Users
Open Unified Identities › Human Identities, filter Providers to Entra ID › User, then select a row to open its details.
User Details
Opening a user shows the Risk and Exposure Point in the header, and the page contains the Information and Issues panes.
Information
Information Pane can contain different badges to highlight important attributes.
Shadow
Indicates that the object can compromise admin objects with at least one attack path.
Privileged
Indicates that the object is Privileged.
ARM Privileged
Indicates that the identity has at least one privileged Azure Resource Manager role assignment at resource group scope or higher.
Enabled
Indicates that the object is enabled.
Disabled
Indicates that the object is disabled.
SSPR Capable
Indicates that the user has enough registered methods to reset their own password.
MFA Capable
Indicates that the user has a registered method that can be used for multifactor authentication.
Tier 0 / Tier 2
Indicates the tier of the object.
Information Pane contains Details, MFA Methods, Groups, Roles, ARM Roles, Administrative Units and Policies. Each tab except Details carries the number of rows it holds in its label.
Details
Details tab contains attributes below about user object.
Name
The user's primary email address or User Principal Name (UPN), used to log into Azure services.
First Name
The given name of the user as entered in their profile.
Last Name
The surname of the user as stored in their profile.
DisplayName
The full name of the user, commonly displayed in emails and directory listings.
The user's alternate or contact email address; may be empty if not configured.
User Principal Name
The unique sign-in name assigned to the user, typically in email address format.
Title
The user’s job title or role, often used in organizational directories; blank if not set.
User Type
Whether the account is a Member of the tenant or a Guest.
Usage Location
The country the user is assigned to for service licensing.
Tenant
The Entra ID tenant the user belongs to, linking to its Tenant page.
On Prem Sync Enabled
Shows if the user account is synchronized from an on-premises Active Directory.
On Prem SID
The user’s security identifier (SID) from the on-premises Active Directory.
On Prem Last Sync DateTime
The last date and time the user's on-premises account was synced to Entra ID.
LastSignInDateTime
The most recent date and time the user signed in; blank if no sign-ins have occurred.
Last Successful Sign-In
The most recent interactive sign-in that succeeded. An account whose last successful sign-in is far in the past is a candidate for removal.
Last Non-Interactive Sign-In
The most recent sign-in performed by a client on the user's behalf, without the user being present. An account can look dormant by interactive sign-in alone while a token is still being refreshed for it.
Enabled
Indicates whether the user account is currently active and allowed to sign in.
When Created
The date the account was created.
Password Last Set
Shows the last time the user changed or was assigned a new password.
When Deleted
The date the account was soft-deleted, if it was.
Password Policies
The password policies applied to the user, for example whether the password is set never to expire.
SSPR Enabled
Whether self-service password reset is enabled for the user.
SSPR Registered
Whether the user has completed self-service password reset registration.
SSPR Capable
Whether the user has enough registered methods to actually reset their own password.
Passwordless Capable
Whether the user has a registered method that allows signing in without a password.
MFA Registered
Whether the user has registered at least one multifactor authentication method.
MFA Methods Registered
The methods the user has registered, for example mobilePhone or softwareOneTimePasscode.
MFA Capable
Whether the user has a registered method that can actually be used for multifactor authentication.
MFA Methods
MFA Methods tab lists the multifactor authentication methods the user has registered, for example Phone or Authenticator app (time-based code). An account with no registered method cannot satisfy a policy that demands multifactor authentication, which is what CAP Audit reports as a user without MFA.
Groups
Groups tab contains a list of groups that the user is a member of. This list also contains Enabled and On Prem Sync Enabled columns to identify the privilege levels of these groups.
Roles
Roles tab contains a list of the Entra ID roles assigned to the user. This list also contains Enabled, Built In and Assigned columns.
ARM Roles
ARM Roles tab contains a list of the Azure Resource Manager role assignments the user holds, so directory roles and resource-plane permissions can be reviewed on the same page.
Administrative Units
Administrative Units tab contains a list of the administrative units the user is a member of, with Display Name, Member Management Restricted and Visibility columns.
Policies
Policies tab lists the Conditional Access policies that currently apply to the user.
Name: The policy the row is about, linking to its Conditional Access Policy page.
State: Whether the policy is Enabled, Disabled or Report-only. A policy in report-only mode appears here but does not enforce anything, so a user can be covered on paper and unprotected in practice.
Issues
Issues pane contains identified issues on the user object.
Last updated
Was this helpful?