Unified Identities

Unified Identities lists every enumerated object of the selected scan and shows which provider or providers it comes from: Active Directory, Azure (Entra ID, Azure Resource Management, Microsoft 365 Teams and Microsoft 365 SharePoint Online), AWS, GCP and GitHub. Accounts that belong to the same person or workload are matched and merged into a single unified identity. Objects that match nothing stay single-provider rows.

The module has four pages in the sidebar: Human Identities, Non Human Identities, Resources and Group. The rules that are used to match and merge identities are in Merge Rules.

List Pages

Each page lists the objects of its category. The list contains the following columns:

Column	Description
Name	Name of the identity. Selecting it opens the details page (see Details Page).
Providers	Icon of each provider the identity has an account in. Hover an icon to see the provider and type.
Risk (%)	Risk score of the identity.
Exposure Point	Exposure point of the identity.
Issue Counts	Number of issues on the identity by severity (Critical, High, Medium, Low, Info).

The table title shows the total number of rows, for example Human (979). Use Search... to search the list, Export to download the list and Columns to show or hide columns.

The type pages in this section (AD Identities, Azure Identities, AWS Identities, GCP Identities, GitHub Identities) document the details page of each object type. To reach an object of a given type, open its category page and filter Providers to that provider and type, as shown below.

Human Identities

Active Directory: User, Local User

Entra ID: User

AWS: IAM User, SSO User

GCP Identities: User

GitHub: User

Human Identities

Non Human Identities

Active Directory: Computer, Managed Service Account, Group Managed Service Account, Delegated Managed Service Account

Entra ID: Device, Application, Service Principal

Azure Resource Management: User Assigned Identity

AWS: IAM Role

GCP Identities: Service Account, Device, Principal

GitHub: App Installation

Non Human Identities

Resources

Active Directory: Domain, Forest, OU, Certificate Authority, CA Certificate, Certificate Template, GPO

Entra ID: Tenant, Administrative Unit, Role, Conditional Access Policy

Azure Resource Management: Virtual Machine, Subscription, Resource Group, Management Group, Key Vault, SQL Server, ARM Role, Managed Cluster, VM Scale Set, Web App, Logic App, Function App, Automation Account, Container Registry, Storage Account

Microsoft 365 Teams: Teams Settings, Teams External Access Settings, Teams Messaging Policy, Teams Meeting Policy

Microsoft 365 SharePoint Online: SharePoint Site, SharePoint Settings

AWS: Account, IAM Policy, Organization, Organizational Unit, Identity Center, Permission Set

GCP Identities: Organization, Folder, Project, Role, Service Account Key, Organizational Unit, Workforce Identity Pool, Workload Identity Pool, Workforce Provider, Workload Provider, Virtual Machine, Customer, KMS Key

GitHub: Organization, Repository, Organization Role, Enterprise

Resources

Group

Active Directory: Group, Local Group

Entra ID: Group

AWS: IAM Group, SSO Group

GCP Identities: Group

GitHub: Team

Group

Filters

The filters above the list are applied directly.

Providers: Selects the providers and entity types to be listed. The menu lists only the providers and types that have data in the selected scan.

Accounts: Filters by the number of linked accounts. Under LINKED ACCOUNTS, Any applies no restriction, Multiple providers lists identities with accounts in more than one provider, and Single provider lists identities with an account in exactly one provider.

In the Providers menu, each provider row shows how many of its types are selected (for example 0/7) and can be expanded to reveal its entity types. Use the Search provider or type... box to find a type. When nothing is selected, every provider and type is shown. Otherwise the menu shows how many types are selected and a button to clear them.

Providers Filter

The selected providers and types are shown as chips under APPLIED FILTERS. Selecting a chip opens the menu at that provider, and its cross button removes that provider from the filter.

Filtered Entity Types

The cross button next to the Providers button clears the whole provider filter.

Show all providers and types

Accounts Filter

The filters, search text and sort order are kept in the page URL (provider, entityType, providerMode, q, sortField, sortOrder). You can bookmark a filtered list or share it as a link. For example, /entities/unifiedidentities/human?provider=AWS&entityType=AWSSSOUser opens Human Identities filtered to AWS SSO users.

A detailed usage is shown below:

Unified Identity Page Usage

Details Page

If a row holds a single identity, its name links directly to that object's own details page (see Object Detail Pages). If the identity is merged from more than one account, the unified identity details page opens. It lists the merged identities, shows the exposure point and the risk score, and displays a combined list of the issues.

Unified Identity Details Page

Merged Identities

This section shows one card per merged identity, with the provider, the object type, a tier label, risk score and exposure point. Select a card to open that object's details page.

Merged Identities

Identity Issues

The identity issues section lists all issues associated with the merged identities. When the issues come from more than one provider, use the filter on the right to filter the table by provider.

Identity Issues List

Filtered Identity Issues List

Object Detail Pages

Every object type has its own details page, documented in the type pages of this section. Most of them share the same layout:

• Header: The object name with its Risk and Exposure Point.

• Information: The main card. Its tabs (for example Details, Groups (4)) show the attributes and relationships of the object. Relationship tabs show the number of rows in their label. Badges on the right of the card title classify the object, for example Privileged, Enabled, Inactive or its tier (Tier0/Tier2 for Active Directory objects, Tier 0/Tier 2 for cloud objects). An object that can compromise admin objects through at least one attack path also carries a red Shadow badge.

• Issues: The issues found on the object, with severity, categories and an Export button. Some types have no Issues panel.

Next to the Information title is the Graph » button, which opens the object in the Graph. For a shadow admin, users with the ReadVisualize permission see Admin Path » instead. It opens the shortest path from the object to admin objects, and its dropdown offers Open in Graph for the ordinary graph view.

Merge Rules