
| credentialId | The keyId of the Microsoft Graph keyCredential. | String | No | No |
| credentialType | The Certificates &amp; secrets tab name in the Microsoft Entra admin center. Always set to `Certificates`. | String | No | No |
| daysSinceLastUse | The number of full days from lastUsed to the current time. This attribute is omitted when the credential is expired or the last-used time is unknown. | Integer | No | No |
| daysUntilExpiry | The number of full days from the current time to the end date. This attribute is omitted when the credential is expired. | Integer | No | No |
| discoveredAt | The time the connector aggregated the credential. | String | No | No |
| expirationDate | The credential end time (endDateTime). | String | No | No |
| extendedPermissions | A JSON object of extended permissions, stored as a string. | String | No | No |
| isActive | Indicates whether the credential is not expired, has been created, and was last used within 90 days (`true` or `false`). | Boolean | No | No |
| isAdmin | Indicates whether the parent service principal has an Azure Resource Manager (ARM) role with the exact scope `*` (`true` or `false`). | Boolean | No | No |
| isIdle | Indicates whether the credential meets the 30-day unused rule (`true` or `false`). | Boolean | No | No |
| lastUsed | The last sign-in time for this keyId. This value comes from Microsoft Graph appCredentialSignInActivities lastSignInDateTime. | String | No | No |
| lifetimeDays | The number of full days from the start date to the end date. This attribute is omitted when the credential is expired. | Integer | No | No |
| name | The list display name, in the form `{appDisplayName}:{credentialId}`. | String | No | No |
| ownerEmail | The email address of the first owner object. | String | No | No |
| owners | A JSON array of owner objects, stored as a string. | String | No | No |
| parentAppId | The application (client) ID (appId). | String | No | No |
| permissions | A JSON array of API permissions, stored as a string. | String | No | No |
| riskFlags | A JSON array of SailPoint policy flags, stored as a string. The array includes `EXPIRED` when the current time is past endDateTime. | String | No | No |
| sailpointId | The native ID, in the form `{application.appId}:{credential.keyId}`. | String | No | No |
| secretHint | The password hint. This attribute is empty for certificates. | String | No | No |
| spDescription | The display name of the Microsoft Graph keyCredential. | String | No | No |
| tags | A JSON array of Microsoft Graph application tags, stored as a string. | String | No | No |
| tenant | The tenant domain of the connection. | String | No | No |
| tokenAgeDays | The number of full days from the start date to aggregation. This attribute is omitted when the credential is expired. | Integer | No | No |
| tokenName | The parent application ID (appId). | String | No | No |

### Microsoft Entra App Federated Credential

| Field | Value |
| --- | --- |
| Resource ID | `azure:app-federated-credential` |
| Resource type | `std:credential` |

The following table lists schema attributes for the Microsoft Entra App Federated Credential resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| NHIType | The non-human identity type. Always set to `AZURE_FEDERATED_CREDENTIAL`. | String | No | No |
| ResourceUrl | The Microsoft Entra admin center Certificates &amp; secrets blade URL. | String | No | No |
| appDisplayName | The display name of the app registration. This value comes from Microsoft Graph application.displayName. | String | No | No |
| audiences | A JSON array of audiences, stored as a string. A typical value is `api://AzureADTokenExchange`. | String | No | No |
| credentialId | The ID of the Microsoft Graph federatedIdentityCredential. | String | No | No |
| credentialType | The Certificates &amp; secrets tab name in the Microsoft Entra admin center. Always set to `Federated credentials`. | String | No | No |
| extendedPermissions | A JSON object of extended permissions from the parent application, stored as a string. | String | No | No |
| issuer | The issuer of the Microsoft Graph federatedIdentityCredential. | String | No | No |
| name | The list display name, in the form `{appDisplayName}:{FIC name}`. FIC is the federated identity credential. | String | No | No |
| ownerEmail | The email address of the first owner object. | String | No | No |
| owners | A JSON array of owner objects, stored as a string. | String | No | No |
| parentAppId | The application (client) ID (appId). | String | No | No |
| permissions | The parent application's requiredResourceAccess, stored as a string. This value is copied from the parent application and is not stored on the federated identity credential. | String | No | No |
| sailpointId | The native ID, in the form `{application.appId}:{federatedIdentityCredential.id}`. | String | No | No |
| spDescription | The description of the Microsoft Graph federatedIdentityCredential. | String | No | No |
| subject | The subject of the Microsoft Graph federatedIdentityCredential. This value is an OpenID Connect (OIDC) subject or a managed identity object ID. | String | No | No |
| tags | A JSON array of Microsoft Graph application tags, stored as a string. | String | No | No |
| tenant | The tenant domain of the connection. | String | No | No |

### Microsoft Entra SAML Token Signing Certificate

| Field | Value |
| --- | --- |
| Resource ID | `azure:saml-cert` |
| Resource type | `std:credential` |

The following table lists schema attributes for the Microsoft Entra SAML Token Signing Certificate resource:

| Attribute | Description | Type | Entitlement | Multi-valued |
| --- | --- | --- | --- | --- |
| LastRotated | The last rotation time. This value matches startDateTime. | String | No | No |
| NHIType | The non-human identity type. Always set to `AZURE_SAML_CERTIFICATE`. | String | No | No |
| ResourceUrl | The Microsoft Entra admin center Single sign-on blade URL. | String | No | No |
| appDisplayName | The display name of the enterprise application. | String | No | No |
| certificateThumbprint | The certificate thumbprint. This value comes from Microsoft Graph customKeyIdentifier. | String | No | No |
| creationDate | The certificate start time (startDateTime). | String | No | No |
| credentialId | The Sign keyId from Microsoft Graph. | String | No | No |
| credentialType | The portal credential kind. Always set to `Saml Certificate`. | String | No | No |
| daysSinceLastUse | The number of full days since last use. This attribute is omitted because lastUsed is empty for SAML certificates. | Integer | No | No |
| daysUntilExpiry | The number of full days from aggregation to endDateTime. This attribute is omitted when the certificate is expired. | Integer | No | No |
| expirationDate | The certificate end time (endDateTime). | String | No | No |
| lifetimeDays | The number of full days from startDateTime to endDateTime. This attribute is omitted when the certificate is expired. | Integer | No | No |
| name | The list display name, in the form `{appDisplayName}:{credentialId}`. | String | No | No |
| ownerEmail | The email address of the first owner object. | String | No | No |
| owners | A JSON array of owner objects, stored as a string. | String | No | No |
| parentAppId | The application (client) ID (appId). | String | No | No |
| riskFlags | A JSON array of SailPoint policy flags based on Microsoft Graph dates and isAdmin, stored as a string. The array includes `EXPIRED` when the current time is past endDateTime. These flags are not Microsoft risk indicators. | String | No | No |
| sailpointId | The native ID, in the form `{SP object id}:{Sign keyId}`. | String | No | No |
| spDescription | The display name of the Microsoft Graph keyCredential. | String | No | No |
| tags | A JSON array of Microsoft Graph service principal tags, stored as a string. | String | No | No |
| tenant | The tenant domain of the connection. | String | No | No |
| tokenAgeDays | The number of full days from startDateTime to aggregation. This attribute is omitted when the certificate is expired. | Integer | No | No |
| usage | The certificate key usage. Set to `Sign` or `Verify`. | String | No | No |