Open Unified Identities › Human Identities, filter Providers to Entra ID › User, then select a row to open its details.
Users
User Details
Opening a user shows the Risk and Exposure Point in the header, and the page contains the Information and Issues panes.
You can analyze the object in the Graph by clicking the Graph » button next to the Information title. For a shadow admin the button reads Admin Path » and opens the shortest path to admin objects (see Object Detail Pages).
User Details
Information
Information Pane can contain different badges to highlight important attributes.
| Badge | Description |
|---|---|
| Shadow | Indicates that the object can compromise admin objects with at least one attack path. |
| Privileged | Indicates that the object is Privileged. |
| ARM Privileged | Indicates that the identity has at least one privileged Azure Resource Manager role assignment at resource group scope or higher. |
| Enabled | Indicates that the object is enabled. |
| Disabled | Indicates that the object is disabled. |
| SSPR Capable | Indicates that the user has enough registered methods to reset their own password. |
| MFA Capable | Indicates that the user has a registered method that can be used for multifactor authentication. |
| Tier 0 / Tier 2 | Indicates the tier of the object. |
Information Pane contains Details, MFA Methods, Groups, Roles, ARM Roles, Administrative Units and Policies. Each tab except Details carries the number of rows it holds in its label.
Details
Details tab contains attributes below about user object.
| Attribute | Description |
|---|---|
| Name | The user’s primary email address or User Principal Name (UPN), used to log into Azure services. |
| First Name | The given name of the user as entered in their profile. |
| Last Name | The surname of the user as stored in their profile. |
| DisplayName | The full name of the user, commonly displayed in emails and directory listings. |
| The user’s alternate or contact email address; may be empty if not configured. | |
| User Principal Name | The unique sign-in name assigned to the user, typically in email address format. |
| Title | The user’s job title or role, often used in organizational directories; blank if not set. |
| User Type | Whether the account is a Member of the tenant or a Guest. |
| Usage Location | The country the user is assigned to for service licensing. |
| Tenant | The Entra ID tenant the user belongs to, linking to its Tenant page. |
| On Prem Sync Enabled | Shows if the user account is synchronized from an on-premises Active Directory. |
| On Prem SID | The user’s security identifier (SID) from the on-premises Active Directory. |
| On Prem Last Sync DateTime | The last date and time the user’s on-premises account was synced to Entra ID. |
| LastSignInDateTime | The most recent date and time the user signed in; blank if no sign-ins have occurred. |
| Last Successful Sign-In | The most recent interactive sign-in that succeeded. An account whose last successful sign-in is far in the past is a candidate for removal. |
| Last Non-Interactive Sign-In | The most recent sign-in performed by a client on the user’s behalf, without the user being present. An account can look dormant by interactive sign-in alone while a token is still being refreshed for it. |
| Enabled | Indicates whether the user account is currently active and allowed to sign in. |
| When Created | The date the account was created. |
| Password Last Set | Shows the last time the user changed or was assigned a new password. |
| When Deleted | The date the account was soft-deleted, if it was. |
| Password Policies | The password policies applied to the user, for example whether the password is set never to expire. |
| SSPR Enabled | Whether self-service password reset is enabled for the user. |
| SSPR Registered | Whether the user has completed self-service password reset registration. |
| SSPR Capable | Whether the user has enough registered methods to actually reset their own password. |
| Passwordless Capable | Whether the user has a registered method that allows signing in without a password. |
| MFA Registered | Whether the user has registered at least one multifactor authentication method. |
| MFA Methods Registered | The methods the user has registered, for example mobilePhone or softwareOneTimePasscode. |
| MFA Capable | Whether the user has a registered method that can actually be used for multifactor authentication. |
MFA Methods
MFA Methods tab lists the multifactor authentication methods the user has registered, for example Phone or Authenticator app (time-based code). An account with no registered method cannot satisfy a policy that demands multifactor authentication, which is what CAP Audit reports as a user without MFA.
Groups
Groups tab contains a list of groups that the user is a member of. This list also contains Enabled and On Prem Sync Enabled columns to identify the privilege levels of these groups.
Groups
Roles
Roles tab contains a list of the Entra ID roles assigned to the user. This list also contains Enabled, Built In and Assigned columns.
Roles
ARM Roles
ARM Roles tab contains a list of the Azure Resource Manager role assignments the user holds, so directory roles and resource-plane permissions can be reviewed on the same page.
Administrative Units
Administrative Units tab contains a list of the administrative units the user is a member of, with Display Name, Member Management Restricted and Visibility columns.
Administrative Units
Policies
Policies tab lists the Conditional Access policies that currently apply to the user.
Name: The policy the row is about, linking to its Conditional Access Policy page.
State: Whether the policy is Enabled, Disabled or Report-only. A policy in report-only mode appears here but does not enforce anything, so a user can be covered on paper and unprotected in practice.
Issues
Issues pane contains identified issues on the user object.
Issues