Managing Non-Human Accounts

You can review and manage your organization’s non-human accounts on the Accounts page. Non-human accounts include machine, service, or bot accounts that relate to a program or service.

You can view a list of non-human accounts, their statuses, owners, and associated non-human identities by selecting Accounts from the Non-Human Identities section of the navigation menu.

You can use the quick filter tiles to review all accounts or refine the account list to view discovered accounts. You can use more filters to further refine the accounts listed in the table. Select + More to view more filter options. To clear all filters, select Clear All Filters.

Viewing Account Details

You can select an account to view additional information about it and its attributes.

1. Go to Agentic Fabric.

2. From the navigation menu, go to the Non-Human Identities section and select Accounts.

3. Select an account.

   On the account’s page, you can:

   • View and copy the account’s attributes in the Details tab. You can update the display of this page by:
     • Pinning important attributes to the Overview section. The attributes display in the order they were pinned. The default attributes cannot be unpinned.
     • Updating the display of the Attributes section to view attributes in a single column or multiple columns.
   • Review the account’s correlated non-human identities in the Non-Human Identities tab.
   • View the account’s identity graph, entitlement assignments, and direct permissions in the Access tab.
   • View the account's lineage map, which demonstrates the relationship between agents and various resources, on the Usage tab. Select each node to view additional information.

Enabling Non-Human Accounts

You can enable an account on a source.

1. Go to Agentic Fabric.

2. From the navigation menu, go to the Non-Human Identities section and select Accounts.

3. Find the account you want to enable and select the Actions icon > Enable Account.

   To enable multiple accounts, select the checkboxes next to the accounts to enable and then select Enable Accounts. You can select up to 100 accounts at a time.

4. In the confirmation window, select Enable.

   Depending on the number of accounts being enabled, the account changes might take some time to process. If successful, the accounts are enabled.

Disabling Non-Human Accounts

You might need to disable an account on a source if a user reports suspicious activity on that account.

1. Go to Agentic Fabric.

2. From the navigation menu, go to the Non-Human Identities section and select Accounts.

3. Find the account you want to disable and select the Actions icon > Disable Account.

   To disable multiple accounts, select the checkboxes next to the accounts to disable and then select Disable Accounts. You can select up to 100 accounts at a time.

4. In the confirmation window, select Disable.

   Depending on the number of accounts being disabled, the account changes might take some time to process. If successful, the accounts are disabled.

Aggregating Non-Human Accounts

You can aggregate data for a single account rather than run a full aggregation.

1. Go to Agentic Fabric.

2. From the navigation menu, go to the Non-Human Identities section and select Accounts.

3. Find the account you want to aggregate and select the Actions icon > Aggregate Account.

   To aggregate multiple accounts, select the checkboxes next to the accounts that require aggregation and then select Aggregate Accounts. You can select up to 100 accounts at a time.

   Note

   If an account is on a source that doesn't support aggregation, the account is ignored during the aggregation.

   If the account’s source is in a healthy state, the aggregation will begin. Depending on the number of accounts selected, the aggregations might take some time to process.

Managing Non-Human Account Requests

Administrators can enable users to submit requests for new non-human accounts, configure the creation form that users fill out to make a request, and define the approval process that the requests will follow.

When non-human account requests are enabled, users can request the creation of non-human accounts and track the status of their requests.

Updating Non-Human Accounts

You can manually update a non-human account. For example, you might need to update the account owner for a non-human account if the previous owner moves to a different role or leaves your organization.

1. Go to Agentic Fabric.

2. From the navigation menu, go to the Non-Human Identities section and select Accounts.

3. Find the account you want to update and select the Actions icon > Update Account.

   To update multiple accounts, select the checkboxes next to the accounts that require updates and then select Update Accounts. You can select up to 100 accounts at a time.

   Note

   When you update the attributes for multiple accounts, an account’s existing attributes will be replaced with your changes. For example, if an account is included in a bulk update that adds an additional owner, the new owner assignment replaces the account’s existing assignments.

4. Make the required change and then select Apply.

   Notes

   • If you manually update an account, it will no longer respect the mappings set during machine account configuration.
   • As account subtypes are created at the source level, you can only update the account subtype for multiple accounts if they reside on the same source.

