---
title: Users
description: Every identity in the tenant - employees, guests, and the accounts nobody has signed into for a year - with what each one can reach, what it did, and whether it should still exist.
icon: Users
---

# Users

The Users screen answers the question the rest of the platform is built around, from the identity's side: **"What can this person reach, and what have they actually done with it?"** Files, sites and groups describe the estate. Users describe who is standing in it.

## What You Can Achieve

<Cards>
  <Card
    title="Answer 'what can this person reach?'"
    description="Every file, site, group and app one account can open - direct grants, group inheritance, sharing links and all. The question an auditor asks about a named employee, answered in one row."
  />
  <Card
    title="Find guests nobody remembers inviting"
    description="External accounts split into Entra guests and SharePoint-only guests - the second kind never appears in your directory reports at all."
  />
  <Card
    title="Catch dormant accounts holding access"
    description="Accounts with no sign-in and no activity for months, still carrying licenses, group memberships and reach into sensitive data."
  />
  <Card
    title="Investigate before you offboard"
    description="See what a departing employee touched, what they still hold, and what breaks if you cut it - then run the offboarding automation from the same screen."
  />
</Cards>

## Internal, external, and the guests you can't see

Not every identity with access is an employee, and not every external identity is in your directory:

- **Internal** - accounts in your own tenant, licensed or not.
- **Entra guests** - external identities properly invited into the directory, visible in Microsoft's own reports.
- **SharePoint-only guests** - external people who got access through a sharing link or a site permission without ever becoming a directory object. They hold real access and are invisible to directory-based reviews - which is exactly why they accumulate.

Filter by any of these, and combine them with sensitivity and sharing filters to ask sharper questions: _external users who can reach files containing sensitive information_ is two clicks.

## Reading the list

Each row carries the identity's whole footprint, so you rarely need to open a drawer to triage:

| Column group | What it tells you |
| :--- | :--- |
| **Reach** | Groups, files and apps the account can reach - the size of what one compromised credential would open |
| **Sensitive exposure** | Sensitive information and labelled files within reach, plus the sharing links this user created |
| **Activity** | Last activity, last sign-in, an activity trend line, emails sent and received with their last timestamps |
| **Account state** | Account enabled, sign-in disabled, MFA registration, creation date, license assignment |
| **Risk** | Security alerts associated with the identity |

Sort by any of them. _Files reachable_ descending is the fastest way to find the accounts worth reviewing first; _last sign-in_ ascending is the fastest way to find the ones that should not exist.

## Common investigations

- **Offboarding audit** - filter to a user, review reach and activity, then use [Automations](/en/docs/screens/automations) to revoke access, expire the links they created, and reclaim the [license](/en/docs/screens/licenses).
- **Dormant with access** - no sign-in for a year, still holding licenses and group memberships. Both a cost line and an attack path, see [Activities](/en/docs/screens/activities).
- **External exposure review** - external users, filtered to those who can reach sensitive information - the report most access reviews are supposed to produce and rarely can.
- **MFA gaps on privileged reach** - accounts with wide reach and no registered MFA method.
- **Incident scoping** - start from the account named in an alert and read its activity, devices and locations from the [Activity Logs](/en/docs/screens/activity-logs).

<Callout type="info">
  Every user links straight into the [permission
  graph](/en/docs/permission-graph) - click through from a row to see *why* the
  access exists, path by path, rather than only that it does.
</Callout>