> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/aws-entities/aws-sso-user.md).

# SSO User

### AWS SSO User Fields

| Field            | Type   | Possible Operators                                             | Description                                                                                                                                |
| ---------------- | ------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| Guid             | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A unique identifier that is a combination of the GUID of the selected Scan and the SSO user's unique ID.                                   |
| FSName           | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A special unique identifier that is a combination of the UserName and the Identity Store ID.                                               |
| UserName         | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The user's Identity Center sign-in name.                                                                                                   |
| DisplayName      | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The user's full display name.                                                                                                              |
| Email            | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The primary email address on the Identity Store profile.                                                                                   |
| UserId           | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The Identity Store user identifier assigned by AWS.                                                                                        |
| IdentityStoreId  | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The identity store the user belongs to (e.g., `d-1234567890`).                                                                             |
| AccountId        | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The account that hosts the Identity Center instance the user belongs to.                                                                   |
| ExternalId       | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The identifier assigned by the upstream identity provider, carried over by SCIM provisioning.                                              |
| ExternalIdIssuer | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The identity store that issued the External ID, as an ARN.                                                                                 |
| AWSTier          | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Privilege tier of the user based on the effective permissions of its permission set assignments. Higher values indicate greater privilege. |
| ExposurePoint    | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | A numerical value indicating the level of exposure based on how many other entities can reach this user through attack paths.              |
| risk             | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The risk score of the user calculated based on vulnerability counts and severities.                                                        |