An identity provider that was configured well at go-live drifts every week: new applications bypass single sign-on, policy exclusions outlive the reason for them, legacy protocols creep back and dormant accounts stay enabled. This health check is a recurring, measurable review of a live identity provider (IdP) and SSO platform, run every quarter with a deeper annual review. It answers one question with numbers: is the IdP still doing its job across the estate this quarter? It is written for IAM platform owners, identity operations, security architects, internal audit and the CISO's office.
What this health check covers
It does not repeat how to harden the IdP. Administrator roles, authentication policy design, session settings, recovery and federation hardening are covered in the Identity Provider and SSO Security Guide, which is where each finding below is fixed. This page gives you the metrics, formulas, thresholds, sign-off and findings log to prove those controls still hold. It is vendor-neutral and works for workforce IdPs whether hosted or self-managed; for customer-facing identity, use the separate Customer identity (CIAM) platform health check.
Key takeaways
- Coverage is the first number. Every authentication metric describes only the applications behind SSO, so a falling SSO coverage figure makes the rest look better than it is.
- Measure sign-ins, not policies. A policy that requires MFA proves little; the share of successful interactive sign-ins that actually satisfied MFA is the figure that matters.
- Exclusions are where drift hides. Count every user, group and application excluded from access policies, and how many exclusions are past their review date.
- Privileged users get their own line. Report phishing-resistant authentication for administrators separately; a high workforce average can mask a weak admin population.
- Fixed formulas make quarters comparable. The formulas and green, amber and red bands here are NHI Mgmt Group recommended methods; record your own once and keep them stable.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this Identity provider (IdP) and SSO platform health check at the cadence set out below. Collect each figure from the data sources described, score it against the green, amber and red thresholds, and record every amber or red result as a finding with an owner and a due date. Keep each completed review so you can compare results quarter on quarter: the trend matters as much as any single score.
Cadence and sign-off
Take every figure as at one measurement date (for example the last working day of the quarter) and pull all exports within one working day of it. Mixed snapshot dates are the most common reason figures fail to reconcile.
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Operational dashboard (IDP-03, IDP-05, IDP-13) | Monthly | Identity operations lead | IAM platform owner | Dashboard snapshot and query definitions |
| Quarterly health check (all metrics) | Quarterly | IAM platform owner | Security risk or GRC | Raw exports, calculated scorecard, findings log |
| Annual review (metrics plus sampling) | Yearly | IAM platform owner | CISO or delegate | Leaver and MFA reset samples, threshold review, sign-off record |
| Independent re-performance | Yearly | Internal audit | Audit committee or CISO | Re-performed calculations for at least three metrics |
| Event-driven check | After a merger, tenant migration, new federation hub or identity incident | IAM platform owner | CISO or delegate | Scoped scorecard for affected metrics |
People who administer the IdP should not be the only ones approving figures about it. This follows the separation of duties principle in NIST SP 800-53 AC-5.
Metrics
Thirteen metrics, each with a numerator and denominator. Record the denominator alongside the percentage so a change in population is visible. NHI Mgmt Group recommended thresholds; adjust to your risk appetite.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| IDP-01 | SSO coverage | In-scope applications authenticating through the IdP / in-scope applications in the application register | IdP application integration list, application register or CMDB | 95% or more | 85% to below 95% | Below 85% |
| IDP-02 | Local login bypass | SSO-integrated applications that still accept a local password for non-emergency users / SSO-integrated applications | Application configuration review, application sign-in logs | Below 2% | 2% to 10% | Above 10%, or any for a privileged application |
| IDP-03 | MFA satisfied on interactive sign-ins | Successful interactive sign-ins where MFA was satisfied (or a valid MFA claim was carried) / all successful interactive sign-ins, 30 days | IdP sign-in logs | 99% or more | 95% to below 99% | Below 95% |
| IDP-04 | Phishing-resistant authentication for privileged users | Privileged users whose every successful sign-in in 30 days used a phishing-resistant method / privileged users | IdP sign-in logs joined with admin role membership | 100% | 95% to below 100% | Below 95% |
| IDP-05 | Legacy protocol sign-ins | Successful sign-ins over protocols that cannot carry MFA / all successful sign-ins, 30 days | IdP sign-in logs (client or protocol field) | 0% | Above 0% to 0.5%, all on an approved exception | Above 0.5%, or any without an exception |
