Honeyuser.

A fake identity provisioned in directory services and HR systems so that any login attempt or enumeration immediately reveals an attacker. It belongs to the Defense & Operations category of cybersecurity.

A fake identity provisioned in directory services and HR systems so that any login attempt or enumeration immediately reveals an attacker.

A honeyuser is a decoy person — typically a plausible employee profile with an Active Directory or Entra ID account, an HR record, and sometimes an email mailbox — used to detect attacker reconnaissance and credential abuse. Because the persona is fictitious, no legitimate process or human should ever authenticate as that user, list their group memberships, or send them mail. Honeyusers are particularly valuable against credential dumping, Kerberoasting, AS-REP roasting, and password-spraying campaigns. They are common in ITDR products such as Microsoft Defender for Identity, CrowdStrike Falcon Identity, and standalone deception platforms.

Defences for Honeyuser typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Decoy account, Honey identity.