> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/gcp-entities/user.md).

# User

The **GCPUser** entity represents a Google Cloud / Google Workspace user account.

| Field                       | Type    | Possible Operators                                             | Description                                               |
| --------------------------- | ------- | -------------------------------------------------------------- | --------------------------------------------------------- |
| Guid                        | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Unique identifier for the entity in Forestall             |
| FSName                      | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Display name used in Forestall                            |
| GCPTier                     | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | GCP tier classification assigned by Forestall             |
| Domain                      | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Domain the user belongs to                                |
| Aliases                     | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Email aliases associated with the user                    |
| ChangePasswordAtNextLogin   | BOOLEAN | N/A (toggle)                                                   | Whether the user must change their password on next login |
| CreationTime                | DATE    | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | Timestamp when the user account was created               |
| CreationTimeDateTimeOffset  | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Creation time with timezone offset                        |
| CustomerId                  | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Google Workspace customer ID                              |
| DeletionTime                | DATE    | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | Timestamp when the user account was deleted               |
| Emails                      | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | All email addresses associated with the user              |
| GuestAccountEmail           | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Email address of the guest account                        |
| Id                          | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Google-assigned unique user ID                            |
| IsAdmin                     | BOOLEAN | N/A (toggle)                                                   | Whether the user has super admin privileges               |
| IpWhitelisted               | BOOLEAN | N/A (toggle)                                                   | Whether the user's IP address is whitelisted              |
| IsDelegatedAdmin            | BOOLEAN | N/A (toggle)                                                   | Whether the user is a delegated administrator             |
| IsEnforcedIn2Sv             | BOOLEAN | N/A (toggle)                                                   | Whether 2-step verification is enforced for the user      |
| IsEnrolledIn2Sv             | BOOLEAN | N/A (toggle)                                                   | Whether the user is enrolled in 2-step verification       |
| IsGuestUser                 | BOOLEAN | N/A (toggle)                                                   | Whether the account is a guest user                       |
| Kind                        | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Resource kind identifier from Google                      |
| LastLoginTime               | DATE    | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | Timestamp of the user's last login                        |
| LastLoginTimeDateTimeOffset | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Last login time with timezone offset                      |
| DisplayName                 | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Full display name of the user                             |
| GivenName                   | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | First name of the user                                    |
| LastName                    | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Last name of the user                                     |
| NonEditableAliases          | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Aliases that cannot be edited                             |
| OrgUnitPath                 | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Organizational unit path the user belongs to              |
| PrimaryEmail                | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Primary email address of the user                         |
| RecoveryEmail               | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Recovery email address for the user                       |
| Relations                   | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | User relations (e.g. manager, assistant)                  |
| Suspended                   | BOOLEAN | N/A (toggle)                                                   | Whether the user account is suspended                     |
| SuspensionReason            | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Reason for account suspension                             |
| risk                        | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Risk score assigned to the entity                         |
| ExposurePoint               | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Exposure point score assigned to the entity               |
| IsShadow                    | BOOLEAN | N/A (toggle)                                                   | Whether the entity is marked as a Shadow Admin            |