> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/feature-reference/orphaned-accounts.md).

# Orphaned Accounts

The Orphaned Accounts page lists every Account that AOH Sync found in a Source System but could not match to any known Identity, so you can investigate and resolve each one.

## Where this data comes from

Orphaned Accounts originate from the Account records that your Connectors pull from each connected Source System. When an Account cannot be matched to an existing Identity using the configured join keys — because the person has left, changed their identifier, or the account genuinely belongs to no current person — AOH Sync marks it as an orphan and surfaces it here for review.

Common reasons an account becomes an orphan:

* A new hire exists in payroll before their login account is created (a timing gap that resolves itself).
* A record uses a different identifier than the one AOH Sync matches on (a data quality issue).
* The account genuinely belongs to no current person — a leftover, a mistake, or an unmarked service account (real risk).

Tracking orphans is how you tell timing gaps apart from actual unmanaged access.

![Orphaned Accounts (Orphan Management) page showing a list of unresolved accounts with columns for Account, Source System, Risk, Status, Discovered, and Actions](/files/lTlpKZ6yEfBSZtK4LlSp)

*The Orphan Management page lists unresolved accounts (ernesto from GitHub, thaddeus from Okta, xavier and dustin from Slack, dwight from AOH Test AD, and others) each with a numerical risk score and a base risk comparison. Use the Source system filter to narrow by source, or sort any column to prioritise your review.*

## How risk scores work

Each orphan carries a **risk score** between 0.0 and 1.0. The score combines a baseline risk with the length of time the orphan has gone unresolved: the longer an account sits unmatched, the higher it scores — automatically, without anyone having to remember to revisit it. A brand-new orphan may be a harmless timing gap; that same account unresolved weeks later signals a real governance problem. Scores are recomputed on a regular cycle so time acts as a risk multiplier.

AOH Sync also surfaces **match suggestions** for each orphan: the most likely existing Identities ranked by confidence, so you can confirm a match rather than search for one.

## What you can do here

| Action                      | What it does                                                                                                                                      |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| Filter by **Status**        | Narrows the list to orphans in a specific state — for example, Unresolved.                                                                        |
| Filter by **Source system** | Shows orphans from a single connected Source System only. Use the source system filter field to narrow the list by source system name.            |
| **Refresh**                 | Reloads the list with the latest data.                                                                                                            |
| Sort by any column          | Reorders the list by Account name, Source System, Risk, Status, or Discovered date.                                                               |
| Click **Actions**           | Opens a menu of resolution options for that orphan: match to an existing Identity, create a new Identity, mark as a Machine Identity, or dismiss. |

## How to use it

{% stepper %}
{% step %}
**Filter to Unresolved** Open **Orphaned Accounts** from the left navigation. Confirm the Status filter is set to **Unresolved** to see only items that need action.
{% endstep %}

{% step %}
**Review risk scores** The Risk column shows a numerical score for each orphan. Higher scores indicate a greater likelihood that the account represents an active, unmanaged access risk. Start with the highest-risk rows.
{% endstep %}

{% step %}
**Resolve each orphan** Click **Actions** on a row and choose the appropriate resolution: match the account to a known Identity, create a new Identity for it, designate it as a Machine Identity, or dismiss it if it is expected.
{% endstep %}
{% endstepper %}

## Related

* [Action Center](/feature-reference/data-quality.md)
* [Identities, Accounts & Users](/core-concepts/identities-accounts-users.md)
* [Source Systems](/feature-reference/source-systems.md)
* [Browsing Identities](/feature-reference/browsing-identities.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.aohwv.dev/feature-reference/orphaned-accounts.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.