Identity metrics: measure the access that remains after the ticket closes

“Leavers processed within four hours” sounds like a useful identity metric. Before relying on it, ask what starts the clock, what stops it and which applications sit outside the measurement. The answer may describe ticket handling rather than the end of access.

For an IAM programme owner, measurement should expose the places where an access decision has not taken effect. That makes the dashboard a way to direct improvement, rather than a collection of reassuring completion rates.

Define the event at each end

A departure can appear first in an HR system, then a directory, then a provisioning service and finally a target application. Those timestamps describe different parts of the journey. Report them separately where the distinction reveals a bottleneck.

Microsoft Entra provisioning logs include the identity, action, source, target and event status. Microsoft distinguishes success, failure, skipped and warning states. That is useful operational evidence, but the team still needs a measurement definition that connects events to the application outcome it intends to report.

For a critical application, confirm what the recorded action means. An account disabled through one integration may coexist with another local route. A metric should not imply complete removal unless its scope actually covers those routes.

Show coverage beside speed

Consider a hypothetical month with 100 departures. Ninety involve applications covered by automated reporting; ten require manual follow-up. Reporting a strong completion rate only for the ninety can conceal the cases that carry the largest uncertainty.

Present both figures: performance within the measured population and the number awaiting confirmation outside it. Keep the exclusions stable enough for comparison, and explain any change. Adding difficult applications may initially make the reported performance look worse while giving management a more accurate view.

The same principle applies to privileged accounts, contractor identities and non-human identities. An employee directory is not automatically a complete population for every access measure. State which inventory supplies the denominator and who maintains it.

Use a small set of measures that lead somewhere

Measure	Decision it should support
Unconfirmed removals by application and age	Where to fix integration or resource manual follow-up.
Privileged access without a current owner	Which permissions need reassignment, restriction or removal.
Review decisions awaiting implementation	Whether access reviews are changing permissions.
Exceptions past their decision date	Which business owners must renew, remediate or stop access.

These measures are proposed management tools, not universal benchmarks. Set thresholds around the business consequence and operating model. A low average delay can coexist with a handful of long-running critical cases, so inspect the tail and the named unresolved items.

Challenge the dashboard with a sample

Choose completed lifecycle events and trace them into the affected applications. Check whether the intended permissions changed, whether failures were visible and whether reporting described the result correctly. This tests the measurement process as well as the identity process.

If a supposedly complete removal still leaves access, repair both the case and the metric definition. Otherwise the dashboard will continue rewarding the same incomplete outcome. The access-review guide applies the same logic to approved revocations.

Explain why the trend changed

Fewer unresolved identities might mean better ownership, a smaller inventory or a reporting failure. Faster processing might reflect a quieter month rather than an improved integration. Pair movement with its operational explanation and avoid attributing every favourable change to the programme.

A useful report ends with the work the evidence supports: repair a connector, clarify an owner, close an exception or extend coverage. That is more actionable than celebrating the number of accounts enrolled. The programme’s job is to keep access aligned with a legitimate purpose, and its measures should follow that purpose into the applications people use.