Onboarding Document Reader
ATC-MID-0006140 · Microsoft Entra ID
38
low risk
Ownership
Why it exists, and who answers for it
- Purpose
- Reads onboarding policy documents for the HR assistant.
- Business owner
- Chidi Okonkwo · People Operations
- Technical owner
- Unassigned
- Type
- Application identity — A registered piece of software.
- Environment
- staging
- Last authenticated
- 2 days ago
The chain
From a person to a resource
Every link is a place a question stops being answerable if nobody recorded it.
- Human ownerChidi Okonkwo · People Operations
- AI agentHR Onboarding Assistant
- Machine identityOnboarding Document Reader
- CredentialX.509 certificate
- ResourcesMicrosoft Graph · Files, Microsoft Graph · Mail
Risk
Why the score is 38
- +14
Credential
Certificate expires in 12 days; the assistant stops working when it does
- +10
Ownership
No technical owner to rotate it
- +8
Privilege
Mailbox read granted through a group and never used
- +6
Data
Employee records, including personal data
- 38Total
Credentials
What it authenticates with
- X.509 certificatemedium-livedBearer secret
Microsoft Graph · Files.Read.All
- Last rotated
- 353 days ago
- Last used
- 2 days ago
- Expires
- in 12 days
Effective access
What it can do, against what it has done
Effective permissions, not assigned roles — a role, a group and a resource policy combine into reach that no single screen in the source system shows. 8 of 11 granted actions were not used in the last 90 days.
- Microsoft Graph · FilesRead
held via Direct role
5 actions granted, 3 used. 2 could be removed on the evidence.
- Microsoft Graph · MailRead
held via Group membership
6 actions granted, 0 used. None of this has ever been exercised.
Blast radius
What a compromise of this credential reaches
1 agent stops working the moment this identity is quarantined — which is exactly what an operator needs to know before doing it.