| IDP-06 | Policy exclusions past review | Access policy exclusions (users, groups, applications, locations) past their review date / all exclusions | IdP policy configuration export, exception register | 0% | Above 0% to 10% | Above 10%, or any expired exclusion on an admin |
| IDP-07 | Dormant enabled accounts | Enabled human accounts with no successful sign-in in 90 days / enabled human accounts | IdP user directory export with last sign-in | Below 2% | 2% to 5% | Above 5%, or any dormant admin |
| IDP-08 | Leaver disablement within service level | Leavers disabled in the IdP within the service level after the HR termination date / leavers in the quarter | HR source effective dates, IdP audit log | 99% or more | 95% to below 99% | Below 95% |
| IDP-09 | Verified authenticator resets | MFA method resets and account recoveries with recorded identity verification evidence / all resets and recoveries | IdP audit log joined with service desk tickets | 100% | 95% to below 100% | Below 95% |
| IDP-10 | Privileged sessions within re-authentication policy | Privileged sessions that re-authenticated within the policy limit / privileged sessions, 30 days | IdP sign-in and session logs | 100% | 98% to below 100% | Below 98% |
| IDP-11 | Federation trust and certificate hygiene | Federation trusts and signing certificates that are expired, expire within 30 days without a scheduled rollover, or unused for 90 days / all trusts and certificates | IdP federation and certificate configuration export | 0% | Above 0% to 5% | Above 5%, or any unknown trust |
| IDP-12 | Application integration ownership | SAML and OIDC application integrations with an active owner and a sign-in in 90 days / all integrations | IdP application integration list, sign-in logs, owner field | 95% or more | 85% to below 95% | Below 85% |
| IDP-13 | High-risk sign-in triage within service level | High-risk sign-in or user risk detections triaged within the service level / all such detections | IdP risk detections, SIEM case records | 95% or more | 85% to below 95% | Below 85% |
A single red privileged finding (a dormant admin, an admin signing in with a phishable method, an unknown federation trust) is reported as red whatever the percentage. The formulas and sampling sizes on this page are NHI Mgmt Group recommended methods, not requirements of any standard.
Two reference points from standards help set your bands. NIST SP 800-63B-4 requires verifiers at AAL2 to offer at least one phishing-resistant option and requires phishing resistance at AAL3, which supports a 100% target for IDP-04 where admins are treated as high assurance. For IDP-10, the same publication sets AAL3 re-authentication at no more than 12 hours overall, with an inactivity timeout of no more than 15 minutes recommended, and AAL2 at no more than 24 hours overall with no more than one hour of inactivity recommended. Use your own policy limit as the denominator test.
How to collect the data
Use raw rows, not dashboard percentages, so each figure can be recalculated. Keep each export with the findings log and note the query used.
- IdP sign-in logs: source for IDP-03, IDP-04, IDP-05, IDP-07 and IDP-10. Filter to successful interactive sign-ins for IDP-03, and split by protocol or client type for IDP-05. Exclude workload and service principal sign-ins from human metrics and report them separately.
- IdP audit log: source for IDP-08 and IDP-09 (account disable events, authenticator registration and reset events). Join reset events with service desk tickets by user and time.
- IdP configuration export: access policies with their exclusions (IDP-06), federation trusts and signing certificates with expiry dates (IDP-11) and application integrations with owner fields (IDP-12). Export configuration as text so quarters can be compared line by line.
- Application register or CMDB: the denominator for IDP-01. The gap list of applications not behind SSO is the finding, not only the percentage.
- Application-side configuration: for IDP-02, check in each SSO-integrated application whether local password sign-in is still enabled for ordinary users. Start with privileged and internet-facing applications.
- HR source of record: termination effective dates for IDP-08. Use the effective date, not the date the record was entered.
- SIEM or case management records: triage timestamps for IDP-13, matched to the IdP's risk detections. See the SIEM Log Source Onboarding Checklist if IdP logs are not yet collected centrally.
- Admin role membership: the population for IDP-04, IDP-07 and IDP-10. Include eligible (just-in-time) assignments as well as standing ones.
Running the quarterly check
- Freeze the date: agree the measurement date and pull every export within one working day of it.
- Reconcile coverage first: update the IDP-01 gap list against the application register before calculating anything else.
- Calculate and compare: apply the recorded formula and compare with last quarter and the band.
- Sample the reds: for each red metric, check five to ten records directly (for example a dormant admin's real sign-in history in the target application) to rule out a data quality issue.
- Log and assign: enter each amber and red item in the findings log with an owner and due date.
- Sign off: present to the approvers in the cadence table and record the decision on each open red item.
