Identity Risk Score๐
The Identity Risk Score is an indicator of the overall risk an identity represents, combining the likelihood it may be involved in a security incident with the potential impact if it were compromised. IDR evaluates behavioral signals, account configuration, and active findings to produce the score. Identities with elevated privileges, weak security posture, or open findings score higher, even when no suspicious activity has been observed.
This gives security teams two powerful capabilities in a single number:
- Threat investigation: The Risk Score on an affected identity tells you immediately whether you are dealing with a high-value target. For example, an 8.5 score on a privileged admin account warrants a different response than a 1.2 on a standard user account.
- Security posture assessment: Identities with high scores and no active findings represent latent exposure. They haven't been compromised yet, but are configured in ways that make them attractive targets. Addressing these proactively reduces your attack surface before an incident occurs.
Note
Risk Scores are currently available for user identities sourced from Entra ID and on-premises Active Directory.
Score Bands๐
| Band | Score Range | Meaning |
|---|---|---|
| Critical | 8.0โ10 | High-confidence risk signal. Likely has open findings and multiple amplifying attributes. Investigate immediately. |
| High | 6.0โ7.9 | Meaningful risk elevation. One or more significant findings or a combination of risky attributes. Review within your normal triage cycle. |
| Medium | 4.0โ5.9 | Moderate risk. May have open findings at lower severity, or attribute-only risk without active findings. |
| Low | 2.0โ3.9 | Some risk signals present but no significant active findings. Monitor for changes. |
| Informational | 0โ1.9 | Baseline risk. No open findings and attributes consistent with low-exposure behavior. |
How the Score Is Calculated๐
IDR calculates a Risk Score for each identity and keeps it current as your environment changes. Scores update on a daily cycle and are also recalculated automatically when findings are opened or closed, or when account modifications are detected. The score reflects a combination of identity attributes and active findings: the more risk signals present, the higher the score.
What Raises the Score๐
- Open findings, particularly at critical or high severity
- No MFA configured on the identity
- Admin or privileged directory roles
- Guest account status
- Authentication activity from high-risk geographic locations
- Broad email footprint
- Historical alert and investigation activity associated with the identity
What Lowers the Score๐
- MFA configured and enforced
- Clean alert and investigation history
- Findings resolved or dismissed
- Removal of unnecessary admin roles
Important
Resolved findings continue to contribute at a reduced weight until the next daily scoring cycle. The full benefit appears in the score calculated the following day.
Score Examples๐
| Identity Scenario | Base Score | Finding | Approximate Adjusted Score |
|---|---|---|---|
| Low-baseline identity | 2.5 | One critical open finding | 5.5 |
| Low-baseline identity | 2.5 | One high open finding | 4.0 |
| High-baseline identity | 7.0 | One high open finding | 7.6 |
Where the Risk Score Appears๐
You can see the Risk Score in the following places.
Identities Table๐
The Risk Score column in the Identities table of the Directory shows the current score for each identity. The card view also shows the score at the top right of each card.
Tip
Sort the Identities table by the Risk Score column in descending order to show your highest-risk identities at the top.
Identity Details๐
Select an identity from the Identities table to open its details. The Summary tab includes the following:
- Current Score: The most recent daily score and its band
- Contributing Factors: The attributes and findings affecting the score
Tip
Use the contributing factors to understand exactly what is driving an elevated score before taking remediation action.
Detection Details๐
The Risk Score shows in the Affected Entities section of detection details. Click the score or Fingerprint icon to see further details about the identity and its score.
Top Risky Users Widget๐
The Top Risky Users widget shows the identities that combine a high score with open findings: the highest-priority group for daily triage. Each entry shows the identity name, open finding counts by severity, and the current score.
Improving an Identity's Score๐
The following actions have the highest impact on the next scoring cycle:
| Action | Expected Effect |
|---|---|
| Resolve open critical or high findings | Significantly reduces score because this removes the largest contribution |
| Enforce MFA on the identity | Reduces the credential exposure contribution |
| Remove unnecessary admin roles | Reduces role-based contribution in the base score |
| Convert guest accounts to managed accounts | Removes the guest-status contribution |
| Dismiss false-positive findings | Excluded entirely from the calculation |
Frequently Asked Questions๐
Why does a low-risk identity suddenly show a high or critical score?
The most common cause is a new open critical- or high-severity finding. Active findings push the score into the appropriate band even when the identity has a clean history. Open the identity's details and review the contributing factors in the Risk Score section to confirm which findings triggered the change.
Does resolving a finding immediately lower the score?
Scores recalculate automatically when a finding is resolved, so you should see an updated score shortly after resolution. However, resolved findings continue to contribute at a reduced weight until the next daily scoring cycle. The full reduction shows in the score calculated the following day.
Why do two identities with the same job role have different scores?
Scores reflect the combination of all attributes, not role alone. Two identities with identical titles may differ in MFA status, geographic access patterns, guest status, open findings, or historical activity. Review the contributing factors in the Risk Score section for each identity to see what is contributing to the difference.
Which identity types have scores?
Scores are currently calculated for user identities sourced from Entra ID and on-premises Active Directory. Service principal and application identity scoring is planned for a future release.
Why do most identities show an informational score for a new tenant or newly onboarded user?
Scores improve as the system accumulates alert data and builds a behavioral profile for each identity. For new tenants or recently added users, scores may remain informational for up to 30 days while this baseline is established. When sufficient data is collected, scores will begin to reflect the full range of risk signals. Identities with open findings will score higher regardless of how recently they were onboarded.
How do I prioritize which critical-risk identities to investigate first?
Sort the Identities table by Risk Score descending. Review the contributing factors in the Risk Score section for your top identities and prioritize those with open critical and high findings. These represent the most actionable starting points and the fastest path to score reduction.