Open findings, ranked by severity.
11 identity-scope findings shown · all statuses · all severities
Open findings at or above the PRS 50 batch threshold — the prioritized weekly cohort.
Open critical-severity findings — the highest-severity band to clear first.
Single reversible action on a high or critical finding — fast risk reduction.
Past the severity-keyed SLA window and still open.
2 findings on tenant configuration
These describe the tenant itself rather than a specific identity — Conditional Access gaps, auth-context coverage, break-glass posture.
- criticalTier0 Admin No Ca MfaTier-0 admins not covered by a sign-in MFA policy
Two directory-role admins are excluded from every enabled Conditional Access policy that enforces MFA on sign-in.
tenant: Glacier Bay Robotics
- lowExcessive Ca ExclusionsConditional Access policy with a broad exclusion list
A Conditional Access policy excludes a synced contractor group, narrowing the protection it delivers.
tenant: Glacier Bay Robotics
Priya Singh can delegate Azure access but is not covered by an MFA-enforcing Conditional Access policy.
Mara Okonkwo holds a permanent Global Administrator role — the highest-impact standing privilege in the tenant.
312 assigned · 41 used
Diego Vasquez holds a permanent Owner assignment exercised on only 19% of its granted actions.
64 assigned · 13 used
Field Ops Copilot Agent inherits broad blueprint permissions but exercises a narrow subset.
240 assigned · 46 used
Glacier Deploy Pipeline holds Contributor across the subscription but exercised 19% of granted actions in the window.
Omar Haddad (external guest) is a member of a privileged directory role group.
90 assigned · 17 used
mi-glacier-api carries Contributor at subscription scope but writes only to one resource group.
120 assigned · 49 used
Backup Orchestrator SP holds a delete permission it has not exercised within the analysis window.
Tomas Novak's Privileged Role Administrator eligibility shows activation patterns that warrant a tighter policy.
Telemetry Forwarder SP has not been used in over 200 days.
Lena Andersen has not signed in for 190 days but retains role assignments.