An approach for user identity management in a virtualized/networked (e.g., cloud) computing environment is provided. In a typical embodiment, historical command usage within a server environment is analyzed to determine the characteristics of the commands being run against a cloud resource to determine with a confidence rating the likelihood the commands are being executed by a certain user. Such an approach allows for more efficient user identity management in order to optimize cloud security and system administration.