Unmanaged identities are accounts or machine principals that do not have clear ownership, lifecycle control, or active monitoring. They often include service accounts, workload identities, API tokens, and automation credentials that were created for a job but never fully inventoried, rotated, or retired.
They matter because attackers often target the easiest path to access: stale credentials, over-privileged service accounts, and forgotten tokens. If no one owns the identity, it may keep working long after the original workload changed, making detection and revocation difficult. In defense, organizations reduce this risk by assigning owners, tracking where each identity is used, limiting privileges, rotating secrets, and watching runtime behavior for unusual API calls, new resource access, or activity outside expected schedules.