| Element | Description |
|---|---|
| User | The user's display name and their corresponding email or username |
| Trust Level | The user's current Trust Level |
| Checks | The total number of checks a user is failing. A 🚫 icon in this column indicates that the corresponding user is not part of the protected population and checks are not being evaluated against this user |
| # IPs | The total number of IP addresses associated with a user's activity across all providers |
| # Logins | The total number of attempted logins across all providers, regardless of result (success, failure, challenge, other) |
| Last Seen (UTC) | The date and time of the last login attempt, regardless of outcome, for a user across all providers |
| Last IP Address | The IP address associated with the last successful or failed login attempt for a user across all providers Read more below about how to pivot on the last IP address |
| Last Location | The location associated with the last successful or failed login attempt for a user across all providers |
| MFA |  = MFA configured = MFA not configured |
| Providers | The logo icon(s) for the corresponding identity data sources where a user's account has been associated
|
| Status | The user's Identity Intelligence Status and Lifecycle Event tag, if applicable. Lifecycle events highlight recent, notable events that have occurred on a user's account that can be beneficial to know about during an investigation. Lifecycle event badges are displayed for 7 days after the event is noted Status - Active (green badge): This account is enabled in an identity data source and has successfully logged in over the last X days. The number of days is consistent with the value set on the Inactive Users and Inactive Guest Users checks (default setting is 30 days) - Inactive (Grey badge): This account is enabled in an identity data source, but has not successfully logged in over the last X days. The number of days is consistent with the value set on the Inactive Users and Inactive Guest Users checks. (default setting is 30 days) - Deprovisioned (Grey badge): This account is no longer enabled in an identity data source and cannot be signed into - Inconsistent (red badge): This account has been flagged because there are account status discrepancies that may pose a significant security threat. See Inconsistent Users to learn about what factors contribute to a user being marked as inconsistent Lifecycle Events (yellow badge) - New Account: indicates that this account was recently created. Includes the date the account was created Significant Change: indicates that an uncommon, but important, activity has recently happened on this account (for ex: MFA factor added, admin privileges granted, sensitive app assigned, etc). You can query for specific Significant change events using Advanced Query mode |
| Compiled Status | Compiled status combines provider user types (ie: internal, external, service accounts, etc) and the user's Identity Intelligence Status |
| Element | Description |
|---|---|
| Created Date (UTC) | The date a user's account was created. Uses the first creation date available across all configured providers |
| Employee ID | The employee ID, gathered from the provider if available |
| Manager Login | The user's manager's email address, gathered from the provider if available |
| Title | The user's job title, gathered from the provider(s) if available |
| Department | The department a user belongs to, gathered from the provider(s) if available |
| Registered Location | The location a user is supposed to be working from based on hiring agreements, if available from the HRIS or the IdP. If the user has multiple registered locations that differ, the HRIS data always takes precedence. If HR information is not available for a user, then the data comes from the IdP |
| Inconsistency Severity | The severity of the inconsistency noted for a user with Inconsistent status |
| User Type | The Identity Intelligence user type assigned based on compiled identity data source user types |
{% endtab %}
{% endtabs %}
### Filters
The Users table is filterable by a number of attributes, enabling you to slice and dice your user population based on the parameters that are important to you.
There are two types of filters that can be used on the Users table - [basic filters](#applying-basic-filters), which can be found to the left of the Users table and [Advanced Query mode](https://docs.oort.io/understanding-your-users/users/advanced-query-mode), which can be enabled via the search bar above the users table. Check out our documentation on to [how to use Advanced Query Mode](https://docs.oort.io/understanding-your-users/advanced-query-mode#entering-advanced-mode-and-adding-filters) to learn more.
Filtered results derived from both basic filters, as well as advanced queries, can be saved to access later or share with teammates. To learn more about how to save filters, see [Saved Filters](https://docs.oort.io/understanding-your-users/users/saved-filters) to learn more.
#### Applying basic filters
You can see all the available basic filters on the left hand side of the Users page.
To enable a filter, select the check box for the attribute you would like to filter by. The applied filters will be added to the search bar, as seen in the screenshot below. The number of users that you are currently viewing, based on the filters and searches used, will appear in the top left corner of the Users table above the column headers.
To remove a filter, you can either deselect the attribute from the filters list on left hand side of the Users table, or select the **X** on the right hand side of the filter box that is in the search bar. To remove all filters besides the default filter, select the **X** located next to the **Advanced** Filter button in the search bar.
After you have selected your filters, the filters are retained as you navigate between different areas within the platform.
