Identity vs Account
A security identity is the analyst's decision object for who can act; an account record is the operational artifact in a directory or cloud IAM—related but not interchangeable.
Identity vs Account
What practitioners need to know
Practitioners ask: Isn't identity just the account in AD? Why do we need two concepts?
Analysts need identity as a security concept—the actor findings attach to, whose privilege and reach change decisions. Directories and cloud IAM store account records—rows with attributes, group memberships, and lifecycle states. The distinction prevents inventory thinking from replacing investigation scope.
Foundation: Understanding Security Identities (KID-CON-0090). Term: Identity (KID-GLS-0010).
Comparison
| Dimension | Security identity (decision lens) | Account record (operational artifact) |
|---|---|---|
| Purpose | Explain who or what could act | Store credentials and attributes in a source |
| Meaning | Comes from privilege, access, and context | Comes from fields and group memberships |
| Completeness | May span multiple records across systems | Often treated as authoritative in one system |
| Analyst use | Pivot investigations, scope blast radius | Input for enrichment—not the definition of scope |
| Unknown state | Explicit uncertainty in decisions | Often missing row or stale object |
| Shared actors | One logical actor, many records possible | Multiple rows without linkage |
Same pattern as Understanding Security Assets (KID-CON-0080): the entity for decisions is not the same as the record in a source system.
One identity, many account records
| Scenario | Identity view | Account record view |
|---|---|---|
| User with on-prem AD and cloud SSO | One person acting across environments | Two objects that may not auto-link |
| Service principal in Azure and AWS | One workload identity with multi-cloud reach | Separate IAM entries per cloud |
| Break-glass admin shared by team | High-risk shared actor | Single enabled account |
| Former employee with lingering app account | One human identity with orphaned access | Disabled in HR system, active in SaaS |
Analysts normalize records into a security identity—or document that normalization failed. Closing an investigation on "account disabled in AD" while a cloud shadow account remains active is a record-complete, identity-incomplete failure.
Account record thinking vs identity thinking
| Account record lens | Identity lens |
|---|---|
| Ticket: sync directory | Question: who can still authenticate? |
| Count of stale accounts | Scope: which actors reach crown jewels? |
| Group membership as static truth | Role and privilege as decision context |
| One system = one answer | Cross-source actor resolution required |
Common mistakes
| Mistake | Consequence |
|---|---|
| Equating IAM hygiene metrics with security outcomes | False maturity signals |
| Investigating only the account named in one log | Missed linked principals |
| Treating disabled directory account as full containment | Active sessions or cloud identities remain |
| Ignoring non-human identities | Service account abuse undetected |
| Assuming samAccountName equals actor everywhere | Wrong attribution across federated systems |
Practical implications
- Resolve actors across IdP, directory, cloud IAM, and application logs before scoping containment.
- Document when records cannot be linked to a single identity.
- Ask what the identity can reach, not only whether the account row looks clean.
- Continue to Identity Context (
KID-CON-0092) for privilege, role, access, and lifecycle dimensions.
Limitations
Account records are necessary inputs but rarely sufficient. Federation, shadow IT, API keys, and local application accounts produce gaps that analysts must state explicitly rather than infer from directory completeness.
Related knowledge
| KID | Resource |
|---|---|
| KID-CON-0090 | Understanding Security Identities |
| KID-GLS-0010 | Identity |
| KID-CON-0080 | Understanding Security Assets |
| KID-GLS-0003 | Security Context |
Authority references
KID-ARC-0001— Canonical Data Model
Why this matters for security decisions
Containment, escalation, and audit narratives depend on who could act, not which directory row was updated. Teams that stop at account records risk leaving active sessions, federated identities, and service principals in play while reporting IAM tasks complete. Identity thinking keeps decisions aligned with actual reach and blast radius.