| AccountId |
An identifier for the account as found by Microsoft Cloud App Security. Could be Microsoft Entra ID, user principal name, or other identifiers. |
String |
| AccountStatus |
Current status of the account |
String |
| AccountUpn |
User principal name (UPN) of the account |
String |
| AdditionalFields |
Additional information about the entity or event |
Object |
| Address |
Address of the account user |
String |
| AssignedRoles |
Active roles assigned to the account |
Object |
| AuthenticationMethod |
Authentication method used by the account |
String |
| AuthenticationSourceAccountId |
Account identifier in the authentication source system |
String |
| City |
City where the client IP address is geolocated |
String |
| Country |
Country/Region where the account user is located |
String |
| CreatedDateTime |
Date and time when the account user was created |
DateTime |
| CriticalityLevel |
The criticality score of each account |
Int32 |
| DeletedDateTime |
The date and time the user was deleted |
DateTime |
| Department |
Name of the department that the account user belongs to |
String |
| DisplayName |
Name of the account user displayed in the address book. Typically a combination of a given or first name, a middle initial, and a last name or surname. |
String |
| EligibleRoles |
Roles that the account is eligible to activate |
Object |
| EmailAddress |
SMTP address of the account |
String |
| EmployeeId |
The employee identifier assigned to the user by the organization |
String |
| EnrolledMfas |
Multi-factor authentication methods enrolled for the account |
Object |
| GivenName |
Given name or first name of the account user |
String |
| GroupMembership |
Account’s group membership description |
Object |
| IdentityId |
Unique identifier for the identity |
String |
| IdentityLinkBy |
Identifier of the entity that linked the identity to the account |
String |
| IdentityLinkReason |
Reason for the linkage between the identity and account |
String |
| IdentityLinkTime |
Date and time when the identity was linked to the account |
DateTime |
| IdentityLinkType |
Type of linkage between the identity and account |
String |
| IsPrimary |
Indicates if this account is considered as primary account for the linked identity |
Boolean |
| JobTitle |
Job title of the account user |
String |
| LastPasswordChangeTime |
Date and time when the account password was last changed |
DateTime |
| Manager |
Manager of the account user |
String |
| Phone |
Phone number of the account user |
String |
| ReportId |
Unique identifier for the event |
String |
| Sid |
Security Identifier (SID) of the account |
String |
| SourceProvider |
The primary Identity provider of the account user |
String |
| SourceProviderAccountId |
Unique identifier for the source provider of the account |
String |
| SourceProviderInstanceDisplayName |
Display name of the source provider instance |
String |
| SourceProviderInstanceId |
Unique identifier for the instance of the source provider |
String |
| SourceProviderRiskLevel |
Risk level of the account as it appears in the source provider; possible values: Low, Medium, High |
String |
| SourceProviderRiskLevelDetails |
Details regarding the risk level as they appear in the source provider |
String |
| SourceSystem |
|
String |
| Surname |
Surname, family name, or last name of the account user |
String |
| Tags |
Labels representing various attributes used to identify or categorize a security configuration |
Object |
| TenantId |
|
String |
| TenantMembershipType |
The Entra Id user type. The possible values are: guest and member |
String |
| TimeGenerated |
|
DateTime |
| Timestamp |
Date and time when the record was generated |
DateTime |
| Type |
The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other |
String |