Five identity metrics to report monthly—and the vanity ones to drop

The dashboard that looks healthy while your risk keeps climbing

A 2026 identity program can report 40 green charts and still miss the one thing that matters: whether a stolen token, a broken policy, or a bloated directory can turn into a real incident. We see this pattern in enterprise reviews all the time: MFA adoption sits at 98%, but 14% of privileged accounts still bypass phishing-resistant factors; login success is high, but token replay attempts are rising; and the identity team celebrates ticket closure speed while access sprawl quietly expands.

The fix is not more metrics. It is better metrics. If you report the wrong identity metrics monthly, you will optimize for optics, not control. The five identity metrics below tell you whether your identity plane is getting safer, faster, and cheaper to operate.

1) Privileged access coverage: who can do real damage, and how protected are they?

This is the first identity metric that belongs in every monthly board packet. Measure the percentage of privileged accounts covered by phishing-resistant MFA, just-in-time elevation, and session recording where applicable.

A useful version looks like this:

Privileged Access Coverage =
(Privileged identities with phishing-resistant MFA + JIT + session controls enabled)
/
(Total privileged identities)

Why this identity metric matters: privileged accounts are still the shortest path to domain compromise, cloud takeover, and SaaS data exfiltration. In a typical 8,000-user enterprise, you might have only 120 privileged identities, but those accounts can control 90%+ of the blast radius. If 18 of those 120 still use SMS-based MFA or weak push approvals, your headline 99% MFA rate is misleading.

What good looks like in 2026:

• 95%+ of privileged identities protected by phishing-resistant MFA
• 90%+ of admin actions behind JIT or time-bound elevation
• 100% of break-glass accounts monitored and tested monthly

A realistic target for large enterprises is to raise privileged access coverage by 3-5 points per month until you hit 95%+. If you are stuck below 80%, the blocker is usually legacy admin workflows, not technology.

Example scenario

A global manufacturer running Microsoft Entra ID, Okta, and AWS IAM found that 41 of 167 privileged identities were still exempt from phishing-resistant MFA because of service desk shortcuts. After removing static exemptions and moving to time-boxed elevation, their incident response team reduced high-risk admin exposure by 62% in one quarter.

2) Identity policy enforcement rate: are your controls actually on, or just documented?

Policy design is not policy enforcement. This identity metric measures the percentage of logins, API calls, and admin actions that are evaluated against current conditional access, device trust, and risk policies.

A simple monthly view should include:

• interactive user sign-ins evaluated by policy
• non-interactive sign-ins evaluated by policy
• privileged actions evaluated by policy
• policy exceptions granted and expired

identity_policy_enforcement:
  interactive_signins_evaluated: 98.7%
  noninteractive_signins_evaluated: 91.2%
  privileged_actions_evaluated: 99.4%
  expired_exceptions_removed: 87
  standing_exemptions_remaining: 14

This identity metric catches the gap between design and reality. For example, a bank may have 100% conditional access coverage on paper, but if 22 service principals bypass policy because they were created before the current baseline, the control is incomplete.

What to watch:

• non-interactive traffic, which often hides the worst gaps
• legacy apps using header-based auth or static secrets
• policy exclusions that never expire

In 2026, the best teams aim for 98%+ policy evaluation coverage across interactive traffic and at least 90% for machine-to-machine flows, then close the remainder with service identity modernization.

3) Identity-to-access latency: how long does it take to give and remove access?

This is the identity metric most leaders underestimate. Access delay creates productivity drag on the way in and risk drag on the way out. Measure median and p95 time from approved request to effective access, and from termination event to access revocation.

Use two separate numbers:

1. Provisioning latency: request approved to access active
2. Deprovisioning latency: HR termination or contractor end date to access removed

Provisioning latency p50: 11 minutes
Provisioning latency p95: 2 hours 18 minutes
Deprovisioning latency p50: 8 minutes
Deprovisioning latency p95: 47 minutes

This identity metric is where engineering and security finally agree. If engineers wait two days for a repo or cloud role, they create shadow access paths. If offboarding takes six hours, a departing admin still has a window to exfiltrate data.

A realistic enterprise benchmark in 2026:

• standard SaaS access: p50 under 15 minutes
• standard cloud role access: p50 under 30 minutes
• termination revocation: p95 under 30 minutes
• privileged access removal: p95 under 10 minutes

Practical architecture decision

Use event-driven deprovisioning tied to HR and contractor systems, not nightly batch jobs. A webhook from Workday or SAP SuccessFactors into your identity orchestration layer can cut revocation latency from hours to minutes.

graph LR
HR[HRIS / Contractor System] --> IGA[Identity Governance]
IGA --> IDP[IdP / SSO]
IGA --> PAM[Privileged Access Mgmt]
IGA --> SaaS[SaaS Apps]
IGA --> Cloud[Cloud IAM]
HR --> SIEM[Security Analytics]

4) Orphaned and overprivileged identity rate: how much access no one can explain?

This identity metric combines two of the most expensive failures: accounts with no owner and accounts with more access than their role justifies. Track both as a percentage of total identities, then break them down by business unit and platform.

A strong monthly report includes:

• orphaned human accounts
• orphaned service accounts
• stale guest accounts older than 90 days
• users with privilege above role baseline

SELECT
  COUNT(*) FILTER (WHERE owner IS NULL) * 100.0 / COUNT(*) AS orphan_rate,
  COUNT(*) FILTER (WHERE privilege_level > role_baseline) * 100.0 / COUNT(*) AS overprivileged_rate
FROM identity_inventory
WHERE status = 'active';

Why this identity metric matters: orphaned and overprivileged accounts are the easiest targets for persistence. Attackers love accounts that no one watches. Internal audits also hate them because they reveal weak ownership and poor lifecycle control.

