IdentityWatch
Continuous Identity Monitoring for the AI Era. Discover every identity. Monitor every entitlement. Detect every threat.
IdentityWatch continuously monitors Microsoft Entra ID to discover identities and entitlements, analyze identity and entitlement usage, detect threats in real time, assess risk, and correlate activity into meaningful incidents—all across Human, Non-Human, and AI Identities.
Read-only Entra ID connection. No agent or appliance. Usage history begins building after consent and flows into the SecurEnds governance experience.
m.alvarez@yourcu.org
14 entitlements held
Microsoft 365 — Standard user
via group · Employees-All
Finance app — Payments Admin
via group · Finance-Ops-Admins
Line-of-business app — Ledger Post
direct assignment
Entra ID — User Administrator
PIM eligible · never activated
6 used in 90 days
8 dormant · 3 review priorities
Extend the value of every access review
Extend the review process you already trust with usage intelligence.
SecurEnds User Access Reviews centralize entitlements, route certifications to the right reviewers, document decisions, and drive remediation. IdentityWatch adds last-used activity, frequency, and relevant ITDR findings to that same workflow, giving reviewers and security teams a shared identity context.
SecurEnds User Access Reviews
Govern and certify access
- Consolidate entitlements across cloud, SaaS, and on-premises applications.
- Route certifications to the appropriate managers and application owners.
- Capture approve, revoke, change, exception, and reviewer-comment decisions.
- Track remediation and produce a complete, audit-ready review record.
User Access Reviews + IdentityWatch
Add usage and ITDR context
- Add last-used date and 90-day frequency to the entitlement review.
- Surface dormant and never-used access as additional context for reviewer decisions.
- Connect relevant ITDR findings to the identity and access involved.
- Preserve timestamped usage and ITDR evidence alongside certification results.
How IdentityWatch extends UAR
Usage and identity-risk context, connected to the identity record.
IdentityWatch complements the SecurEnds governance record with three additional dimensions: entitlement usage, changes in identity activity, and ITDR findings connected to the access involved.
01
Entitlement usage
Correlate Entra ID sign-in and audit activity with the entitlement inventory to provide last-used and frequency context for supported human and non-human identities.
02
Usage context for reviewers
Last-used and frequency data helps reviewers focus attention on dormant and never-used entitlements and determine whether access should be retained, changed, or revoked.
03
Identity activity context
Add signals such as first-seen infrastructure, use of privileged grants, and renewed activity on dormant access to the review and security workflows your team already uses.
04
Context across connected applications
Use Entra ID activity alongside entitlement data already collected through SecurEnds connectors to broaden the context available during certification and investigation.
05
Non-human & AI agent identities
Bring supported service principals and AI agents into the same identity view so their access and activity context can complement existing non-human identity governance.
06
Evidence that complements certification
Retain 13 months of timestamped usage history and export it alongside certification decisions to strengthen the evidence available for annual audits and examinations.
ITDR intelligence for access governance
Connect identity findings to the access-review record.
IdentityWatch applies ITDR analytics to the same Entra ID telemetry used for entitlement-usage intelligence. Relevant findings are connected to the identity and its access context, creating continuity between certification, investigation, and remediation.
How it complements governanceIdentityWatch adds ITDR findings to the identity and entitlement context already governed in
SecurEnds. IAM, security, compliance, and audit teams can collaborate from a shared record while
retaining their existing review and response responsibilities.
Account takeover
Account takeover and identity-use signals
Signals that supplement the access record with context about unusual or potentially unauthorized identity activity.
S19
Irregular IP takeoverCRITICAL
A sign-in originates from infrastructure not previously associated with the identity. Priority increases when the activity is followed by use of a dormant entitlement.
S01
MFA fatigueHIGH
Repeated MFA push prompts followed by an approval, providing context for a possible MFA-fatigue event.
S02
Impossible travelHIGH
Two sign-ins from locations that cannot be reached in the elapsed time, with corporate egress learned and suppressed.
S03
Token theft & replayHIGH
A session token appears from new infrastructure without a corresponding fresh authentication event.
S04
Password sprayHIGH
A single source attempts a limited set of passwords across multiple accounts, consistent with password-spray behavior.
