Users

Open Unified Identities › Human Identities, filter Providers to GCP Identities › User, then select a row to open its details.

Users

Users Details

Opening a user shows the Risk and Exposure Point in the header, the Information card with the Details, Groups and Roles tabs, and an Issues panel when the user has issues.

You can analyze the object in the Graph by clicking the Graph » button next to the Information title. For a shadow admin the button reads Admin Path » and opens the shortest path to admin objects (see Object Detail Pages).

Users Details

Information

Information card can contain different badges to highlight important attributes.

Badge	Description
Tier 0 / Tier 2	The tier of the user.
Privileged	Indicates that the user is privileged.
Shadow	Indicates that the object can compromise admin objects with at least one attack path.

The Details tab contains attributes about the GCP User account retrieved from Google Workspace Directory. Several attributes show an info icon next to their name with a short explanation.

Attribute	Description
Name	The full email address used as the unique identifier for the user account.
Primary Email	The primary email address of the user.
Display Name	The display name of the user account.
Domain	The Google Workspace domain the user belongs to (e.g., labs.forestall.io).
Given Name	The first name of the user.
Last Name	The last name (family name) of the user.
Directory Customer	The Google Workspace customer of the user (e.g., labs.forestall.io); links to the customer details.
Id	The unique numeric identifier of the user account.
Aliases	Additional email aliases assigned to the user.
Non Editable Aliases	System-assigned aliases that cannot be modified (e.g., [e-mail]).
Emails	All email addresses associated with the user account.
Guest Account Email	The email address if the account is a guest account.
Relations	Relationships defined for the user in the directory.
Org Unit	The organizational unit the user belongs to (e.g., Developers); links to the organizational unit details, or shows the path if the OU was not enumerated.
Recovery Email	The recovery email address configured for the user account.
Kind	The type identifier of the directory resource (e.g., admin#directory#user).
Change Password At Next Login	Indicates whether the user is required to change their password on next login.
Suspended	Indicates whether the user account is currently suspended.
Suspension Reason	The reason provided for the account suspension, if applicable.
Is Admin	Indicates whether the user has super administrator privileges in Google Workspace.
Is Delegated Admin	Indicates whether the user has been granted delegated administrator privileges.
Is Enforced In 2Sv	Indicates whether two-step verification (2SV) is enforced for the user.
Is Enrolled In 2Sv	Indicates whether the user is enrolled in two-step verification (2SV).
Is Guest User	Indicates whether the account is classified as a guest user.
Ip Whitelisted	Indicates whether the user's access is restricted to specific whitelisted IP addresses.
Deletion Time	The timestamp when the user account was deleted, if applicable.
Last Login Time (Admin Console)	The most recent login time recorded for the user in the Admin Console.
Creation Time	The timestamp when the user account was created.

Groups

The Groups tab lists all parent groups above the current User. The Name column links to the group details.

Roles

The Roles tab lists all assigned roles to the current user. The Name column links to the role details.