Identity Risk Score is higher than expected in ITDR

If your Identity Risk Score appears alarmingly high after connecting your Identity Provider, follow this article to troubleshoot the problem.

Symptoms

• Identity Risk Score is much higher than expected

Cause

Legitimate behaviors in your organization are being flagged as risky before the system has learned what normal activity in your environment looks like

Resolution

1. An initial high Identity Risk Score is common. The product has not yet learned what normal behavior is in your environment.
2. Review which signals are contributing most to the elevated score (e.g., impossible travel, stale accounts, weak MFA coverage).
3. Identify whether any of the flagged behaviors are legitimate and expected for this organization.
4. Check again in 5–7 days after fine-tuning the system to see if the score has stabilized.

Scores typically stabilize as the system ingests more behavioral data over the first few days/weeks.

Back to ITDR Guide