Identification

Three populations need identifiers: people, service accounts, and devices.

Objective [a] is every human user, [b] is processes acting on behalf of users, and [c] is devices. Your directory, the account system such as Active Directory or Microsoft Entra ID, covers [a] the day you stand it up. Objectives [b] and [c] are where the deliberate work lives.

A process acting on behalf of a user is a service account, not an application a person runs.

Word running under a signed-in user is that user's process and needs no identifier of its own. The backup job, the scanner uploading to a document library, and the integration service principal in Microsoft Entra ID are accounts that are not people but act like people. List each one with its purpose and owner, and [b] is met.

Ignore the operating system's built-in service identities.

SYSTEM, Local Service, Network Service, and TrustedInstaller are internal Windows machinery. If you document them at all, one line calling them native operating system accounts necessary for system function is enough.

Devices get identified by whatever your management stack already assigns.

Intune assigns each enrolled device its own device identifier. For equipment outside management, define the method in a procedure: MAC address, asset tag, or hostname convention. Objective [c] asks that a method exists and is applied, not that it be sophisticated.

Shared accounts survive this requirement only with traceability bolted on.

The assessment guide states that management of individual identifiers is not applicable to shared system accounts, but an account no one can trace to a person undermines everything downstream. Where a shared account is unavoidable, put its credential in a vault that logs who checked it out and rotates it after use.