The User entity represents a user account in Azure Active Directory (Entra ID).
| Field | Type | Possible Operators | Description |
|---|---|---|---|
| Guid | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Unique identifier for the entity in Forestall |
| FSName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Display name used in Forestall |
| ObjectID | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Azure AD Object ID of the user |
| FirstName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | First name of the user |
| LastName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Last name of the user |
| Enabled | BOOLEAN | N/A (toggle) | Whether the user account is enabled |
| WhenCreated | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Date the user account was created |
| DisplayName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Display name of the user in Azure AD |
| Title | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Job title of the user |
| PasswordLastSet | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Date the user’s password was last set |
| TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Email address of the user | |
| OnPremImmutableID | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Immutable ID synced from on-premises AD |
| OnPremSyncEnabled | BOOLEAN | N/A (toggle) | Whether the user is synced from on-premises AD |
| OnPremSID | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | On-premises Security Identifier (SID) |
| IsInactive | BOOLEAN | N/A (toggle) | Whether the user account is inactive |
| OnPremLastSyncDateTime | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Last sync date/time from on-premises AD |
| UserPrincipalName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | User Principal Name (UPN) of the user |
| UserType | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Type of user (e.g., Member, Guest) |
| IsAZPrivileged | BOOLEAN | N/A (toggle) | Whether the user has privileged access in Azure |
| IsShadow | BOOLEAN | N/A (toggle) | Whether the user is a Shadow Admin |
| IsAdmin | BOOLEAN | N/A (toggle) | Whether the user has admin privileges |
| WhenDeleted | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Date the user was deleted (if applicable) |
| UsageLocation | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Usage location assigned to the user |
| PasswordPolicies | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Password policies applied to the user |
| TenantID | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Azure AD Tenant ID the user belongs to |
| IsSsprRegistered | BOOLEAN | N/A (toggle) | Whether the user is registered for Self-Service Password Reset |
| IsSsprEnabled | BOOLEAN | N/A (toggle) | Whether SSPR is enabled for the user |
| IsSsprCapable | BOOLEAN | N/A (toggle) | Whether the user is capable of using SSPR |
| IsMfaCapable | BOOLEAN | N/A (toggle) | Whether the user is capable of using MFA |
| IsMfaRegistered | BOOLEAN | N/A (toggle) | Whether the user is registered for MFA |
| IsPasswordlessCapable | BOOLEAN | N/A (toggle) | Whether the user is capable of passwordless authentication |
| MethodsRegistered | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Authentication methods registered by the user |
| LastSignInDateTime | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Last interactive sign-in date/time |
| LastNonInteractiveSignInDateTime | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Last non-interactive sign-in date/time |
| LastSuccessfulSignInDateTime | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Last successful sign-in date/time |
| AZTier | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | Azure tier classification assigned by Forestall |
| IsARMPrivileged | BOOLEAN | N/A (toggle) | Whether the object holds a privileged Azure Resource Manager (ARM) role. |