Local host account

Some tools run locally on a host – a desktop application, a command-line tool, or a service on a workstation or server – and have no login of their own. The user reaches them simply by being signed in to the machine. On ResorsIT that local operating-system account is not unmanaged: it is an IGAP-governed identity, so a tool that trusts the logged-in user is still governed centrally.

For this catalogue we assume every workstation is under IGAP management. On that basis, the host account is provisioned, updated, and disabled by the platform like any other identity – and any local tool that keys off it inherits that governance for free.

How ResorsIT integrates it

• The host’s OS user account is a platform-governed identity, not a standalone local account the user sets up alone
• The account is created and de-provisioned with the person (see provisioned account), commonly through the on-host agent for machines the platform cannot reach directly
• Deactivating the user disables the host login, and with it every local tool that relies on being signed in to that machine
• The tool itself needs no identity feature – it trusts the OS session

When a tool uses this

Local host access fits tools installed on a managed machine that authenticate against the logged-in OS user rather than their own login: desktop apps, CLIs, local development tools, and single-user local services. These tools are typically a Deployment Payload by usage; this page describes how the person actually reaches them.

Where the host is Windows or AD-joined, the host login is the Windows identity (see non-SSO identities). Access to a host over a shell is key-based rather than an interactive OS login.