Score identity risk from MFA status, breach history, password reuse, inactive accounts, and excess permissions.