Why AI identity is the security problem of the next decade.

What is an AI identity?

When people think "identity" they picture a person with a username. But most identities in a modern cloud tenant aren't people at all, they're non-human identities (NHIs): service accounts, service principals, OAuth-connected apps, app registrations, automation, and now AI agents and Copilots. Each can authenticate, hold permissions, and reach data without a human in the loop at the moment it acts.

An "AI identity" is simply a non-human identity created by, or acting on behalf of, an AI system. A Copilot connected to SharePoint, a custom agent with mailbox access, a third-party AI tool granted OAuth scopes: each is an identity with standing reach into company data.

Why AI creates new identities, fast

The whole point of an AI agent is to act for you, which means it needs access. Turn on more AI and you mint more identities, each with permissions that rarely get reviewed. The result is a quiet explosion of non-human identities inside every Microsoft 365 tenant:

¹ Gartner (analyst estimate, ~45:1); vendor telemetry: Entro Labs, NHI & Secrets Risk Report (H1 2025), 144:1. ² CyberArk, 2025 State of Machine Identity Security (which independently puts the ratio at >80:1 and finds 79% of leaders expect up to 150% growth in a year). ³ Grand View Research. Cited as third-party industry research.

Why it matters now

This isn't a future problem, the industry's most-watched voices are already flagging it:

• Gartner predicts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents due to governance gaps identified only after production incidents occur, and names AI agents as a defining force reshaping identity and access management.⁴
• Microsoft is building native management for agent identities (Entra Agent ID, Agent 365), when the platform itself races to govern AI identities, the problem is real.
• Canalys (now part of Omdia) found 61% of partners still struggle to get AI projects out of the proof-of-concept stage with customers, adoption stalls precisely where governance is unclear.⁵
• The Cloud Security Alliance has stood up dedicated research on non-human identity and agentic-AI governance, a sign the security community now treats this as its own discipline.⁶

What good governance looks like

Governing AI identities comes down to four capabilities: discover every AI and non-human identity in the tenant; understand what each can reach and who owns it; score the risk and blast radius; and govern continuously, with the evidence mapped to the frameworks auditors and insurers ask about. Done well, governance isn't a brake on AI, it's what lets you say "yes" with confidence.

Who delivers it: your MSP

For most organisations, the partner best placed to do this is the MSP who already runs their Microsoft 365 tenant. That's what Sabiki AIRM is built for: an agentless, read-only layer that gives MSPs the observability and governance to make AI safe for every client, and turn it into a recurring managed service.

Go deeper: The non-human identity explosion in Microsoft 365 → · How MSPs turn this into a service →