User

The User entity represents a user account in Azure Active Directory (Entra ID).

Field	Type	Possible Operators	Description
Guid	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Unique identifier for the entity in Forestall
FSName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Display name used in Forestall
ObjectID	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Azure AD Object ID of the user
FirstName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	First name of the user
LastName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Last name of the user
Enabled	BOOLEAN	N/A (toggle)	Whether the user account is enabled
WhenCreated	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	Date the user account was created
DisplayName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Display name of the user in Azure AD
Title	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Job title of the user
PasswordLastSet	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	Date the user's password was last set
Email	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Email address of the user
OnPremImmutableID	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Immutable ID synced from on-premises AD
OnPremSyncEnabled	BOOLEAN	N/A (toggle)	Whether the user is synced from on-premises AD
OnPremSID	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	On-premises Security Identifier (SID)
IsInactive	BOOLEAN	N/A (toggle)	Whether the user account is inactive
OnPremLastSyncDateTime	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	Last sync date/time from on-premises AD
UserPrincipalName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	User Principal Name (UPN) of the user
UserType	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Type of user (e.g., Member, Guest)
IsAZPrivileged	BOOLEAN	N/A (toggle)	Whether the user has privileged access in Azure
IsShadow	BOOLEAN	N/A (toggle)	Whether the user is a Shadow Admin
IsAdmin	BOOLEAN	N/A (toggle)	Whether the user has admin privileges
WhenDeleted	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	Date the user was deleted (if applicable)
UsageLocation	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Usage location assigned to the user
PasswordPolicies	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Password policies applied to the user
TenantID	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Azure AD Tenant ID the user belongs to
IsSsprRegistered	BOOLEAN	N/A (toggle)	Whether the user is registered for Self-Service Password Reset
IsSsprEnabled	BOOLEAN	N/A (toggle)	Whether SSPR is enabled for the user
IsSsprCapable	BOOLEAN	N/A (toggle)	Whether the user is capable of using SSPR
IsMfaCapable	BOOLEAN	N/A (toggle)	Whether the user is capable of using MFA
IsMfaRegistered	BOOLEAN	N/A (toggle)	Whether the user is registered for MFA
IsPasswordlessCapable	BOOLEAN	N/A (toggle)	Whether the user is capable of passwordless authentication
MethodsRegistered	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Authentication methods registered by the user
LastSignInDateTime	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	Last interactive sign-in date/time
LastNonInteractiveSignInDateTime	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	Last non-interactive sign-in date/time
LastSuccessfulSignInDateTime	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	Last successful sign-in date/time
AZTier	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Azure tier classification assigned by Forestall
IsARMPrivileged	BOOLEAN	N/A (toggle)	Whether the object holds a privileged Azure Resource Manager (ARM) role.