# Cisco Identity Checks

Cisco Identity Intelligence provides two categories of insights: identity threat detection and identity posture management. More information about the different types of checks can be found [here](https://docs.oort.io/understanding-check-failures/..#different-types-of-checks).

Navigate to the relevant section or search for a specific area of interest in the list below. Click on any detection to read more information about what criteria is used to fail a user for a specific check, which data sources are compatible with each check, as well as recommendations to remediate and customizable settings.

{% tabs %}
{% tab title="Identity Posture Management" %}

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FhMSYStZQlnuBn4JwKgQc%2FPosture%20Management.png?alt=media&#x26;token=cc9e22c1-f2db-43aa-aa66-c168559574b2" alt=""><figcaption></figcaption></figure>

[Access from Denied Territories](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/access-from-denied-countries)

[Allow/Block Email Logins](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/allow-block-email-logins)

[Application Login Bypasses SSO](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/application-login-bypasses-sso)

[Applications with Expired Secret](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/non-human-identity-nhi-posture-checks/applications-with-expired-secret)

[HRIS Discrepancies](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/hris-discrepancy)

[Identity Intelligence Client Secret Expiring Soon](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/non-human-identity-nhi-posture-checks/oort-client-secret-expiring-soon)

[Inactive Account Probing](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/inactive-account-probing)

[Inactive Guest Users](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/inactive-guest-users)

[Inactive Users](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/inactive-users)

[Missing Value in Mandatory Field](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/missing-value-in-mandatory-field)

[Never Logged In](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/never-logged-in)

[No MFA Configured ](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/no-mfa-configured)

[No Strong MFA Configured](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/no-strong-mfa-configured)

[Okta Long Running Sessions](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/okta-long-running-sessions)

[Okta Session Length Policy Compliance](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/okta-session-length-policy-compliance)

[Personal VPN Usage](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/personal-vpn-usage)

[Provider User Type Missing](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/user-type-missing)

[Rate Limit Alert](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/rate-limit-alert)

[Role Assigned to Azure Cloud Only Account](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/role-assigned-to-azure-cloud-only-account)

[Salesforce Direct Login Settings ](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/access-from-denied-countries-1)

[Shared Mailbox Sign In Enabled](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/non-human-identity-nhi-posture-checks/shared-mailbox-sign-in-enabled)

[Slack User Inconsistencies](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/slack-user-inconsistencies)

[Telecom MFA Limit Reached](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/telecom-mfa-limit-reached)

[Unmanaged Devices Access](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/unmanaged-devices-access)

[Unused Application for a User](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/unused-application-for-a-user)

[Upcoming App Key Expiration](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/non-human-identity-nhi-posture-checks/upcoming-app-key-expiration)

[User Authorized to Bypass MFA](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/user-authorized-to-bypass-mfa)

[User Has Directly Assigned Application](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/user-has-directly-assigned-application)

[User in IDP but not in HRIS](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/user-in-idp-but-not-in-hris)

[User Password Expiration Failure](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/user-password-expiration-failure)

[User Stuck in Non-Functional State](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/user-stuck-in-non-functional-state)

[User Sharing Authenticators](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/users-sharing-authenticators)

[Weak MFA Was Used to Successfully Sign In](https://docs.oort.io/understanding-check-failures/oort-insights/identity-posture-management-insights/weak-mfa-was-used-to-successfully-sign-in)
{% endtab %}

{% tab title="Identity Threat Detection" %}

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FBF5SHNsje7CFfKMvwcwY%2FThreat%20Detection.png?alt=media&#x26;token=6b683612-3b36-43b8-a001-0ccee5d47aa9" alt=""><figcaption></figcaption></figure>

[A Bypass Code Was Used To Successfully Sign In](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/a-bypass-code-was-used-to-successfully-sign-in)

[Access From Dormant Account](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/access-from-dormant-account)

[Accounts With Unusually High Activity](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/accounts-with-unusually-high-activity)

[Active Account under Heavy Attack](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/active-account-under-heavy-attack)

[Activity From Untrustworthy ISP](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/activity-from-untrustworthy-isp)

[Admin Impersonation in Okta](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/admin-impersonation-in-okta)

[Admin Role Assigned to User ](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/admin-role-assigned-to-user)

[Authenticator Registration Anomalies](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/authenticator-registration-anomalies)

[Code Exfiltration By Guest Account](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/code-exfiltration-by-guest-account)

[Compromised Sessions](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/compromised-session)

[Google Drive File with Excessive Sharing Permissions](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/google-drive-file-with-excessive-sharing-permissions)

[Impossible Travel](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/impossible-travel)

[IP Threat Detected](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/ip-threat-detected/ip-threat)

[Login to Admin Console](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/login-to-admin-console-in-okta)

[MFA Flood](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/mfa-flood)

[Microsoft Entra ID Admin Activity Anomaly](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/azure-admin-activity-anomaly)

[New Country for Tenant](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/new-country-for-tenant)

[New IdP Created](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/new-idp-created)

[Okta Admin Activity Anomaly](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/okta-admin-activity-anomaly)

[Rare Browser Activity](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/rare-browser-activity)

[Registered Location Mismatch](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/registered-location-mismatch)

[Risky Parallel Sessions](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/risky-parallel-sessions)

[Service Account Successful Sign In](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/non-human-identity-nhi-threat-checks/service-account-successful-sign-in)

[Shared Mailbox Successful Sign In](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/non-human-identity-nhi-threat-checks/shared-mailbox-successful-sign-in)

[Sign In Threat Detected](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/sign-in-threat-detected)

[Sign-in from Recently Created IdP](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/sign-in-from-recently-created-idp)

[Successful Access from a Previously Only Failing IP](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/successful-access-from-a-previously-only-failing-ip)

[Super Admin Login to Google](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/super-admin-login-to-google)

[Suspicious Activity Reported by End User](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/suspicious-activity-reported-by-end-user)

[Unusual Repo Access](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/unusual-repo-access)

[User IP in Blocked State](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/user-ip-in-blocked-state)

[User Lock Out Risk Detected](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/user-lock-out-risk-detected)

[User Trust Level Alert](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/user-trust-level-alert)

[Users With Defined Email Forward Rules](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/users-with-defined-email-forward-rules)

[Users with New Email Forward Rules](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/users-with-new-email-forward-rules)

[Weak MFA Manually Activated and Utilized](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/weak-mfa-manually-activated-and-utilized)
{% endtab %}
{% endtabs %}