> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/azure-entities/entra-id/user.md).

# User

The **User** entity represents a user account in Azure Active Directory (Entra ID).

| Field                            | Type    | Possible Operators                                             | Description                                                              |
| -------------------------------- | ------- | -------------------------------------------------------------- | ------------------------------------------------------------------------ |
| Guid                             | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Unique identifier for the entity in Forestall                            |
| FSName                           | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Display name used in Forestall                                           |
| ObjectID                         | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Azure AD Object ID of the user                                           |
| FirstName                        | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | First name of the user                                                   |
| LastName                         | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Last name of the user                                                    |
| Enabled                          | BOOLEAN | N/A (toggle)                                                   | Whether the user account is enabled                                      |
| WhenCreated                      | DATE    | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | Date the user account was created                                        |
| DisplayName                      | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Display name of the user in Azure AD                                     |
| Title                            | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Job title of the user                                                    |
| PasswordLastSet                  | DATE    | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | Date the user's password was last set                                    |
| Email                            | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Email address of the user                                                |
| OnPremImmutableID                | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Immutable ID synced from on-premises AD                                  |
| OnPremSyncEnabled                | BOOLEAN | N/A (toggle)                                                   | Whether the user is synced from on-premises AD                           |
| OnPremSID                        | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | On-premises Security Identifier (SID)                                    |
| IsInactive                       | BOOLEAN | N/A (toggle)                                                   | Whether the user account is inactive                                     |
| OnPremLastSyncDateTime           | DATE    | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | Last sync date/time from on-premises AD                                  |
| UserPrincipalName                | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | User Principal Name (UPN) of the user                                    |
| UserType                         | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Type of user (e.g., Member, Guest)                                       |
| IsAZPrivileged                   | BOOLEAN | N/A (toggle)                                                   | Whether the user has privileged access in Azure                          |
| IsShadow                         | BOOLEAN | N/A (toggle)                                                   | Whether the user is a Shadow Admin                                       |
| IsAdmin                          | BOOLEAN | N/A (toggle)                                                   | Whether the user has admin privileges                                    |
| WhenDeleted                      | DATE    | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | Date the user was deleted (if applicable)                                |
| UsageLocation                    | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Usage location assigned to the user                                      |
| PasswordPolicies                 | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Password policies applied to the user                                    |
| TenantID                         | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Azure AD Tenant ID the user belongs to                                   |
| IsSsprRegistered                 | BOOLEAN | N/A (toggle)                                                   | Whether the user is registered for Self-Service Password Reset           |
| IsSsprEnabled                    | BOOLEAN | N/A (toggle)                                                   | Whether SSPR is enabled for the user                                     |
| IsSsprCapable                    | BOOLEAN | N/A (toggle)                                                   | Whether the user is capable of using SSPR                                |
| IsMfaCapable                     | BOOLEAN | N/A (toggle)                                                   | Whether the user is capable of using MFA                                 |
| IsMfaRegistered                  | BOOLEAN | N/A (toggle)                                                   | Whether the user is registered for MFA                                   |
| IsPasswordlessCapable            | BOOLEAN | N/A (toggle)                                                   | Whether the user is capable of passwordless authentication               |
| MethodsRegistered                | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Authentication methods registered by the user                            |
| LastSignInDateTime               | DATE    | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | Last interactive sign-in date/time                                       |
| LastNonInteractiveSignInDateTime | DATE    | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | Last non-interactive sign-in date/time                                   |
| LastSuccessfulSignInDateTime     | DATE    | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | Last successful sign-in date/time                                        |
| AZTier                           | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Azure tier classification assigned by Forestall                          |
| IsARMPrivileged                  | BOOLEAN | N/A (toggle)                                                   | Whether the object holds a privileged Azure Resource Manager (ARM) role. |