Investigate a risky identity
This is the payoff of the get-started path: taking a high-risk identity and understanding why it's risky and what to do about it.
Find a candidate
- From the dashboard, filter identities by severity: high or critical.
- Sort by risk so the most pressing identities are at the top.
- Open the top identity to start the investigation.
Understand the risk
On the identity's detail view, review:
- Correlated accounts — every account Mesh matched to this identity across your connected systems. Look for orphaned, duplicate, or unexpected accounts.
- Entitlements — the access this identity holds. Watch for excessive or toxic combinations of privileges.
- Risk signals — the specific conditions the risk engines flagged, each with a severity and an explanation of the contributing factors.
Decide and act
- Confirm whether the flagged access is expected for this person's role.
- Note remediation steps (revoke access, disable a stale account, enforce stronger authentication) and route them through your normal access-management process.
- Re-check the identity after the next collection to confirm the signal clears.
You're up and running
You've connected an IdP, pulled in a source system, oriented yourself in the dashboard, and investigated a real risk. From here:
- Add more connectors from Connectors & Integrations.
- Deepen your configuration with the Admin Guide.
- Learn day-to-day workflows in the User Guide.