Entra ID · Non-human identity labs
Entra NHI labs for the identities nobody signs in as.
Non-human identities outnumber humans in most Entra ID (Azure AD) tenants. Service principals, app registrations, managed identities, and now Entra Agent IDs pile up with missing owners, over-privileged Microsoft Graph permissions, and unclear blast radius.
Instant digital download on Gumroad. Demo mode runs with no tenant.
// the problem
Where identity drift hides
servicePrincipalService principalsMissing owners and over-privileged Microsoft Graph permissions.applicationApp registrationsApp vs service-principal ownership to untangle.managedIdentityManaged identitiesWorkload identities with unclear blast radius.agentIdentityEntra Agent IDsBlueprints and agent identities: the newest objects to pile up.
// the kit
Entra NHI Discovery Lab Kit
This hands-on Entra ID lab kit gives you a working .NET collector that inventories every non-human identity through Microsoft Graph, resolves ownership, risk-scores high-privilege permissions and stale credentials, and exports the findings to CSV and SQLite.
It's a practitioner lab, not enterprise inventory software: a demo mode that needs no tenant, a read-only live path with a least-privilege consent guide, and a scoring playbook for portfolio work or identity interview prep.
How it works
- Run demo mode. No tenant, no consent. See collect, normalize, score, store, and report end to end.
- Optional: connect a lab tenant. Follow the guide for read-only application permissions (
Application.Read.All,Directory.Read.All,AgentIdentityBlueprint.Read.All,AgentIdentity.Read.All) and admin consent. - Read the scoring playbook. Map NoOwner, tiered high-privilege permissions, and credential findings to plain-language risk.
- Reuse the narrative to build a portfolio piece or prep for identity interviews in your own lab.
What you get
- Runnable .NET collector for Entra service principals, app registrations, managed identities, and Agent ID objects (blueprints and agent identities)
- Ownership resolution (owned, none, unknown, inherited) and tiered risk scoring for high-privilege permissions and stale credentials
- SQLite run history with per-tenant orphan trends, plus a CSV of findings
- Demo mode with fake data (no tenant needed)
- Test-tenant setup and admin-consent guide with a least-privilege permission table
- Scoring playbook: what each finding means and how to talk about it
- Regression test suite built from a test-tenant fixture
- Architecture notes, talking points, and tough questions with answers
Requirements: .NET 10 SDK. Comfortable with Entra basics and running a .NET project.
// fit check
Who it's for
Built for
- IAM and identity engineers who want a hands-on Entra NHI lab they can finish in an evening
- Identity practitioners, consultants included, who want hands-on NHI practice in their own lab
- Practitioners preparing for senior IAM or identity-risk interviews
- Anyone who wants the judgment packaged, not another unguided Graph script
Not for
- Teams shopping for an enterprise NHI platform
- Anyone who needs multi-cloud production inventory on day one
- Buyers who want a supported product with an SLA
// get the kit
Get the Entra NHI Discovery Lab Kit
$79 one-time · instant download
Get it on GumroadIncludes: source code, README walkthrough, demo output, consent guide, scoring playbook, tests.
Does not include: video course, support SLA, production deployment help, or AWS/GCP/Okta collectors.
Prototype / learning only. This is a study and interview lab kit. It is read-only by design, Entra-scoped, tested against one small test tenant, and provided as is with no warranty. Use it in lab tenants you control. You are responsible for Graph permissions and tenant policy.
// faq
FAQ
Why buy this instead of asking AI to build one?
AI is good at scaffolding Graph calls. It is unreliable at the parts that waste evenings: app vs service-principal ownership, Agent ID object shapes, admin-consent traps, and a scoring model you can defend. This kit is a path already debugged, plus a demo narrative and playbook.
Is this enterprise NHI software?
No. It is a practitioner lab kit for learning, personal lab demos, and interview prep.
Do I need admin consent?
Not for demo mode. Live mode needs read-only application permissions and admin consent; the guide covers it. Use a lab tenant you control.
Does it cover AWS, GCP, or Okta?
v1 is Entra + Agent ID only, by design. The architecture shows a multi-collector shape and a stub for a future collector; live multi-cloud is not a v1 promise.
What skill level do I need?
Comfortable with Entra basics and running a .NET project. You don't need to be a Graph expert; the walkthrough covers the sharp edges.
What is your refund policy?
Instant digital download: no refunds after the files have been downloaded or accessed. If delivery fails or the zip is corrupt, email hello@identitydriftlabs.com within 7 days with your order receipt for a replacement or refund.
Will this get me hired or pass an audit?
It strengthens lab and interview credibility around NHI discovery and Agent ID. It is not a certification, not an audit tool, and not a guarantee of any outcome.
Follow the lab
Updates on the kit, Entra non-human identity, and Agent IDs.