Why non-human identity is the security problem of the next decade.
Every AI feature you switch on in Microsoft 365 creates something new and invisible: an identity. Understanding those identities, and who can see them, is fast becoming the difference between adopting AI safely and stalling at the pilot. Here's what "non-human identity" means, why it's exploding, and what the analysts are saying.
What is an non-human identity?
When people think "identity" they picture a person with a username. But most identities in a modern cloud tenant aren't people at all, they're non-human identities (NHIs): service accounts, service principals, OAuth-connected apps, app registrations, automation, and now AI agents and Copilots. Each can authenticate, hold permissions, and reach data without a human in the loop at the moment it acts.
An "non-human identity" is simply a non-human identity created by, or acting on behalf of, an AI system. A Copilot connected to SharePoint, a custom agent with mailbox access, a third-party AI tool granted OAuth scopes: each is an identity with standing reach into company data.
Why AI creates new identities, fast
The whole point of an AI agent is to act for you, which means it needs access. Turn on more AI and you mint more identities, each with permissions that rarely get reviewed. The result is a quiet explosion of non-human identities inside every Microsoft 365 tenant:
1 Gartner (analyst estimate, ~45:1); vendor telemetry: Entro Labs, NHI & Secrets Risk Report (H1 2025), 144:1. 2 CyberArk, 2025 State of Machine Identity Security (which independently puts the ratio at >80:1 and finds 79% of leaders expect up to 150% growth in a year). 3 Grand View Research. Cited as third-party industry research.
Why it matters now
This isn't a future problem, the industry's most-watched voices are already flagging it:
- Gartner predicts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents due to governance gaps identified only after production incidents occur, and names AI agents as a defining force reshaping identity and access management.4
- Microsoft is building native management for agent identities (Entra Agent ID, Agent 365), when the platform itself races to govern non-human identities, the problem is real.
- Canalys (now part of Omdia) found 61% of partners still struggle to get AI projects out of the proof-of-concept stage with customers, adoption stalls precisely where governance is unclear.5
- The Cloud Security Alliance has stood up dedicated research on non-human identity and agentic-AI governance, a sign the security community now treats this as its own discipline.6
What good governance looks like
Governing non-human identities comes down to four capabilities: discover every non-human identity in the tenant; understand what each can reach and who owns it; score the risk and blast radius; and govern continuously, with the evidence mapped to the frameworks auditors and insurers ask about. Done well, governance isn't a brake on AI, it's what lets you say "yes" with confidence.
Who delivers it: your MSP
For most organisations, the partner best placed to do this is the MSP who already runs their Microsoft 365 tenant. That's what Sabiki AIRM is built for: an agentless, read-only layer that gives MSPs the observability and governance to make AI safe for every client, and turn it into a recurring managed service.
See the non-human identities in a real tenant, free.
Register free and run one full NHI Risk assessment on any Microsoft 365 tenant. Agentless, read-only, results the same day.
Free NHI Risk Score →Go deeper: The non-human identity explosion in Microsoft 365 → · How MSPs turn this into a service →
Sources
- 1 Entro Labs, NHI & Secrets Risk Report (H1 2025), reporting
- 2 CyberArk, 2025 State of Machine Identity Security, report (PDF)
- 3 Grand View Research, Non-Human Identity Access Management Market, market report
- 4 Gartner, “Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure” (May 2026), source
- 5 Canalys (now part of Omdia), “MSP Trends & Predictions 2025”, source
- 6 Cloud Security Alliance, non-human identity security research, CSA
Sabiki Security is not affiliated with, sponsored by, or endorsed by these organisations; their research is cited as third-party industry context. Analyst/vendor names and quotations are subject to each provider's usage terms, confirm permitted use before public launch.