Workload identities

What is a workload identity?

A workload identity is any app or service that authenticates programmatically to access organizational resources without a human user signing in. Unlike end-user apps, workload identities operate autonomously using credentials such as client secrets, certificates, or private keys.

ISPM recognizes the following workload identities:

Okta OIDC apps

Apps that are registered in Okta and authenticate programmatically using OpenID Connected. These apps use client secrets or private key JWT to prove their identity. No human sign-in is required.

Okta API service integrations

Machine-to-machine integrations that authenticate through the OAuth 2.0 client credentials flow to access Okta APIs directly.

Salesforce-connected apps

Unmanaged OAuth apps created directly within a Salesforce org.

Salesforce managed connected apps

Apps that are installed from the Salesforce AppExchange (third-party integrations). These are higher risk apps because they're externally controlled.

Enterprise applications

Apps that are registered in Microsoft Entra ID (formerly Azure AD). These are represented as service principals in the directory. Each app is granted delegated or app-level permissions to organizational resources. These apps often accumulate broad permissions over time and can become high risk if credentials aren't rotated or scopes aren't reviewed.

Why workload identity permissions matter

Workload identities are often granted broad permissions during initial setup and rarely reviewed afterward. Over time, this creates a hidden attack surface. A compromised or misconfigured workload identity can exploit its permissions to access sensitive data, modify directory objects, or in severe cases, perform a complete tenant takeover.

Common risk factors include the following:

• Client secrets that have never been rotated or have no expiry date
• Apps granted administrative scopes that exceed their operational need
• Orphaned apps whose owning team no longer maintains them

About the workload identities inventory

The ISPM workload identities inventory aggregates all workload identities across Okta, Salesforce, and Microsoft Entra ID into a single, searchable dashboard. For each identity, the inventory surfaces the following information:

• The authentication methods in use, such as client_secret_basic, client_secret_post, client_secret_jwt, or private_key_jwt
• The permissions and scopes granted to the app
• The secret rotation status, including expiration dates for client secrets and certificates

Benefits

Security practitioners

• Identify over-privileged apps that violate least-privilege principles
• Detect stale or never-rotated secrets that represent standing credential exposure
• Prioritize remediation based on the sensitivity of granted permissions
• Reduce the risk of tenant-level compromise from a single compromised credential

Identity and access management admins

• Maintain an accurate, up-to-date inventory without manual audits or spreadsheets
• Track secret expiry dates across Okta, Salesforce, and Microsoft Entra ID from one place
• Locate apps using weaker authentication methods and plan upgrades
• Support compliance and audit requirements with documented app permission records