# Investigate a risky identity

This is the payoff of the get-started path: taking a high-risk identity and
understanding *why* it's risky and *what to do* about it.

## Find a candidate

1. From the dashboard, filter identities by **severity: high** or **critical**.
2. Sort by risk so the most pressing identities are at the top.
3. Open the top identity to start the investigation.

## Understand the risk

On the identity's detail view, review:

- **Correlated accounts** — every account Mesh matched to this identity across
  your connected systems. Look for orphaned, duplicate, or unexpected accounts.
- **Entitlements** — the access this identity holds. Watch for excessive or
  toxic combinations of privileges.
- **Risk signals** — the specific conditions the risk engines flagged, each with
  a severity and an explanation of the contributing factors.

## Decide and act

- Confirm whether the flagged access is expected for this person's role.
- Note remediation steps (revoke access, disable a stale account, enforce
  stronger authentication) and route them through your normal access-management
  process.
- Re-check the identity after the next collection to confirm the signal clears.

## You're up and running

You've connected an IdP, pulled in a source system, oriented yourself in the
dashboard, and investigated a real risk. From here:

- Add more connectors from [Connectors & Integrations](../connectors/index.md).
- Deepen your configuration with the [Admin Guide](../admin-guide/index.md).
- Learn day-to-day workflows in the [User Guide](../user-guide/index.md).