Identity Risk Score๐
The Identity Risk Score is an indicator of the overall risk an identity represents, combining the likelihood it may be involved in a security incident with the potential impact if it were compromised. The score is calculated by a patent-pending machine learning model that evaluates behavioral signals, account configuration, and active findings to produce a single, continuously updated risk indicator for every identity in your environment. Identities with elevated privileges, weak security posture, or open findings score higher, even when no suspicious activity has been observed.
In short
Every identity gets a score from 0โ10. The higher the number, the more attention that identity needs. The score rises when things like missing MFA or open security findings are present, and falls when good security practices are in place. Some of what drives the score you can change yourself (like turning on MFA); some of it just describes the person and can't be changed (like their department or job title) โ see What Raises the Score below for the full breakdown.
Powered by a patent-pending ML model
The Identity Risk Score is generated by IDR's patent-pending machine learning model. Rather than relying on static rules, the model learns from behavioral and configuration signals across your environment to produce a score that reflects each identity's actual risk profile.
This gives security teams two powerful capabilities in a single number:
- Threat investigation: The Risk Score on an affected identity tells you immediately whether you are dealing with a high-value target. For example, an 8.5 score on a privileged admin account warrants a different response than a 1.2 on a standard user account.
- Security posture assessment: Identities with high scores and no active findings represent risk that hasn't turned into an incident yet. They haven't been compromised, but they're configured in ways that make them attractive targets. Addressing these proactively reduces your attack surface before an incident occurs.
Note
Risk Scores are currently available for Active user identities sourced from Entra ID and on-premises Active Directory. Identities marked Deleted or Disabled in your Identity Provider don't receive a Risk Score.
Score Bands๐
| Band | Score Range | Meaning |
|---|---|---|
| Critical | 8.0โ10 | High-confidence risk signal. Likely has open findings and multiple amplifying attributes. Investigate immediately. |
| High | 6.0โ7.9 | Meaningful risk elevation. One or more significant findings or a combination of risky attributes. Review within your normal triage cycle. |
| Medium | 4.0โ5.9 | Moderate risk. May have a lower-severity open finding, or a combination of risky factors even without one. |
| Low | 2.0โ3.9 | Some risk signals present but no significant open findings. Monitor for changes. |
| Informational | 0โ1.9 | Baseline risk. No open findings, and the identity's factors don't currently raise concern. |
How the Score Is Calculated๐
IDR calculates a Risk Score for each identity and keeps it current as your environment changes. Scores update on a daily cycle and are also recalculated automatically when findings are opened or closed, or when account modifications are detected. The score reflects a combination of identity attributes and active findings: the more risk signals present, the higher the score.
Contributing factors fall into two categories, shown separately wherever factors appear in the UI:
- Security Factors โ attributes tied to account configuration and security posture that you can directly influence, such as MFA status, admin roles, and open findings.
- Profile Factors โ attributes about the identity that are not easily controlled, such as department, job title, or the city an identity signs in from. A user based in a higher-risk city, for example, shows a Profile Factor raising their score regardless of their security configuration.
Because Profile Factors are largely outside a customer's control, prioritize remediation on Security Factors first โ see Improving an Identity's Score.
What Raises the Score๐
Security Factors:
- No MFA configured on the identity
- MFA configured without a passwordless method (when MFA is otherwise enabled)
- Open findings, particularly at critical or high severity โ labeled Identity Exposures in the Contributing Factors panel
- Admin or privileged directory roles
- Guest account status
- Active credential leaks (compromised credentials)
- Hybrid account (synced from an on-premises directory)
- Broad email footprint (more linked email addresses)
- Historical alert and investigation activity associated with the identity
Profile Factors:
- Department is a higher-risk group
- Job title is a higher-risk group
- City is a higher-risk location
- Employee type is a higher-risk group
- No manager on file
- Identity is configured for VIP monitoring โ shown as "High-value identity, prioritize monitoring" in the Contributing Factors panel
What Lowers the Score๐
Security Factors:
- MFA configured and enforced
- Passwordless MFA configured
- Clean alert and investigation history
- Findings resolved or dismissed
- Removal of unnecessary admin roles
- Fewer linked email addresses
Profile Factors:
- Department is a lower-risk group
- Job title is a lower-risk group
- City is a lower-risk location
- Employee type is a lower-risk group
- Manager on file
Note
Active credential leaks, hybrid account status, and VIP monitoring only ever raise a score โ there's no corresponding "lowers the score" state for these factors.
Important
Resolved findings continue to contribute at a reduced weight until the next daily scoring cycle. The full benefit appears in the score calculated the following day.
Where the Risk Score Appears๐
You can see the Risk Score in the following places.
Identities Table๐
The Risk Score column in the Identities table of the Directory shows the current score for each identity. The card view also shows the score at the top right of each card.
Tip
Sort the Identities table by the Risk Score column in descending order to show your highest-risk identities at the top.
Identity Details๐
Select an identity from the Identities table to open its details. The Summary tab includes the following:
- Current Score: The most recent daily score and its band
- Contributing Factors: The attributes and findings affecting the score, grouped into Security Factors and Profile Factors
The panel is split into two columns โ Factors raising Risk Score and Factors lowering Risk Score โ each broken down into Security Factors and Profile Factors. Select the info icon next to Profile Factors for an in-product reminder of what that category means.