In the annual review, sample 25 leavers and check each in the IdP and two downstream applications, and sample 25 MFA resets and confirm the verification evidence matches the documented procedure.
Red flags that need action now
- Any privileged account that signed in during the quarter without a phishing-resistant method.
- A federation trust, signing certificate or identity provider connection that nobody can explain or that was added without a change record. See the Golden SAML and Federation Trust Abuse Defence Guide.
- An authenticator reset for an administrator without recorded identity verification.
- Successful legacy protocol sign-ins for accounts with no approved exception.
- An access policy exclusion covering an admin role, a break-glass account without monitoring, or "all users" in a pilot group that never closed.
- A leaver still able to sign in more than 24 hours after the termination effective date.
- A gap of more than 24 hours in IdP log delivery to the SIEM during the quarter.
- High-risk sign-in detections closed as benign in bulk without investigation notes.
- An SSO coverage figure that fell by more than five percentage points in a quarter.
Findings log
Keep one running log across quarters so repeat findings are visible. Escalate a finding that is red for two consecutive quarters to the CISO, and record any finding that repeats three times in the risk register.
| ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-IDP-01 | [n] in-scope applications not behind SSO, including [application] | IDP-01 | [Red / Amber] | [Application owner] | [Date] | [Open / In progress / Closed / Risk accepted] |
| HC-IDP-02 | [n] administrators signed in with a phishable method | IDP-04 | Red | [IAM platform owner] | [Date] | [Status] |
| HC-IDP-03 | [n] policy exclusions past review date | IDP-06 | [Severity] | [Policy owner] | [Date] | [Status] |
| HC-IDP-04 | [n] MFA resets without verification evidence | IDP-09 | [Severity] | [Service desk manager] | [Date] | [Status] |
| HC-IDP-05 | [Trust or certificate] expired or unused | IDP-11 | [Severity] | [Federation owner] | [Date] | [Status] |
Add columns for quarter raised and a repeat flag if your log tool does not track history.
Remediation map
| Finding type | Where to fix it |
|---|---|
| Applications outside SSO, local login bypass (IDP-01, IDP-02) | Identity Provider and SSO Security Guide: federation, keys and applications; How Single Sign On Works |
| MFA gaps and phishable admin sign-ins (IDP-03, IDP-04) | Passwordless and Passkeys Guide; Conditional Access Guide |
| Legacy protocol sign-ins (IDP-05) | Legacy Authentication and ROPC Retirement Guide |
| Policy exclusions and break-glass drift (IDP-06) | Conditional Access Guide; Break-Glass Account Guide |
| Dormant accounts and late leavers (IDP-07, IDP-08) | Orphaned and Dormant Accounts; Joiner-Mover-Leaver Guide |
| Unverified authenticator resets (IDP-09) | Account Recovery and Help Desk Security Guide |
| Long privileged sessions (IDP-10) | JIT Access Guide; Session Hijacking and Cookie Theft Guide |
| Federation trust and certificate hygiene (IDP-11) | Federation and Trust Relationships Guide |
| Unowned or unused application integrations (IDP-12) | SaaS and OAuth App Governance Guide |
| Slow risk triage (IDP-13) | ITDR Guide |
Related guides
- Identity Provider and SSO Security Guide: how to harden the IdP that this check measures.
- Authentication Maturity Model: where your scorecard places you and what the next level needs.
- Identity Security Metrics Guide: programme-level identity metrics for leadership reporting.
- Identity Provider Tenant Compromise Playbook: what to do if a red finding turns out to be an intrusion.
- Identity governance and administration (IGA) platform health check: the companion check for certification, orphan accounts and leaver processing.
References
- NIST: SP 800-63B-4 Digital Identity Guidelines, Authentication and Authenticator Management
- NIST: SP 800-63C-4 Digital Identity Guidelines, Federation and Assertions
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls (AC-2 Account Management, AC-2(3) Disable Accounts, AC-5 Separation of Duties, IA-2(1) Multi-factor Authentication to Privileged Accounts, IA-11 Re-authentication, AU-6 Audit Record Review)
- NIST: Cybersecurity Framework 2.0 (PR.AA-01, PR.AA-03, DE.CM-03)
- OWASP: Authentication Cheat Sheet
Related NHI Mgmt Group resources: Identity Provider and SSO Security Guide, Authentication Maturity Model, Identity Security Metrics Guide, Identity Provider Tenant Compromise Playbook, Identity governance and administration (IGA) platform health check.