Govern the identities nobody owns.
Service accounts, app registrations, managed identities and API keys now outnumber people. Give each one an owner, an explainable risk rating, live policy checks and a certification cycle.
| Identity | Type | Owner | Risk |
|---|---|---|---|
| svc-backup-prod | Service principal | Unassigned | Critical |
| app-hr-sync | App registration | HR Systems | Medium |
| mi-func-billing | Managed identity | Finance IT | Low |
| admin-shared-01 | Generic admin | IT Ops | High |
| svc-ci-deploy | Service principal | Platform | Medium |
Illustration with sample data
What NHI & NHA Governance does
NHI & NHA Governance keeps a register of non-human identities and accounts. They are discovered from Microsoft Entra ID and enriched by Azure, received from user access reviews, or added manually. Each record captures business and technical owners, purpose, account type, technology, relationships to cloud resources and review status.
Risk is computed from named, weighted conditions covering ownership, credential status, privilege, dormancy and certification, with the reasoning recorded. Policy-as-Code results for each identity show live checks such as expiring secrets. Periodic reviews end in certification, certification with remediation, or unable to certify, and remediation tasks are created from the record. Secret values are never stored, only metadata.
Key capabilities
Automatic discovery
Service principals, app registrations and managed identities from Entra ID and Azure.
From access reviews
Service accounts found in a UAR are sent straight in.
Explainable risk scoring
Weighted conditions with reasoning captured.
Policy-as-Code results
Live rule results per identity, such as secret expiry.
Periodic certification
Certified, certified with remediation, or unable to certify.
Secrets never stored
Only metadata is kept, never credential values.
The business case.
Efficiency, multi-framework alignment, reduced complexity and streamlined processes: what NHI & NHA Governance changes for your programme.
Dormant & orphaned NHIs
Ownership and dormancy conditions surface the riskiest machine identities.
Service-account controls
Evidence that system and application accounts are managed and reviewed.
Less manual inventory work
Discovery replaces spreadsheets of service accounts.
Review → certify → remediate
One record carries the full lifecycle.
Efficiency figures compare the effort of each workflow cycle in RiskVantis with the same work done manually or in a traditional GRC tool. Your result depends on your starting point; we will model it with you in a demo.
From setup to outcome.
Discover
Connect Entra ID and Azure, or receive accounts from a UAR.
Assign owners
Business and technical ownership for each identity.
Assess risk
Weighted conditions and policy checks produce an explainable rating.
Certify
Periodic reviews and remediation tasks.
Supports your obligations.
NHI & NHA Governance contributes evidence and coverage to these frameworks and regulations.
Common questions.
Which identities are discovered automatically?
Service principals, app registrations and managed identities from Microsoft Entra ID, enriched with Azure role assignments and resource associations.
Does RiskVantis store secrets?
No. Only metadata is stored; credential and secret values are never kept.
How is risk calculated?
From named, weighted conditions covering ownership, credential status, privilege, dormancy and review status, with the reasoning recorded.
Works better together.
User Access Review
Reconcile HR people records against every system's access exports with a deterministic, rule-based analysis. It surfaces leavers with access, dormant users and generic…
Learn more →Control Assurance & Security ReviewsAI Agent Management
AI agents act with real credentials, real tools and real data. AI Agent Management gives each one an owner, a traceable chain from model to certification and an ISO/IEC…
Learn more →Compliance ManagementPolicy-as-Code & Continuous Monitoring
Run automated technical rules against the data RiskVantis already collects from Microsoft Entra ID, Microsoft 365, your assets and privacy records. Start from a rule…
Learn more →See NHI & NHA Governance in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.