What good looks like:

• orphaned human accounts below 0.5%
• orphaned service accounts below 1% of total service identities
• overprivileged accounts below 3% and trending down monthly

A real-world pattern: a SaaS-heavy company with 18,000 identities found 612 guest accounts older than 120 days and 89 service accounts with no owner. After assigning ownership and removing unused access, they reduced audit exceptions by 74% and cut quarterly remediation effort by 31 hours.

5) Identity incident rate and mean time to contain: are identity failures becoming incidents?

The best identity metric is the one that links controls to outcomes. Track identity-related security incidents per month and the mean time to contain them. That includes token theft, suspicious sign-in bursts, impossible travel events, MFA fatigue attacks, privilege escalation, and unauthorized role grants.

Report it like this:

• identity incidents per 1,000 users
• identity incidents per 1,000 privileged identities
• mean time to detect
• mean time to contain
• percentage of incidents caused by policy gaps vs user behavior vs misconfiguration

Month: June 2026
Identity incidents: 17
Per 1,000 users: 0.21
MTTD: 14 minutes
MTTC: 52 minutes
Top cause: misconfigured service principal permissions (41%)

This identity metric keeps the conversation honest. If your login success rate is excellent but your token replay incidents are climbing, your authentication layer is not as healthy as the dashboard suggests.

In 2026, mature teams aim for:

• MTTD under 15 minutes for identity anomalies
• MTTC under 60 minutes for medium-severity identity incidents
• downward trend in incidents caused by standing privilege and stale secrets

The metrics that only flatter you

Some identity metrics look useful because they move in the right direction when you do almost anything. They are not useless, but they should never be your primary monthly report.

1) Overall MFA adoption

A 99% MFA adoption rate sounds impressive until you learn that the missing 1% includes all your admins and service desks. This identity metric flatters you because it ignores factor strength, exception scope, and phishing resistance.

Better question: what percentage of privileged and high-risk access uses phishing-resistant MFA?

2) Total number of SSO apps connected

More apps in SSO is not the same as better control. A company can connect 340 apps and still leave 90 shadow SaaS tools unmanaged. This metric flatters platform teams while hiding app risk concentration.

Better question: what percentage of business-critical apps enforce current policy and SCIM-based lifecycle management?

3) Ticket closure speed for access requests

Fast closure can mean automation, or it can mean rubber-stamping. If your average access ticket closes in 4 minutes, ask whether the request was validated or just auto-approved.

Better question: what percentage of access requests are approved by policy, denied by policy, or escalated for manual review?

4) Number of identities onboarded

Growth is not control. Adding 2,000 contractors to your directory tells you nothing about whether they were removed on time or assigned the right entitlements.

Better question: what is the net identity growth after removals, and how many identities are stale after 30, 60, and 90 days?

5) Password reset count

A falling password reset count can mean better self-service, or it can mean more passkeys and fewer password users. On its own, it tells you little about risk or efficiency.

Better question: what percentage of users are on passkeys or phishing-resistant authentication, and how many resets are tied to suspicious activity?

How to build a monthly identity report executives will actually use

Your monthly identity report should fit on one page, with drill-downs behind it. If you need 14 charts to explain the state of identity, the report is too broad.

Use this structure:

1. Top-line risk: privileged access coverage, identity incidents, deprovisioning latency
2. Control health: policy enforcement rate, orphaned/overprivileged rate
3. Operational efficiency: provisioning latency, exception backlog, automation rate
4. Trend and variance: month-over-month change, outliers, business-unit hotspots

{
  "month": "2026-08",
  "privileged_access_coverage": 0.96,
  "policy_enforcement_rate": 0.987,
  "provisioning_latency_p95_minutes": 138,
  "deprovisioning_latency_p95_minutes": 22,
  "orphaned_identity_rate": 0.004,
  "identity_incidents": 12
}

A good report also names owners. If a metric is red and no team owns the fix, it is just decoration.

Common Pitfalls

• Reporting averages instead of percentiles. Median provisioning may be 9 minutes while p95 is 2 hours. Use both, or you will hide painful tail latency.
• Mixing human and machine identities. Service principals, workload identities, and human users behave differently. Split the data or the signal gets muddy.
• Counting enabled controls, not enforced controls. A policy that exists but is bypassed by exclusions does not reduce risk.
• Letting exceptions age forever. Every standing exemption becomes a future incident unless it has an owner and an expiry date.
• Celebrating adoption without coverage. MFA adoption across the workforce means little if privileged users and admins are the last holdouts.

What to automate before next month’s review

If you want these identity metrics to stay accurate, automate the collection. Pull from your IdP, PAM, IGA, HRIS, SIEM, and cloud control plane on a daily cadence, then aggregate monthly.

A practical stack in 2026 often includes:

• Microsoft Entra ID or Okta for authentication signals
• CyberArk, Delinea, or BeyondTrust for privileged controls
• SailPoint or Saviynt for governance
• Workday or SAP SuccessFactors for lifecycle triggers
• Splunk, Microsoft Sentinel, or Google SecOps for incident correlation

The automation goal is not just reporting. It is finding drift early enough to fix it before the audit, the outage, or the breach.

Key Takeaways

• Report privileged access coverage monthly, not just total MFA adoption.
• Track policy enforcement rate to expose apps, service accounts, and flows that bypass controls.
• Use p95 provisioning and deprovisioning latency to measure real operational speed.
• Combine orphaned and overprivileged identity rate into one risk view so you can prioritize cleanup.
• Add identity incident rate and mean time to contain to connect controls with outcomes.
• Drop vanity metrics that look good but do not change risk, cost, or response time.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.