Note
If an identity has no factors in a given category (for example, nothing currently lowering a Security Factor), that section shows No data instead of an empty list. The timestamp at the bottom of the panel ("Evaluated as of...") shows when these factors were last calculated.
Tip
Use the contributing factors to understand exactly what is driving an elevated score before taking remediation action.
Detection Details๐
The Risk Score shows in the Affected Entities section of detection details. Click the score or Fingerprint icon to see further details about the identity and its score.
Top 5 Risky Users Widget๐
The Top 5 Risky Users widget shows the identities that combine a high score with open findings: the highest-priority group for daily triage. Each entry shows the identity name, open finding counts by severity, and the current score.
Improving an Identity's Score๐
The following actions have the highest impact on the next scoring cycle:
| Action | Expected Effect |
|---|---|
| Resolve open critical or high findings | Significantly reduces score because this removes the largest contribution |
| Enforce MFA on the identity | Reduces the credential exposure contribution |
| Enable a passwordless MFA method | Further reduces the MFA-related contribution beyond standard MFA |
| Resolve active credential leaks | Removes the compromised-credential contribution |
| Remove unnecessary admin roles | Reduces role-based contribution in the base score |
| Convert guest accounts to managed accounts | Removes the guest-status contribution |
| Consolidate or remove unused linked email addresses | Reduces the email-footprint contribution |
| Dismiss false-positive findings | Excluded entirely from the calculation |
Note
These actions all target Security Factors. Profile Factors (department, job title, city, employee type, manager status, VIP monitoring) are attributes of the identity rather than configuration, so there's no direct action to change them โ focus remediation on the Security Factors above. Hybrid account status is also not directly actionable โ it reflects your directory sync architecture rather than a per-identity setting. Historical alert and investigation activity likewise has no single action to take โ it's a record of past detections rather than a setting, and naturally improves over time as new alerts are avoided.
Frequently Asked Questions๐
Why does a low-risk identity suddenly show a high or critical score?
The most common cause is a new open critical- or high-severity finding. Active findings push the score into the appropriate band even when the identity has a clean history. Open the identity's details and review the contributing factors in the Risk Score section to confirm which findings triggered the change.
Does resolving a finding immediately lower the score?
Scores recalculate automatically when a finding is resolved, so you should see an updated score shortly after resolution. However, resolved findings continue to contribute at a reduced weight until the next daily scoring cycle. The full reduction shows in the score calculated the following day.
Why did an identity's score change even though nothing in my directory changed?
Scores recalculate on a daily cycle even without a configuration change, because the underlying machine learning model also incorporates behavioral signals such as alert and investigation activity. An identity's score can shift day to day as this activity accumulates or ages out, independent of any edits to the identity's attributes.
Are all factors weighted equally?
No. The Risk Score is generated by a patent-pending machine learning model, not a simple additive checklist. The model learns how strongly each factor actually correlates with risk and weighs contributions accordingly, so two identities with the same set of factors present won't necessarily move the score by the same amount. The Contributing Factors shown on an identity's details reflect what mattered most for that specific score.
Does the machine learning model use my organization's data to train models used by other customers?
The model is trained on aggregated behavioral and account signals across the IDR customer base to learn what typically correlates with risk. Scoring for your identities is calculated using your own tenant's current data.
If a field like Department, Employee Type, or Job Title is blank in my directory, does that raise or lower the score?
A blank field isn't automatically neutral. The model infers a value based on patterns learned from similar identities, so a missing Department, Employee Type, or Job Title can still raise or lower the score depending on what correlates with risk for comparable identities elsewhere in the model. Populating the field with accurate data gives the model a more precise signal to work from.
Why do two identities with the same job role have different scores?
Scores reflect the combination of all attributes, not role alone. Two identities with identical titles may differ in MFA status, city risk, guest status, open findings, or historical activity. Review the contributing factors in the Risk Score section for each identity to see what is contributing to the difference.
What's the difference between Security Factors and Profile Factors?
Security Factors are tied to account configuration and security posture โ things you can directly change, like enabling MFA, removing an unnecessary admin role, or resolving open findings. Profile Factors are attributes of the identity itself, such as department, job title, or city, that aren't easily controlled. Both can raise or lower a score, but remediation should focus on Security Factors since those are the ones you can act on. See What Raises the Score for the full breakdown.
Which identity types have scores?
Scores are currently calculated for user identities sourced from Entra ID and on-premises Active Directory. Service principal and application identity scoring is planned for a future release.
Why don't I see a Risk Score for a deleted or disabled user?
Risk Scores are only calculated for Active identities. If an identity is marked Deleted or Disabled in your Identity Provider, it won't have a Risk Score.
Why do most identities show an informational score for a new tenant or newly onboarded user?
Scores improve as the system accumulates alert data and builds a behavioral profile for each identity. For new tenants or recently added users, scores may remain informational for up to 30 days while this baseline is established. When sufficient data is collected, scores will begin to reflect the full range of risk signals. Identities with open findings will score higher regardless of how recently they were onboarded.
How do I prioritize which critical-risk identities to investigate first?
Sort the Identities table by Risk Score descending. Review the contributing factors in the Risk Score section for your top identities and prioritize those with open critical and high findings. These represent the most actionable starting points and the fastest path to score reduction.