Now Hiring: Are you a driven and motivated 1st Line IT Support Engineer?

Identitywatch

  • Home
  • Identitywatch

Identitywatch

IdentityWatch

Continuous Identity Monitoring for the AI Era. Discover every identity. Monitor every entitlement. Detect every threat.

IdentityWatch continuously monitors Microsoft Entra ID to discover identities and entitlements, analyze identity and entitlement usage, detect threats in real time, assess risk, and correlate activity into meaningful incidents—all across Human, Non-Human, and AI Identities.

Book a walkthrough
Explore usage and ITDR

Read-only Entra ID connection. No agent or appliance. Usage history begins building after consent and flows into the SecurEnds governance experience.

m.alvarez@yourcu.org
14 entitlements held
Microsoft 365 — Standard user
via group · Employees-All

used today

Finance app — Payments Admin
via group · Finance-Ops-Admins

last used 247d ago

Line-of-business app — Ledger Post
direct assignment

never used

Entra ID — User Administrator
PIM eligible · never activated

never used

6 used in 90 days
8 dormant · 3 review priorities

Extend the value of every access review

Extend the review process you already trust with usage intelligence.

SecurEnds User Access Reviews centralize entitlements, route certifications to the right reviewers,
document decisions, and drive remediation. IdentityWatch adds last-used activity, frequency, and
relevant ITDR findings to that same workflow, giving reviewers and security teams a shared identity context.

SecurEnds User Access Reviews

Govern and certify access

  • Consolidate entitlements across cloud, SaaS, and on-premises applications.
  • Route certifications to the appropriate managers and application owners.
  • Capture approve, revoke, change, exception, and reviewer-comment decisions.
  • Track remediation and produce a complete, audit-ready review record.

User Access Reviews + IdentityWatch

Add usage and ITDR context

  • Add last-used date and 90-day frequency to the entitlement review.
  • Surface dormant and never-used access as additional context for reviewer decisions.
  • Connect relevant ITDR findings to the identity and access involved.
  • Preserve timestamped usage and ITDR evidence alongside certification results.

How IdentityWatch extends UAR

Usage and identity-risk context, connected to the identity record.

IdentityWatch complements the SecurEnds governance record with three additional dimensions: entitlement usage, changes in identity activity, and ITDR findings connected to the access involved.

01

Entitlement usage

Correlate Entra ID sign-in and audit activity with the entitlement inventory to provide last-used and frequency context for supported human and non-human identities.

02

Usage context for reviewers

Last-used and frequency data helps reviewers focus attention on dormant and never-used entitlements and determine whether access should be retained, changed, or revoked.

03

Identity activity context

Add signals such as first-seen infrastructure, use of privileged grants, and renewed activity on dormant access to the review and security workflows your team already uses.

04

Context across connected applications

Use Entra ID activity alongside entitlement data already collected through SecurEnds connectors to broaden the context available during certification and investigation.

05

Non-human & AI agent identities

Bring supported service principals and AI agents into the same identity view so their access and activity context can complement existing non-human identity governance.

06

Evidence that complements certification

Retain 13 months of timestamped usage history and export it alongside certification decisions to strengthen the evidence available for annual audits and examinations.

ITDR intelligence for access governance

Connect identity findings to the access-review record.

IdentityWatch applies ITDR analytics to the same Entra ID telemetry used for entitlement-usage
intelligence. Relevant findings are connected to the identity and its access context, creating
continuity between certification, investigation, and remediation.

How it complements governanceIdentityWatch adds ITDR findings to the identity and entitlement context already governed in
SecurEnds. IAM, security, compliance, and audit teams can collaborate from a shared record while
retaining their existing review and response responsibilities.

Account takeover

Account takeover and identity-use signals

Signals that supplement the access record with context about unusual or potentially unauthorized identity activity.

S19

Irregular IP takeoverCRITICAL

A sign-in originates from infrastructure not previously associated with the identity. Priority increases when the activity is followed by use of a dormant entitlement.

S01

MFA fatigueHIGH

Repeated MFA push prompts followed by an approval, providing context for a possible MFA-fatigue event.

S02

Impossible travelHIGH

Two sign-ins from locations that cannot be reached in the elapsed time, with corporate egress learned and suppressed.

S03

Token theft & replayHIGH

A session token appears from new infrastructure without a corresponding fresh authentication event.

S04

Password sprayHIGH

A single source attempts a limited set of passwords across multiple accounts, consistent with password-spray behavior.

S05

Dormant account & entitlement revivalHIGH

A long-inactive account signs in, or an entitlement unused for months is suddenly exercised.

