Directory identity
Which accounts are still enabled?
Start with the accounts reported by your connected identity provider. Account status and available sign-in information help you decide which identities need a closer look.
Platform / Identity Authority
Identity & access context
Review the access your providers report.
Bring account status, MFA registration, privileged roles, and application access into one review. Identify accounts that need attention and understand the evidence behind the concern.
Available evidence depends on your connected providers and the permissions you grant.
The access picture
Identity
Account & provider
Authentication
MFA & account state
Access
Groups & privileged roles
Applications
Apps & OAuth consent
Provider recordReported stateLast observation
Four questions for an access review
An account list does not explain the access behind it.
Identity Authority brings together the account, its authentication posture, and the surrounding access context so your team can decide what needs investigation.
Use it when reviewing privileged access, checking authentication gaps, or preparing evidence for an audit.
Authentication
Where does MFA need attention?
Distinguish registered, not registered, and unknown MFA states. Focus your review on enabled accounts without an observed registration, while keeping missing data separate from a confirmed gap.
Privilege & membership
Who holds elevated access?
Review reported privileged role assignments in the context of the identity and provider. Group and role context helps explain access beyond an account's name or job title.
Applications & consent
How far does application access extend?
Application and OAuth-grant summaries show another part of the access picture. Use that context to scope a review of what connected applications have been allowed to do.
An access review in practice
A role assignment changes the question.
An enabled account without MFA registration deserves review. If it also holds a privileged role, that access gives the authentication gap more context.
This is a reason to investigate—not proof that the account is compromised, and not permission to disable it automatically.
- Account
- Enabled
- Role assignment
- Privileged access reported
- MFA registration
- Not registered
Next questionDoes this role still need that access, and what authentication does your policy require?
Read the evidence correctly
Unknown is not the same as protected.
A missing permission or unavailable observation leaves a question unanswered. Keep that separate from a provider explicitly reporting that MFA is not registered.
Check the provider and last synchronization time before relying on a result. A timestamp tells you when the evidence was collected; it does not guarantee the account has stayed unchanged.
Example · MFA registration
- Registered
- The provider reports registration for the account.
- Not registered
- The provider explicitly reports no registration.
- Unknown
- The required observation is missing or unavailable.
Registration is one piece of authentication evidence. It does not establish that every sign-in was protected.
From access context to a decision
Review the identity. Check the context. Decide the next step.
Add the device information.
When an identity provider links a user to managed devices, VitalSec shows that device information next to the account so your team can see whether the device is managed and what condition it reported.
Keep changes authorized.
Seeing an account or role does not give VitalSec permission to change it. Disabling an account, changing a role, or removing access requires a connected provider that supports the change and customer approval.
Bring the evidence to the review.
Use the account and access information alongside ShadowAI findings, control tests, and Evidence Continuity records. Keep the source, collection time, and unanswered questions with the decision.
What do you need to know about access?
Start with your identity providers, the accounts you need to review, and the questions your team needs to answer.