   The update might take some time depending on the number of accounts selected.

Discovering Potential Non-Human Accounts

Agentic Fabric identifies possible non-human accounts based on common patterns of non-human account attributes. You can review these insights to see why the account was recommended as a non-human account and determine whether you should update its correlation.

1. Go to Agentic Fabric.

2. From the navigation menu, go to the Non-Human Identities section and select Accounts.

3. Select the Discovered Accounts tile to view accounts identified as potential non-human accounts.

   Note

   SailPoint’s Machine Account Discovery reviews updated accounts daily to discover possible non-human accounts. When discovered, the Discovered as Machine or Discovered as Agent label is added to these accounts.

4. Select the Discovered as Machine filter to view a list of possible machine accounts that should be correlated to machine identities.

5. Select the Discovered as Agent filter to view a list of possible non-human accounts that should be correlated to agents.

6. Select the label in the Insights column to view the reasons why the account was discovered as a potential non-human account.

7. If the account is a non-human account, select the checkbox for the account and select Correlate to Machine Identity.

   To update the correlation for multiple accounts, select the checkboxes next to the accounts and then select Correlate to Machine Identity.

8. If the account is a human account, select the checkbox for the account and select Dismiss Insights. The account is removed from the list of accounts.

   To dismiss insights for multiple accounts, select the checkboxes next to the accounts and then select Dismiss Insights.

Updating Correlation

If a user classified a non-human account incorrectly, you can update the account’s correlation to update its classification.

1. Go to Agentic Fabric.

2. From the navigation menu, go to the Non-Human Identities section and select Accounts.

3. Find the account you want to update and select the Actions icon > Update Correlation.

4. Under Account Type, select the type of account the account should be updated to.

5. In the Correlated Identity dropdown list, select the identity the account should be correlated to.

6. Select Save to save these changes.

Clearing Manual Classification

If a user classified a non-human account incorrectly, you can clear the account's classification and return it to its original account type.

1. Go to Agentic Fabric.

2. From the navigation menu, go to the Non-Human Identities section and select Accounts.

3. Find the account you want to update and select the Actions icon > Undo Classification.

   Alternatively, you can select Undo Manual Classification from the Actions menu on the account's details page.

   To update multiple accounts, select the checkboxes next to the accounts that require updates and then select Undo Manual Classification. You can select up to 100 accounts at a time.

   The update might take some time depending on the number of accounts selected. If successful, the accounts return to their original classification.

Removing Non-Human Accounts

You might need to remove an account to fix data on the source.

1. Go to Agentic Fabric.

2. From the navigation menu, go to the Non-Human Identities section and select Accounts.

3. Find the account you want to remove and select the Actions icon > Remove Accounts.

4. In the confirmation window, select Remove to remove the account. This action removes the account from SailPoint Human Fabric, not from the source system itself.

The account is removed and will be added again during your next full aggregation.

Note

If your source is configured for delta aggregation, you should disable it if you want to reaggregate the account.

Deleting Non-Human Accounts

If your organization has decommissioned an application, you may need to delete the non-human accounts associated with it. If approvals are required for the deletion, your request will be sent to a reviewer and will go through the configured approval process.

1. Go to Agentic Fabric.

2. From the navigation menu, go to the Non-Human Identities section and select Accounts.

3. Find the account you want to delete and select the Actions icon > Delete Account.

   Notes

   • You can only delete accounts on direct connect sources that support account deletion. Refer to SailPoint Identity Security Connectors for a list connectors and their supported account operations.
   • Account deletions are not supported on the IdentityNow source.

4. In the confirmation window, review the account and source information.

5. If your request requires approval, enter the business justification for deleting this account in the Comment field and select Request.

6. If your request does not require approval, select Delete to confirm the deletion.

You can track the status of your request on the Account Requests page in your Request Center. You’ll also receive email notifications about the request throughout its approval and provisioning process.

Note

For Service Desk Integration sources, a ticket will be created to track the account deletion request.

If your request is approved, the account is removed from the source. If your request is denied, no action is taken on the account.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.