Unknown Identity
An unknown identity exists in activity or directory sources but lacks sufficient context for confident security decisions—uncertainty about role, ownership, or privilege, not merely an unmapped account name.
Unknown Identity
Definition
An unknown identity is an identity that exists in activity or directory sources but lacks sufficient context for confident security decisions.
The uncertainty is about role, ownership, privilege, and relationships—who the identity represents, what it can access, and whether it is expected—not merely an unmapped username or service principal label. Authentication or log activity may surface the entity; decision support still requires context enrichment.
Related terms
- Identity —
KID-GLS-0010 - Security Context —
KID-GLS-0003 - Unknown Asset —
KID-GLS-0030