Orphaned Accounts
The Orphaned Accounts page lists every Account that AOH Sync found in a Source System but could not match to any known Identity, so you can investigate and resolve each one.
Where this data comes from
Orphaned Accounts originate from the Account records that your Connectors pull from each connected Source System. When an Account cannot be matched to an existing Identity using the configured join keys — because the person has left, changed their identifier, or the account genuinely belongs to no current person — AOH Sync marks it as an orphan and surfaces it here for review.
Common reasons an account becomes an orphan:
A new hire exists in payroll before their login account is created (a timing gap that resolves itself).
A record uses a different identifier than the one AOH Sync matches on (a data quality issue).
The account genuinely belongs to no current person — a leftover, a mistake, or an unmarked service account (real risk).
Tracking orphans is how you tell timing gaps apart from actual unmanaged access.
The Orphan Management page lists unresolved accounts (ernesto from GitHub, thaddeus from Okta, xavier and dustin from Slack, dwight from AOH Test AD, and others) each with a numerical risk score and a base risk comparison. Use the Source system filter to narrow by source, or sort any column to prioritise your review.
How risk scores work
Each orphan carries a risk score between 0.0 and 1.0. The score combines a baseline risk with the length of time the orphan has gone unresolved: the longer an account sits unmatched, the higher it scores — automatically, without anyone having to remember to revisit it. A brand-new orphan may be a harmless timing gap; that same account unresolved weeks later signals a real governance problem. Scores are recomputed on a regular cycle so time acts as a risk multiplier.
AOH Sync also surfaces match suggestions for each orphan: the most likely existing Identities ranked by confidence, so you can confirm a match rather than search for one.
What you can do here
Filter by Status
Narrows the list to orphans in a specific state — for example, Unresolved.
Filter by Source system
Shows orphans from a single connected Source System only. Use the source system filter field to narrow the list by source system name.
Refresh
Reloads the list with the latest data.
Sort by any column
Reorders the list by Account name, Source System, Risk, Status, or Discovered date.
Click Actions
Opens a menu of resolution options for that orphan: match to an existing Identity, create a new Identity, mark as a Machine Identity, or dismiss.
How to use it
Filter to Unresolved Open Orphaned Accounts from the left navigation. Confirm the Status filter is set to Unresolved to see only items that need action.
Review risk scores The Risk column shows a numerical score for each orphan. Higher scores indicate a greater likelihood that the account represents an active, unmanaged access risk. Start with the highest-risk rows.
Resolve each orphan Click Actions on a row and choose the appropriate resolution: match the account to a known Identity, create a new Identity for it, designate it as a Machine Identity, or dismiss it if it is expected.
Related
Last updated