What does the "Last Accessed" date mean for an NHI?

What does the "Last Accessed" date on an NHI actually mean?

It reflects whatever the connected source system reports as its most recent successful authentication event — Ploy doesn't generate this timestamp itself, it reads it from the integration.

Does it include non-interactive logins (background service calls), or only interactive ones?

It depends on the source system:

• Most integrations (Auth0, Google Workspace, Okta, Airtable, Freshservice, etc.) don't distinguish — they expose a single "last login" or "last activity" field that covers both.

• Azure/Microsoft service principals — Ploy pulls from Azure's sign-in audit logs, which technically include both. In practice, non-interactive background calls can be underrepresented because of how Azure surfaces them, so the date may skew toward delegated/interactive use.

• API keys (e.g. OpenAI) — purely usage-based; any authenticated API call, interactive or not, will update it.

Is it real-time?

No. It refreshes on Ploy's scheduled scan cycle for that integration — typically daily, though some integrations run more frequently.

Why is it blank?

Either no auth event has ever been recorded in the source system, or the scanner hasn't run yet since the NHI was added.

Is the top-level "Last Accessed" the same as what's on individual credentials?

Not necessarily. Individual credentials (certificates, secrets, tokens) can each carry their own last-used timestamp if the source system tracks at that level — and that can sometimes be more granular than the top-level NHI date.

Bottom line

Treat "Last Accessed" as a useful signal, but understand it's only as precise as what the upstream source system exposes — and for Azure specifically, take the date with a small grain of salt if you're trying to catch purely background service activity.

For more on how "Last Accessed" appears in access reviews, see How Review Cycles Work.