> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/unified-human-identities.md). # Unified Human Identities #### Overview The Unified Human Identities (UHI) feature addresses identity fragmentation by automatically correlating disparate digital accounts into a single virtual asset. Modern enterprise environments manage identity across on-premises directories, cloud Identity Providers (IdPs), SaaS applications, and cloud platforms. Within these systems, individuals often accumulate multiple digital accounts, creating a visibility gap where risk is analyzed at the account level rather than the human level. UHI functions as a central source of truth to provide a view of an individual's total effective access and security posture across the enterprise. ![UHI\_infographic\_6.png](/files/tO0OVS6X2HmFMDvt7yzI) **Product availability** The UHI feature is available for customers using the following products: * Cortex Cloud Identity Security * Cortex ITDR * Cortex SaaS Security **Implementation and correlation** Cortex Cloud Identity Security creates and maintains Unified Human Identity assets automatically when a human identity is detected within the Cortex Data Lake. * **Correlation method:** Cortex Cloud Identity Security uses the user email as the primary identifier to link accounts. * **Asset model:** A Unified Human Identity serves as an umbrella container for every environment-specific identity belonging to a single person. * **Supported sources:** Correlation includes data from the following environments: * On-premises * Identity providers (IdPs) * Cloud platforms * SaaS applications #### Human Identities Inventory The Human Identities inventory provides a centralized location to audit and manage the individuals in your organization. **Inventory filter tabs** The inventory view is organized into four primary tabs to filter the unified asset list: * **All Identities**: Displays every correlated human identity across all environments. * **Cloud Identities**: Filters for identities with accounts in cloud service providers (AWS, Azure, GCP, and OCI). * **SaaS Identities** Filters for identities with accounts in SaaS applications. * **On-premises Identities** Filters for identities originating from local directory sources, such as Active Directory. **Inventory summary data** The top of the inventory provides a real-time summary of identity health: * **Risk Breakdown:** A summary showing the total number of individuals with associated risks, categorized by high and low severity. * **Administrative Status:** A count of individuals who hold administrative privileges across any connected system. * **Activity Tracking:** An overview of inactive identities who have not accessed their accounts within a specified timeframe. #### Individual Identity Details Panel You can click an individual in the identity inventory list to open a detailed profile panel that consolidates information typically scattered across multiple consoles. * **Identity metadata:** Displays the individual’s title, department, and employment type. * **Providers:** Lists the source systems (such as Okta, AD, or specific cloud platforms) contributing identity data to the Unified Human Identity. * **Identity insights:** Behavioral and posture-based analytics highlighting specific security risks or anomalies associated with the person’s combined footprint. * **Correlated accounts:** Lists every specific account, including cloud roles, directory profiles, and SaaS logins, that has been correlated to a specific Unified Human Identity. #### Operational Use Cases * **Detection of Privilege Creep:** Identifies individuals who have accumulated excessive permissions across unrelated platforms, and who may be invisible when viewing accounts in isolation. * **Incident Investigation:** Responders can search by name or email to view all associated system access, reducing the manual effort required to cross-reference logs from different providers. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/unified-human-identities.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.