Adaptive Access Review

Adaptive Access Review is a risk-driven governance capability in ADManager Plus that continuously monitors user privileges using real-time identity confidence scoring.

Unlike traditional periodic access certifications, Adaptive Access Review automatically triggers targeted certification requests when it detects elevated risk signals or anomalous behavior.

This enables administrators and managers to:

• Identify over-privileged accounts.
• Detect dormant privileged access.
• Respond to anomalous user behavior.
• Review entitlements that have not been certified recently.
• Focus review efforts only where risk exists.

Instead of reviewing all access on a schedule, reviews are triggered dynamically based on risk.

Key concepts

Understanding the following terms will help teams interpret their Adaptive Access Review results correctly.

Identity confidence score

A dynamic score (0-100) that represents the trust level of a user's access.

• Higher score → Lower risk
• Lower score → Higher risk
• The score is calculated using governance, hygiene, and behavioral signals.

Risk-triggered review

A certification request automatically generated by the system when a user's access crosses a defined risk threshold.

Dynamic scoring

A weighted normalization model that adjusts based on available data. If certain scores are not applicable (e.g., a new user with no behavioral history), they are excluded instead of being treated as zero.

Prerequisites

• Activate the Adaptive Access Review module so the system can generate and manage certification requests.
• Ensure that the default certifier assignment rule is configured, as this rule will be used to process the certification requests and cannot be modified later.
• Ensure user attributes like department, title, group membership, and account status are accurate for meaningful scoring.
• Check whether anomaly or activity monitoring is available, as it will improve risk scoring. If not, the system will calculate the score using available data.

How Adaptive Access Review works

Adaptive Access Review continuously monitors user access and calculates an Identity Confidence Score based on governance posture, access hygiene, and behavioral signals.

If the score drops due to elevated risk, such as dormant privileged access, unusual activity, low peer similarity, or outdated certifications, the system automatically generates a targeted certification request for that specific access.

Each review request includes:

• The current identity confidence score.
• A summary of the risk indicators that triggered the review.
• A recommended action such as Retain, Remove, or Manual Review.

Reviewers can use this contextual information to validate, modify, or revoke the flagged access.

Identity confidence score

The identity confidence score is a dynamic score between 0 and 100 that represents the overall trust level of a user’s access.

The score is calculated using three main categories:

Each category contributes proportionally to the final score. A higher score indicates lower risk. A lower score indicates elevated risk and may trigger a review.

Governance (30%)

This category evaluates how well the access aligns with governance policies.

Hygiene (30%)

This category evaluates account security posture, such as password age, account status, and alignment with peer access patterns.

Behavioral (40%)

This category evaluates real-time behavioral risk.

Dynamic scoring model

Adaptive Access Review uses a Dynamic Scoring model. If a category does not have sufficient data, it is excluded from the calculation instead of being treated as zero. The remaining categories automatically adjust their weight proportionally.

Example:

This ensures:

• New users are not penalized for missing behavioral history.
• Service accounts without login activity are evaluated fairly.
• The score reflects only available and relevant data.

Auto-trigger conditions

A certification review is automatically triggered when the identity confidence score drops due to one or more of the following conditions:

• Low peer similarity in access patterns.
• Privileged account showing prolonged dormancy.
• Detection of unusual or anomalous activity.
• Access not certified within the last six months.
• Significant degradation in governance or hygiene signals.

When triggered, the system generates a targeted certification request with contextual details and a recommended action.

Steps to configure Adaptive Access Review

1. Navigate to Admin > General Settings > Security and Privacy.
2. Under the Privacy Settings tab, select the Enable Adaptive Access Review check box.
3. A new Confidence Score column will now be displayed in access certification request reviews.
4. Review the Confidence Score for each access item and check the corresponding recommendation.
5. Click Details to view the factors behind the recommendation.
6. Based on the recommendation, choose the appropriate action, such as Approve, Revoke, or Needs Attention.

Tips

• Always review the risk context provided along with the score before taking action.
• Prioritize dormant or unused privileged access for immediate review.
• Investigate low peer similarity to identify potential privilege creep.
• Treat anomalous activity alerts as high priority and validate recent behavior.
• Complete certification requests promptly to maintain a strong governance posture.