How to Read an Identity Posture Report

What is an identity security posture report?

An identity security posture report is a regular snapshot of how well the accounts that reach your firm's systems are protected: who can sign in, how they prove who they are, what they can reach, and which sign-ins looked wrong. For most RIAs, broker-dealers and family offices on Microsoft 365, the data comes from Microsoft Entra ID, the directory behind every mailbox, Teams chat and SharePoint file.

Microsoft's own identity secure score is usually one input. It is a percentage showing how closely a tenant follows Microsoft's identity recommendations, and Microsoft recalculates it every 24 hours. A report worth reading goes further. It names the accounts behind each gap, compares this period with the last one, and records what was fixed, what was accepted as a risk, and what is still open.

Why should a CCO or COO read it?

A CCO or COO should read it because those accounts are the front door to customer information, and examiners ask about that door. The SEC Division of Examinations' fiscal year 2026 priorities list access controls and account management among the cybersecurity practices it reviews, alongside firms' identity theft programs under Regulation S-ID and the amended Regulation S-P. Our read of what the 2026 exam priorities signal for RIAs covers the rest of the list.

Regulation S-P requires written policies and procedures covering administrative, technical and physical safeguards for customer information. The rule does not list specific identity controls, so the firm has to show what it chose and that it works. A dated identity report, with remediation notes attached, is some of the clearest evidence a firm can produce for the technical side of that obligation.

State-registered advisers covered by the FTC Safeguards Rule face a more specific requirement. 16 CFR 314.4(c) requires multifactor authentication for any individual accessing any information system, unless the firm's Qualified Individual approves in writing reasonably equivalent or more secure access controls.

Which sections should you read first?

Start with five: multifactor coverage, legacy sign-in methods, administrator accounts, stale and shared accounts, and risky sign-ins. Together they cover the most common ways an attacker gets into a firm mailbox.

Multifactor authentication coverage

Look for the share of users with MFA registered and enforced, and the names of anyone excluded. A short exclusion list is normal, for example an emergency administrator account kept offline or a scan-to-email device. Each exclusion should have a named owner, a written reason and a review date.

Then look at the methods in use. NIST SP 800-63B-4 does not treat one-time codes or out-of-band methods that rely on entering or relaying a code as phishing-resistant, and passwords are not either. If most of your staff still approve sign-ins by text message or push notification, the report should say so plainly.

Legacy authentication

Older sign-in protocols, used by some mail apps, copiers and outdated Office versions, cannot perform multifactor checks. Microsoft's secure score includes a recommendation to enable a policy blocking legacy authentication. If the report shows any legacy sign-ins in the period, ask which accounts made them and from what device or app.

Administrator accounts

Read the list of Global Administrators by name. Microsoft's recommendations include requiring MFA for administrative roles, designating more than one Global Administrator, and using least-privileged roles. In practice that means a small number of named people, each using a separate admin account that is not their everyday mailbox.

Stale, shared and guest accounts

Look for accounts with no sign-in for 90 days or more, accounts belonging to people who have left, shared mailboxes that still allow direct sign-in, and guest users from former vendors or consultants. Each one is a working credential nobody is watching. The fix is usually a tighter offboarding checklist, and the report is how you confirm it is being followed.

Risky sign-ins and risky users

On tenants licensed for it, Microsoft Entra ID Protection flags sign-ins that look like compromise, such as leaked credentials or sign-ins from unfamiliar locations. The report should show how many were flagged, how many were confirmed or dismissed, and who reviewed them. A flagged sign-in that nobody closed is a finding in its own right.

What does a good trend look like?

A good trend shows fewer open findings each cycle, a short exception list with owners, and no high-severity item that repeats from one report to the next. The score alone can mislead. Microsoft drops recommendations marked as ignored from the calculation and removes risk-accepted actions from the improvement list, so a score can look better, and a gap can vanish from view, when items are set aside and nothing has been fixed.

Ask for accepted risks to appear as their own section, each with the approver's name and a review date. That list is often the most useful page for a CCO, because it shows exactly which gaps the firm decided to live with and who decided.

What should you ask your IT provider about the report?

Five questions cover most of it:

• Which findings are new since the last report, and which repeat?
• Who approved each MFA exclusion and accepted risk, and when will each be reviewed?
• Which administrator accounts signed in this period, and from where?
• Were any risky sign-ins confirmed as compromise, and if so, was the incident response program started?
• What would it take to move the remaining users, starting with administrators and anyone who handles wires, to phishing-resistant methods such as passkeys or security keys?

The fourth question matters most. Regulation S-P requires an incident response program that assesses the nature and scope of any incident involving unauthorized access to customer information. A confirmed account compromise is often where that assessment starts.

How does the report fit into exam evidence?

File each report with its remediation notes and accepted-risk list, dated, alongside your annual compliance review materials. When an examiner asks how the firm manages access, you can hand over a series of reports that shows the controls over time, with names and dates attached. It belongs in the same exam evidence binder as your other IT provider reports.

If a risky sign-in turns out to be unauthorized access to customer information, the recordkeeping rules apply directly. Rule 204-2(a)(25) requires SEC-registered advisers to keep documentation of detected unauthorized access and of notification determinations, generally for five years. Broker-dealers have a parallel requirement under Rule 17a-4(e)(14).

What should your firm do this quarter?

• Ask for the current identity report and the two before it, side by side.
• Reduce the MFA exclusion list to named, approved exceptions with review dates.
• Confirm legacy authentication is blocked, and ask to see the policy itself.
• Review every Global Administrator by name and remove anyone who does not need the role.
• Disable accounts for anyone who left this year, and remove stale guest users.
• Pick a cadence, monthly or quarterly, and decide who signs off on each report.

How does s90 help?

s90's Identity Posture service produces this report on a set schedule for firms on Microsoft 365, explains each finding in plain language, and tracks fixes and accepted risks so the compliance team has a dated record ready for an exam. If you would like to see what a report for your firm would show, we are happy to walk through a sample with you.