The inventory builds itself
Entries come from directory security, cloud configuration, Entra roles, the agent hardening check and the platform AI users and MCP tokens, reconciled daily.
Security Operations
Identity Governance
Every privileged and technical account with owner, purpose and expiry
Service accounts, secondary admin accounts, API keys, service principals, local administrators and by now AI users and MCP tokens: they appear everywhere and nobody keeps a common list. Identity governance builds exactly that list – not by hand, but from the scans that already run. Recertification, segregation of duties and access requests build on it. The module deliberately stores no credentials, only their metadata.
ISO 27001BSI IT-GrundschutzNIS2DORAKI-Verordnung
Features
Your benefits
Ownership stays manual – and is never overwritten
Who owns an account and what it is for is maintained by the organisation itself. The daily reconciliation never touches those fields.
Recertification across everything that grants rights
Accounts, AD groups, Entra roles, application roles, physical access rights, platform roles, business roles and AI agents – with a PDF closing report and revocation via ticket or immediate action.
Rights without a request stand out
The target-actual comparison surfaces permissions without a valid request – with a time view of what was granted without a request or change.
Capabilities
All capabilities at a glance
- One entry per account with type, source, owner, purpose, criticality, last sign-in, password or key age, expiry and vault status
- Rules and findings with four-eyes exceptions
- Break-glass accounts with test evidence and sign-in alerting via the SIEM
- Segregation of duties with templates and time-limited exceptions
- Entitlement catalogue and requests in the self-service portal with approval and end date
- Authorisation concepts per IT system with approval and versions
- Leaver and mover events from personnel data with a checklist as tickets or tasks
- Register of AI agents with approval and classification under the AI Act
- Vault reconciliation with CyberArk, BeyondTrust Password Safe or CSV – reads metadata only, never a password
Experience Identity Governance live
Schedule a no-obligation demo – we will show you the module with your own use cases.