Summary: 95% of enterprise permissions go unused — yet most organizations discover dormant access only through quarterly reports assembled by hand from a dozen admin consoles. Oleria Trustfusion, an AI-native identity security platform, eliminates the dormant access detection scramble by computing usage continuously and surfacing last-activity in days on every review line, so reviewers see dormant access where the decision happens — not in a separate report nobody reads.
95% of enterprise permissions go unused (Microsoft Security). The standard answer is the dormancy report — generated quarterly from a dozen admin consoles, manually correlated, attached to a ticket. By the time the report runs, the data is stale; by the time it's reviewed, six more months of dormancy have accumulated.
Most identity tools treat dormancy as a separate report, run once a quarter, parsed by hand. The signal exists in the data; it just isn't surfaced where the decision happens. Reviewers approve dormant access because they don't see that it's dormant.
Oleria's AI surfaces dormant days alongside every reviewable access line. Past the threshold, the AI's recommendation is "Reject." Reviewer confirms; access narrows continuously, not just at audit time.
Time to identify dormant access Days → continuous
Quarterly dormancy reports Eliminated
95% unused permissions stat Materially reduced over time
Audit findings on dormant access Eliminated
If 95% of enterprise permissions go unused, the question is how much of that is in your environment — and what it's costing in both risk and compliance exposure. Oleria's Identity Security Maturity Assessment benchmarks your current dormant access posture.
Yes — API patterns, scheduled jobs, and action streams apply the same dormancy logic.
Oleria correlates IdP authentication with app-level activity — per-permission, not per-identity.
Reviewers override per line with documented justification logged in the audit trail.
90 days — matches common quarterly review cadence and seasonal use patterns.
Days since last login or last access activity for a specific permission in the connected app.
