Service Accounts Disguised as Users

The question it answers: Which user accounts behave like service accounts - script-only sign-ins, old passwords, no MFA?

Scanners, sync tools and old integrations often run as ordinary user accounts: a password that never changes, excluded from MFA, signing in only from scripts. They are prime targets for password spray and never show up in the service principal reports. Accounts that sign in only non-interactively and have no MFA protection are listed first.

Note

A row needs a service-style name or non-interactive-only sign-ins, plus at least one more signal. Replace such accounts with a managed identity or service principal, or put them behind a Conditional Access policy for workload locations.

At a glance

Where in the app	Entra ID › Identity Hygiene › Disguised Service Accounts
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 (sign-in activity).
Report id (API and MCP)	entra.security.disguised-service-accounts

Columns

Column	Key	Type
Account	DisplayName	Link
Score	Score	Status
Signals	Signals	Text
Last interactive	LastInteractive	Date
Last non-interactive	LastNonInteractive	Date
Password age (days)	PasswordAgeDays	Text
Licensed	Licensed	YesNo
UPN	UserPrincipalName	Text

What it needs

Licence: Microsoft Entra ID P1 (sign-in activity).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
User.Read.All	Microsoft Graph	Read all users’ full profiles
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information
AuditLog.Read.All	Microsoft Graph	Read all audit log data
UserAuthenticationMethod.Read.All	Microsoft Graph	Read all users’ authentication methods
Policy.Read.All	Microsoft Graph	Read your organization’s policies

Data sources it reads

• GET /v1.0/users (passwordPolicies, lastPasswordChangeDateTime)
• GET /v1.0/users?$select=signInActivity
• GET /v1.0/reports/authenticationMethods/userRegistrationDetails
• GET /v1.0/identity/conditionalAccess/policies

Through the API and MCP

GET /ir-api/v1/reports/entra.security.disguised-service-accounts?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.security.disguised-service-accounts. The client needs the Read grant for Entra ID. See Using the API.