Security · Managed Security Operations · 06
Identity and access monitoring
Identity and access monitoring watches the accounts, privileges and authentication events that attackers use most: new administrator accounts, privilege changes, dormant accounts that suddenly wake, impossible travel, repeated failures, MFA bypasses and access that outlives employment. It is needed when identity is the control everything else depends on, which is nearly every environment, when access reviews are infrequent or absent, when an audit asks for evidence of access governance, or after an incident that began with a credential. Monitoring produces defined detection for identity events, a recurring access review with recorded decisions, a reconciled list of privileged accounts and service accounts with owners, and the evidence that access is granted, reviewed and removed on purpose.
Scope
What the review covers.
- Detection for privileged account creation and change, authentication anomalies and MFA events
- Privileged and service account inventory with owners
- Joiner, mover and leaver verification against HR records
- Periodic access reviews with recorded decisions
- Dormant and orphaned account handling
- Evidence for audits and customer reviews
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Identity detection set | Rules and alert handling for identity events |
| Privileged account inventory | Owned, justified, reviewed |
| Access review record | Decisions and removals, period by period |
| Evidence summary | Access governance evidence for auditors |
Prerequisites
What we need from you.
- Access to the identity provider and directory, and to authentication logs
- An HR feed or list for joiner, mover and leaver reconciliation
- Application owners to participate in access reviews
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Does this replace an identity governance product?
For many organizations it covers what matters without one. Where a product is warranted the monitoring defines what it must do.
How often are access reviews run?
Quarterly for privileged access is a common standard; the cadence is set by your obligations and your rate of change.
What about cloud and SaaS accounts?
In scope. Identity sprawl across SaaS is often where the orphaned accounts are found.