S06

Legacy authenticationMEDIUM

Authentication over basic protocols that bypass MFA entirely.

S07

Consent phishingHIGH

A user grants an application durable API access in a pattern consistent with consent phishing.

S08

Privilege escalationCRITICAL

A new privileged entitlement is granted and then exercised, preserving the grant and use as one connected sequence. Self-grants receive immediate priority.

S09

Service account & AI agent abuseHIGH

A service account or AI agent uses new infrastructure, receives new credentials, or exercises a permission outside its prior activity baseline.

S10

Mailbox persistenceMEDIUM

New inbox forwarding, redirection, concealment rules, or mailbox delegations that may indicate persistence.

Control plane

Changes to critical identity controls

Signals that add governance context when critical identity-control settings are changed, disabled, or expanded.

S11

Conditional access tamperingCRITICAL

Conditional access policies are disabled, modified, or given new exclusions, with the affected identities and entitlements retained for review.

S12

Federation abuseCRITICAL

Federation trust or token-signing certificate changes that may affect the integrity of authentication.

S13

Privileged role management abuseHIGH

Unusual privileged-role activations, approval bypass, or conversion of eligible roles to permanent assignments.

S14

Device registration abuseHIGH

New device registrations that may be used to satisfy device-based access requirements.

S15

Guest & external access abuseHIGH

External guests invited and rapidly granted privileges, or collaboration settings loosened.

S16

Authentication policy tamperingCRITICAL

Security defaults disabled, MFA methods removed, or trusted locations edited to weaken authentication.

S17

Cross-tenant access abuseHIGH

Cross-tenant trust or synchronization settings are changed in a way that expands access from an external tenant.

S18

Directory sync abuseCRITICAL

Unusual synchronization-account activity or password-hash-sync changes that may indicate a connector security issue.
Findings surface inside the SecurEnds access-review and security workflows your team already
runs. Investigation and remediation remain aligned to your existing approvals, ownership, and
response processes.

Each finding is enriched with the affected identity’s entitlement footprint — held, used in the
last 90 days, and dormant — so responders can understand the access involved and reviewers can
retain the relevant activity evidence with the certification record.

How it works

A read-only Entra ID connection that complements your SecurEnds deployment.

Grant read-only consent to begin collecting Entra ID activity context. There is no agent or appliance, and the resulting usage intelligence is added to the SecurEnds identity-governance experience.

01 · Connect

Read-only consent

Use admin consent to read supported sign-in, directory, and entitlement data. IdentityWatch does not require an additional agent or appliance in the tenant.

02 · Inventory

Map who holds what

Use the SecurEnds entitlement inventory—including supported group-derived, direct, directory-role, and PIM-eligible access—as the governance foundation.

03 · Correlate

Correlate activity with access

Correlate supported sign-in and audit activity with entitlement records to build last-used and frequency context for reviewers and security teams.

04 · Review

Enrich the access review

Usage intelligence and relevant findings appear inside the SecurEnds review workflow, adding context where reviewers already make certification decisions.

Extend context across connected systems

Microsoft Entra ID
SaaS applications
Line-of-business systems
Legacy & on-prem apps
200+ connectors

For your next exam

A stronger evidence package for every examination.

SecurEnds User Access Reviews document who has access, who reviewed it, and what decision was
made. IdentityWatch complements that certification record with usage history and identity-threat
context, giving audit and compliance teams a more complete evidence package from one platform.

What evidence informed the certification decision?
The UAR decision, reviewer record, and remediation history, supplemented by available last-used and frequency context.
How does IdentityWatch extend the access-review record?
It connects Entra ID activity to entitlement context already collected from supported cloud, SaaS, line-of-business, legacy, and on-premises applications.
How are identity findings connected to governed access?
Relevant ITDR findings are linked to the identity and entitlement context used by governance and security teams.
How does the evidence support the annual review cycle?
Thirteen months of timestamped usage history can be exported alongside the access-review and certification record.

SecurEnds User Access Reviews establish governance, accountability, and remediation. IdentityWatch adds
usage intelligence and identity-risk context, creating a stronger review
experience and a shared evidence base for IAM, security, compliance, and audit teams.

Extend your SecurEnds access reviews

Add usage intelligence and identity-risk context to every review.

See how IdentityWatch extends the SecurEnds User Access Review workflow with entitlement activity,
dormant-access context, and ITDR findings — while preserving the governance, certification, and
remediation process your teams already use.

Book a Demo

Meet SecurEnds at BLACK HAT USA 2026 | Booth #8006 | August 1–6 | Mandalay Bay, Las Vegas

Register Now
X