Key points
- ISPM checks the accounts, roles, app registrations and policies in your identity provider and the apps behind it, before anyone abuses them.
- Typical findings are admins without MFA, stale privileged accounts, ownerless apps with broad permissions, loose guest access and unused permissions.
- Severity alone ties too many findings. Ranking by what the account can reach tells you which one to fix first.
- SSPM checks the settings inside each SaaS app and CSPM checks cloud infrastructure. ISPM checks identities across all of them.
- Start with your admins. Count them, close their MFA gaps, and take roles off accounts nobody uses.
What is identity security posture management?
Identity security posture management (ISPM) is the practice of checking your identities for weaknesses before an attacker finds them. It reads how accounts, roles, groups, app registrations and sign-in policies are set up today. Then it reports each gap as a finding.
The identities include people, guests, service accounts and the apps that act on their own. The settings live in your identity provider and in the SaaS apps that trust it.
ISPM needs no attack to happen first. MITRE ATT&CK lists the abuse of cloud accounts as T1078.004 (Valid Accounts: Cloud Accounts). Its entry notes that over-privileged accounts can be used to pull data from cloud storage and databases. An attacker with a working sign-in needs no exploit. ISPM looks for the accounts that would be worth that sign-in.
What does ISPM check?
ISPM checks for the conditions attackers look for first. Most of them are ordinary.
| Finding | What it looks like | Why it matters |
|---|---|---|
| Admin without MFA | A user with a directory role signs in with a password alone | One phished password hands over the role |
| Stale privileged account | An account with no sign-in for 90 days still holds a role | Nobody would notice it signing in again |
| Ownerless app with broad permissions | An app registration holds Directory.ReadWrite.All and lists no owner | Nobody answers for its secrets or its scopes |
| Loose guest access | A guest from a partner tenant holds a role or reads the whole directory | You do not control that person's account |
| Unused permissions | A role or scope that has not been used in months | It adds reach without doing any work |
Public baselines give you a yardstick for several of these. CISA's Secure Configuration Baseline for Microsoft Entra ID requires phishing-resistant MFA for highly privileged roles (MS.AAD.3.6v1). It also caps Global Administrators at two to eight users (MS.AAD.7.1v1).
Unused permissions are easy to miss, because nothing breaks while they sit there. In Sonrai Security's Cloud Access Risk Report, 92% of identities with access to sensitive permissions did not use them over 90 days. That sample covered public cloud estates.
Why rank findings by reach instead of severity?
Severity tells you how bad a type of gap is. Reach tells you how bad this one is. Many findings share a severity label, and a list sorted by severity alone leaves you guessing.
Take two findings that both arrive as high.
- A service principal holds Directory.ReadWrite.All and has no owner. It can read and change users and groups across the whole directory.
- A dormant guest has not signed in since March. It can read one SharePoint site.
On severity they tie. On reach they are far apart. The service principal goes first.
Reach comes from the blast radius of the account. That covers what it holds directly, what it gets through groups and nested groups, and what its roles grant. Attack paths matter too. A low-risk account that sits in a group nested inside a privileged group can reach far more than its own roles suggest. A good ISPM tool finds that route before anyone walks it.
How is ISPM different from SSPM, CSPM and IGA?
Each of these tools reads a different layer. The names sound alike, and buyers often mix them up.
| What it reads | A typical finding | |
|---|---|---|
| CSPM (cloud security posture management) | Settings in AWS, Azure and Google Cloud infrastructure | A storage bucket open to the internet |
| SSPM (SaaS security posture management) | Settings inside each SaaS app | External file sharing left on in a collaboration app |
| IGA (identity governance and administration) | Who should hold which access, and the reviews that prove it | A leaver who still holds three app roles |
| ISPM (identity security posture management) | Identities and their privileges across the identity provider and its apps | An admin with no MFA |
The layers overlap at the edges. An SSPM tool may flag a weak admin setting in one app. ISPM asks the same question across every app the identity reaches.
IGA and ISPM fit together well. A review asks whether a person should hold some access. ISPM asks whether the account holding it is safe to leave as it is.
How do you start with ISPM?
Start with your admins. Their accounts reach the most.
- Connect your identity provider. Roles, groups, app registrations and sign-in policies all live there.
- Count your admins. Compare the number of Global Administrators with CISA's two to eight. Move anyone who needs less onto a narrower role.
- Close MFA gaps on privileged roles. Use phishing-resistant methods where you can.
- Take roles off stale accounts. Pick a cutoff, such as 90 days without a sign-in, and act on what it finds.
- Give every app registration an owner. Remove the ones nobody claims. An app with no owner has the same problem as an orphaned account. Nobody answers for it.
- Review guest access. Remove guests whose project has ended, and limit what the rest can read.
- Scan again on a schedule. Gaps reopen as people change roles and approve new apps.
Service accounts and app registrations deserve their own pass. A non-human identity often holds broad permissions and never signs in with MFA.
What does EnscureX Posture do?
EnscureX Posture scans users, groups, applications, service principals and domains every six hours. Each finding is a standing condition. The scan opens it, and the scan closes it once the gap is gone.
A finding has one of three states: active, acknowledged or resolved. Acknowledging a finding records who did it and when. An admin without MFA stays open until MFA is on, and then the scan closes it.
Each finding carries the remediation guidance from its rule, with a script where one applies.
Findings are ranked by what the affected account can reach. The impact score weighs reach as well as severity. The blast radius shows everything one account can reach, and attack paths trace the route from an entry point to anything privileged. Each account and each application carries a risk score, and the organization gets one posture score.
If a check cannot run with the permissions you granted, it is marked unevaluated. A gap you cannot see never shows up as a pass. The close the door first page walks through the whole job.
Frequently asked questions
What is the difference between ISPM and CIEM?
CIEM (cloud infrastructure entitlement management) looks at the roles and permissions identities hold in AWS, Azure and Google Cloud. ISPM covers your identity provider and the SaaS apps that trust it. The two overlap on service accounts and other non-human identities.
How often should identity posture be scanned?
Several times a day is a sensible target. Roles, consents and policies change during working hours, and a weekly scan leaves a new gap open for days.
Who owns ISPM in a security team?
Security engineering usually owns the findings and the ranking. IT admins make most of the fixes, because they run the identity provider. GRC reads the trend.
Can ISPM tell me if an account is compromised?
No. ISPM shows where an attacker would most likely start. Catching someone who is using an account right now is the job of identity threat detection and response (ITDR).