The Identities page of Identity Threat Detection & Response (ITDR) provides a complete inventory of all user accounts, API tokens, and OAuth credentials discovered across your connected identity sources. It gives you visibility into each identity's risk score, group memberships, activity history, and associated alerts, helping you understand your identity attack surface at a glance.
Human Identities - Users
The Human tab on the Identities page lists all accounts synced from your connected identity providers. Each row displays:
| Column | Description |
|---|---|
| Account status | Displays if the account is active, or only enabled for one of two IdP's. If the identity is disabled in both Entra ID and Okta, it needs to be manually re-enabled from there. |
| Alerts | Number of alerts associated with the identity. |
| Dark web exposure | Displays if the identity is determined to have been exposed in password and data breaches. |
| Dark web monitoring | Displays whether the identity is being monitored or not for password and data breaches. |
| Identity | Email address of the user. |
| Last alert triggered | Time the last alert was triggered. |
| Login restriction | Displays the name of the login restriction group set in Configurations > Login restriction. This group defines allowed countries and login hours. |
| MFA protection | Displays if multi-factor authentication is fully enabled, only enabled for one of two IdP's, or completely disabled. |
| Risk score & Posture | Indicates whether the identity is included or excluded from risk score calculations and security posture checks. |
| Protection enabled | Displays whether the identity is being monitored with ITDR. Each identity with Protection enabled is counted towards your subscription usage. You can free up a license by disabling the toggle for protection, then enable protection as needed for other identities. |
| Source | Displays the IdP's the identity is connected to. |
| Tag | Contextual metadata label added to the identity. Hover over a tag to reveal the X to remove it from this identity. |
| User type | Type of user: admin or member. |
Human Identity Detail View
Click on any human identity to open a detailed profile. The identity detail view includes:
- Okta/Entra ID Identity: Displays the user's information and statuses as gathered from the IdP.
- Endpoint: When possible to correlate the identity to an endpoint, this displays the OS type, machine IP, OS platform, and machine ID.
- Dark web monitoring: When an identity is exposed, this shows leaked data such as email address, compromised computer, and domains using the compromised email. This information is not actionable from the ITDR page.
Non-human Identities -API Tokens, OAuth Credentials, Service Accounts
The Non-human tab on the Identities page surfaces the alerts on your API Tokens, OAuth Credentials, and Service accounts in your environment. These do not count towards your license usage. Each row displays:
| Column | Description |
|---|---|
| Account status | Displays if the account is active, or only enabled for one of two IdP's. If the identity is disabled in both Entra ID and Okta, it needs to be manually re-enabled from there. |
| Age | How old the API or OAuth credential is. |
| Alerts | Number of alerts associated with the identity. |
| Identity | Name of the API Token, OAuth credential, or service account. |
| Last used | Time the non-human identity was last used. |
| Last alert triggered | Time the last alert was triggered. |
| Owner | User who created the non-human identity. |
| Protection enabled | Displays whether the identity is being monitored with ITDR. Non-human identities do not count towards subscription usage. |
| Risk level |
Displays the security risk this non-human identity poses to your environment.
|
| Service type | API, OAuth credential, or service user. |
| Source | Displays the IdP's the identity is connected to. |
| Tag | Contextual metadata label added to the identity. Hover over a tag to reveal the X to remove it from this identity. |
Non-human Identity Detail View
Click on any non-human identity to open a detailed profile.
Non-human Entra ID Details
The detail view for an Entra ID non-human identity includes the following:
- Name: The display name of the application.
- Application ID: The unique application (client) identifier.
- Object ID: The unique object identifier in the directory.
- Enabled for users to sign in: Indicates whether users are allowed to sign in to the application.
- Administrative roles: The administrative roles assigned to the identity. A Privileged indicator appears when any assigned role is considered privileged.
- Conditional Access: The Conditional Access policies that apply to this identity, each showing its policy name, who created it, and its state.
- Permissions: The API permissions granted to the application, each showing the claim value, permission, type, granted through, and granted by.
Non-human Okta Details
The detail view for an Okta non-human identity includes the following:
- Client ID: The unique client identifier for the application
- Creation date: The date the application was created
- App integration name: The name of the app integration
- Application type: The type of application
- Application notes for admins: Administrative notes recorded for the application
- Token can be used from: The IPs/Networks from which the token can be used
- Consent: The consent scopes granted to the application. Only granted consents are shown, when present.
Response Actions
Response actions can be taken directly from the Identities page. Response actions can be started directly from the Identities page. If ITDR is linked to both Entra ID and Okta, you can choose the identity provider(s) for the action. Available actions depend on which tab (Human or Non-human) you're on. See the table below.
| Action | Human Identities tab | Non-human identities tab | Description |
|---|---|---|---|
| Tag identities | ✓ | ✓ |
Add up to 5 labels per identity to organize and categorize them. Tags are searchable and filterable across the Identity page. Select an existing tag from the dropdown, or type a new name and click Create. To delete a tag and remove it from all associated identities, click the trash icon next to it in the dropdown. |
| Disable user | ✓ | ✓ | Suspends the account so the user cannot sign in. The user is removed from ITDR pages and must be re-enabled through your IdP, not through Nebula. Add a note so other admins know why the account was disabled. On the non-human identities tab, only available for service accounts. |
| Force change password | ✓ | ✓ | Requires the user to set a new password at their next sign-in. On the non-human identities tab, only available for service accounts. |
| Exclude identity | ✓ | X |
Suppress alerts and remove the identity from Identity Risk Score calculations and Posture Management checks. Requires a duration (30 days, 60 days, permanent, or custom date) and a reason. This is generally used for shared mailboxes or accounts where MFA or password resets are not enforced. |
| Remove from exclusion | ✓ | X | Removes the exclusion rule for the selected identities, restoring them to Identity Risk Score and Posture Management checks. |
| Add to dark web monitoring | ✓ | X | Monitor the identity for password and data breaches. |
| Remove from dark web monitoring | ✓ | X | Stop monitoring the identity for password and data breaches. |
| Remove user from the group (Entra) | ✓ | X | Removes the selected users from an Entra group, revoking access and permissions granted by that group. If a malicious actor has access to a privileged account, remove that user from the group granting them privileged access to revoke the permissions. |
| Enforce 2FA | ✓ | X | Forces the user to set up two-factor authentication (2FA) at their next login. We recommended enforcing 2FA for all users. |
| Revoke user session | ✓ | X | Terminates all active sessions for the account and requires them to log in again from each device. After resetting a password, use this option to lock malicious actors out of accounts. |
| Revoke token | X | ✓ | Invalidates the authorization token and immediately stops all integrations using it. |
| Revoke API | X | ✓ | Invalidates the API key and immediately stops all integrations using it. |
Back to ITDR Guide