title: Risk Scoring category: Intelligence tags: risk, scoring, analytics, security, anomaly priority: Normal

Risk Scoring

IdentityCenter assigns a risk score to every identity in your environment. Risk scores quantify the security exposure associated with each account, enabling you to prioritize remediation, target access reviews, and automate policy enforcement based on data-driven risk assessment.

Risk Score Range

Risk scores are calculated on a 0 to 100 scale:

The Four Risk Dimensions

The RiskScoringEngine (in the RiskEngine project) computes a composite score from four independent risk dimensions. Each dimension evaluates a different aspect of an identity's security posture.

1. Access Risk

Access Risk measures the level of privilege and breadth of permissions an identity holds.

Example: A user who is a member of Domain Admins with 142 group memberships scores significantly higher than a standard user with 8 group memberships.

2. Behavior Risk

Behavior Risk assesses how an identity's activity patterns compare to expected baselines.

Example: A user who typically logs in Monday-Friday 8AM-6PM but suddenly shows authentication at 3AM on a Saturday receives an elevated behavior risk score.

3. Compliance Risk

Compliance Risk evaluates an identity's standing against your organization's policies and audit requirements.

Example: An account with 3 open Critical violations and 2 overdue access reviews scores higher than one with a single Medium violation that was resolved promptly.

4. Anomaly Risk

Anomaly Risk uses statistical analysis and peer group comparison to identify outliers.

Example: A Marketing Manager with 45 group memberships when the average for Marketing Managers is 8 flags a high anomaly risk due to peer group deviation.

Composite Score Calculation

The RiskScoringEngine combines the four dimensions using a weighted formula:

The composite score is calculated as:

Composite Score = (Access Risk x 0.30) + (Behavior Risk x 0.25)
               + (Compliance Risk x 0.25) + (Anomaly Risk x 0.20)

Administrators can adjust these weights in the Intelligence settings to reflect organizational priorities. For example, a heavily regulated environment might increase Compliance Risk weight to 35%.

The UserRiskScore Model

Risk scores are persisted in the UserRiskScore model, which tracks scores over time:

Score history is retained, allowing you to visualize risk trends over time and identify whether an identity's risk is increasing, decreasing, or stable.

PeerGroupAnalyzer

The PeerGroupAnalyzer compares each identity's access patterns to their peers. Peers are determined by:

• Department -- Users in the same department
• Job Title -- Users with the same or similar job title
• Manager -- Users reporting to the same manager
• Location -- Users in the same office or site

The analyzer calculates a deviation score for each identity based on how much their access differs from the peer group median. Significant deviations (more than 1.5 standard deviations) are flagged as anomalies.

Peer Comparison Example

Identity: Jane Doe (Marketing Manager)
Peer Group: Marketing Managers (15 members)

                        Jane Doe    Peer Median    Deviation
Group Memberships:      45          8              +462%  [ANOMALY]
Application Access:     5           5              0%
Shared Drive Access:    12          6              +100%  [REVIEW]
Admin Rights:           0           0              0%

Recommendation: Review 37 excess group memberships

Using Risk Scores

In Access Reviews

Risk scores are displayed alongside each identity during access review campaigns. Reviewers can:

• Sort review items by risk score (highest first)
• Filter to show only High and Critical risk identities
• Use risk context to make informed approve/revoke decisions

In Policy Enforcement

Create policies that trigger based on risk thresholds:

• Require multi-factor authentication for identities with risk score >50
• Auto-flag accounts with risk score >75 for immediate review
• Restrict self-service operations for Critical-risk accounts

In the Directory Browser

When viewing objects in the Directory Browser, risk scores are displayed as color-coded badges:

• Green (0-25): Low risk
• Yellow (26-50): Medium risk
• Orange (51-75): High risk
• Red (76-100): Critical risk

In ChatHub

Use the /insights command to view risk scores and breakdowns:

/insights john.smith

Or ask in natural language:

What is the risk score for john.smith?
Show me all high-risk users
Who are the riskiest identities in my environment?

See ChatHub Slash Commands Reference for more query options.

In Workflow Triggers

Risk scores can trigger automated workflows:

• Notify the security team when any identity crosses the Critical threshold
• Initiate an access review when an identity's risk increases by more than 20 points
• Disable accounts automatically when risk score reaches 95+ (with appropriate approval workflow)

Tuning Risk Scores

Adjusting Dimension Weights

Navigate to Intelligence Settings to modify the default weights for each risk dimension. Consider your organization's priorities:

Reducing False Positives

If too many identities are flagged as High or Critical risk:

1. Review the peer group definitions -- ensure departments and titles are accurate in your directory
2. Adjust inactivity thresholds -- if your environment has seasonal users, extend the inactive period
3. Exclude known service accounts from behavioral analysis
4. Refine the anomaly detection sensitivity in Intelligence settings

Next Steps

• Contextual Insights -- AI-powered analysis of individual objects
• AI Intelligence Training -- Train the AI on your environment's patterns
• Intelligence Hub Overview -- Broader view of the analytics engine
• ChatHub Slash Commands Reference -- Query risk scores through chat
• Access Reviews Overview -- Use risk scores to prioritize reviews
• Security Hardening -- Protect your IdentityCenter deployment