> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/unified-identities/azure-identities/entra-id/users.md).
# Users
Open **Unified Identities › Human Identities**, filter **Providers** to **Entra ID › User**, then select a row to open its details.
Users
## User Details
Opening a user shows the `Risk` and `Exposure Point` in the header, and the page contains the `Information` and `Issues` panes.
{% hint style="info" %}
You can analyze the object in the [Graph](/forestall/visualize/visualize.md) by clicking the **Graph »** button next to the `Information` title. For a shadow admin the button reads **Admin Path »** and opens the shortest path to admin objects (see [Object Detail Pages](/forestall/unified-identities.md#object-detail-pages)).
{% endhint %}
User Details
## Information
`Information Pane` can contain different badges to highlight important attributes.
| Badge | Description |
| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| **Shadow** | Indicates that the object can compromise admin objects with at least one attack path. |
| **Privileged** | Indicates that the object is Privileged. |
| **ARM Privileged** | Indicates that the identity has at least one privileged Azure Resource Manager role assignment at resource group scope or higher. |
| **Enabled** | Indicates that the object is enabled. |
| **Disabled** | Indicates that the object is disabled. |
| **SSPR Capable** | Indicates that the user has enough registered methods to reset their own password. |
| **MFA Capable** | Indicates that the user has a registered method that can be used for multifactor authentication. |
| **Tier 0** / **Tier 2** | Indicates the tier of the object. |
`Information Pane` contains `Details`, `MFA Methods`, `Groups`, `Roles`, `ARM Roles`, `Administrative Units` and `Policies`. Each tab except `Details` carries the number of rows it holds in its label.
## Details
Details tab contains attributes below about user object.
| Attribute | Description |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name | The user's primary email address or User Principal Name (UPN), used to log into Azure services. |
| First Name | The given name of the user as entered in their profile. |
| Last Name | The surname of the user as stored in their profile. |
| DisplayName | The full name of the user, commonly displayed in emails and directory listings. |
| Email | The user's alternate or contact email address; may be empty if not configured. |
| User Principal Name | The unique sign-in name assigned to the user, typically in email address format. |
| Title | The user’s job title or role, often used in organizational directories; blank if not set. |
| User Type | Whether the account is a `Member` of the tenant or a `Guest`. |
| Usage Location | The country the user is assigned to for service licensing. |
| Tenant | The Entra ID tenant the user belongs to, linking to its [Tenant](/forestall/unified-identities/azure-identities/entra-id/tenants.md) page. |
| On Prem Sync Enabled | Shows if the user account is synchronized from an on-premises Active Directory. |
| On Prem SID | The user’s security identifier (SID) from the on-premises Active Directory. |
| On Prem Last Sync DateTime | The last date and time the user's on-premises account was synced to Entra ID. |
| LastSignInDateTime | The most recent date and time the user signed in; blank if no sign-ins have occurred. |
| Last Successful Sign-In | The most recent interactive sign-in that succeeded. An account whose last successful sign-in is far in the past is a candidate for removal. |
| Last Non-Interactive Sign-In | The most recent sign-in performed by a client on the user's behalf, without the user being present. An account can look dormant by interactive sign-in alone while a token is still being refreshed for it. |
| Enabled | Indicates whether the user account is currently active and allowed to sign in. |
| When Created | The date the account was created. |
| Password Last Set | Shows the last time the user changed or was assigned a new password. |
| When Deleted | The date the account was soft-deleted, if it was. |
| Password Policies | The password policies applied to the user, for example whether the password is set never to expire. |
| SSPR Enabled | Whether self-service password reset is enabled for the user. |
| SSPR Registered | Whether the user has completed self-service password reset registration. |
| SSPR Capable | Whether the user has enough registered methods to actually reset their own password. |
| Passwordless Capable | Whether the user has a registered method that allows signing in without a password. |
| MFA Registered | Whether the user has registered at least one multifactor authentication method. |
| MFA Methods Registered | The methods the user has registered, for example `mobilePhone` or `softwareOneTimePasscode`. |
| MFA Capable | Whether the user has a registered method that can actually be used for multifactor authentication. |
## MFA Methods
MFA Methods tab lists the multifactor authentication methods the user has registered, for example `Phone` or `Authenticator app (time-based code)`. An account with no registered method cannot satisfy a policy that demands multifactor authentication, which is what [CAP Audit](/forestall/cap-audit.md) reports as a user without MFA.
## Groups
Groups tab contains a list of groups that the user is a member of. This list also contains `Enabled` and `On Prem Sync Enabled` columns to identify the privilege levels of these groups.
Groups
## Roles
Roles tab contains a list of the Entra ID roles assigned to the user. This list also contains `Enabled`, `Built In` and `Assigned` columns.
Roles
## ARM Roles
ARM Roles tab contains a list of the Azure Resource Manager role assignments the user holds, so directory roles and resource-plane permissions can be reviewed on the same page.
## Administrative Units
Administrative Units tab contains a list of the administrative units the user is a member of, with `Display Name`, `Member Management Restricted` and `Visibility` columns.
Administrative Units
## Policies
Policies tab lists the Conditional Access policies that currently apply to the user.
**Name:** The policy the row is about, linking to its [Conditional Access Policy](/forestall/unified-identities/azure-identities/entra-id/conditional-access-policies.md) page.
**State:** Whether the policy is `Enabled`, `Disabled` or `Report-only`. A policy in report-only mode appears here but does not enforce anything, so a user can be covered on paper and unprotected in practice.
## Issues
Issues pane contains identified issues on the user object.