S05
Dormant account & entitlement revivalHIGH
A long-inactive account signs in, or an entitlement unused for months is suddenly exercised.
S06
Legacy authenticationMEDIUM
Authentication over basic protocols that bypass MFA entirely.
S07
Consent phishingHIGH
A user grants an application durable API access in a pattern consistent with consent phishing.
S08
Privilege escalationCRITICAL
A new privileged entitlement is granted and then exercised, preserving the grant and use as one connected sequence. Self-grants receive immediate priority.
S09
Service account & AI agent abuseHIGH
A service account or AI agent uses new infrastructure, receives new credentials, or exercises a permission outside its prior activity baseline.
S10
Mailbox persistenceMEDIUM
New inbox forwarding, redirection, concealment rules, or mailbox delegations that may indicate persistence.
Control plane
Changes to critical identity controls
Signals that add governance context when critical identity-control settings are changed, disabled, or expanded.
S11
Conditional access tamperingCRITICAL
Conditional access policies are disabled, modified, or given new exclusions, with the affected identities and entitlements retained for review.
S12
Federation abuseCRITICAL
Federation trust or token-signing certificate changes that may affect the integrity of authentication.
S13
Privileged role management abuseHIGH
Unusual privileged-role activations, approval bypass, or conversion of eligible roles to permanent assignments.
S14
Device registration abuseHIGH
New device registrations that may be used to satisfy device-based access requirements.
S15
Guest & external access abuseHIGH
External guests invited and rapidly granted privileges, or collaboration settings loosened.
S16
Authentication policy tamperingCRITICAL
Security defaults disabled, MFA methods removed, or trusted locations edited to weaken authentication.
S17
Cross-tenant access abuseHIGH
Cross-tenant trust or synchronization settings are changed in a way that expands access from an external tenant.
S18
Directory sync abuseCRITICAL
Unusual synchronization-account activity or password-hash-sync changes that may indicate a connector security issue.
Findings surface inside the SecurEnds access-review and security workflows your team already
runs. Investigation and remediation remain aligned to your existing approvals, ownership, and
response processes.
Each finding is enriched with the affected identity's entitlement footprint — held, used in the last 90 days, and dormant — so responders can understand the access involved and reviewers can retain the relevant activity evidence with the certification record.
How it works
A read-only Entra ID connection that complements your SecurEnds deployment.
Grant read-only consent to begin collecting Entra ID activity context. There is no agent or appliance, and the resulting usage intelligence is added to the SecurEnds identity-governance experience.
01 · Connect
Read-only consent
Use admin consent to read supported sign-in, directory, and entitlement data. IdentityWatch does not require an additional agent or appliance in the tenant.
02 · Inventory
Map who holds what
Use the SecurEnds entitlement inventory—including supported group-derived, direct, directory-role, and PIM-eligible access—as the governance foundation.
03 · Correlate
Correlate activity with access
Correlate supported sign-in and audit activity with entitlement records to build last-used and frequency context for reviewers and security teams.
04 · Review
Enrich the access review
Usage intelligence and relevant findings appear inside the SecurEnds review workflow, adding context where reviewers already make certification decisions.
Extend context across connected systems
Microsoft Entra ID
SaaS applications
Line-of-business systems
Legacy & on-prem apps
200+ connectors
For your next exam
A stronger evidence package for every examination.
SecurEnds User Access Reviews document who has access, who reviewed it, and what decision was made. IdentityWatch complements that certification record with usage history and identity-threat context, giving audit and compliance teams a more complete evidence package from one platform.
What evidence informed the certification decision?
The UAR decision, reviewer record, and remediation history, supplemented by available last-used and frequency context.
How does IdentityWatch extend the access-review record?
It connects Entra ID activity to entitlement context already collected from supported cloud, SaaS, line-of-business, legacy, and on-premises applications.
How are identity findings connected to governed access?
Relevant ITDR findings are linked to the identity and entitlement context used by governance and security teams.
How does the evidence support the annual review cycle?
Thirteen months of timestamped usage history can be exported alongside the access-review and certification record.
SecurEnds User Access Reviews establish governance, accountability, and remediation. IdentityWatch adds usage intelligence and identity-risk context, creating a stronger review experience and a shared evidence base for IAM, security, compliance, and audit teams.
Extend your SecurEnds access reviews