> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# User Inventory

> Every person who touches a device or an account, correlated across your identity, MDM, and EDR sources

<Info>
  **Tier:** User Inventory is included in the **Protect** tier. Customers on Connect or Discover see device inventory only — talk to your account team about upgrading if you need user-side visibility.
</Info>

## Overview

The **User Inventory** at `/user-inventory` is the people-side mirror of [Devices](/device-management). Where Devices answers *"what hardware do we have?"*, User Inventory answers *"who is using it, and what apps do they touch?"*.

Users are pulled from your identity sources (Microsoft Entra ID, Okta, Google Workspace, on-prem AD), enriched with HR-style attributes (department, job title, manager), and correlated against the devices and cloud apps each person uses.

## Columns

The grid is organised into four column groups:

| Group                | Default columns                                                                    |
| -------------------- | ---------------------------------------------------------------------------------- |
| **User Details**     | Name, Email, Job Title, Department, Tags                                           |
| **Sign In Activity** | Last Successful Time, Last Successful Location                                     |
| **User Devices**     | Recent Devices                                                                     |
| **User Accounts**    | Per-integration sign-in presence (e.g. Microsoft 365, Duo, Microsoft Defender ATP) |

Email is the matching key used to correlate users across every integration. Tags come from the [Logic Engine](/tags-and-logic-engine).

Click any column header's sort icon to sort. The same [query language](/reference/query-syntax) used in Devices works here, scoped to user fields.

## Drilling into a user

Click a row to open the user detail panel. It shows:

* **Profile**: avatar, name, email, department, job title, accounts (Microsoft 365, OnPrem AD, Duo, etc.)
* **Recent Devices**: every device this user has signed into, with last-seen times — useful for joiner-mover-leaver flows
* **Activity timeline**: when this user last appeared in each integration
* **Tags**: user-level tags from the Logic Engine

This is the data view that powers offboarding workflows — "show me every device and app touched by user X" — and supports [Access Control](/access-control) reviews.

## Filtering the user list

User Inventory uses the same [query grammar](/query-language) (`field:value`, `AND` / `OR` / `NOT`) as Devices, but with user-specific fields. The exact field set is best discovered via the search bar's autocomplete — click the search input and type a few characters to see available fields with descriptions.

Common patterns:

* Filter by tag: `tags:Phishing-Campaign-Q2`
* Filter by department or job title via the user-detail fields exposed in autocomplete
* Negate to find exceptions: `NOT tags:Stock`

## Use cases

<CardGroup cols={2}>
  <Card title="Offboarding audit" icon="user-minus">
    Quarterly: find users with stale last-seen times and at least one associated device. Validate against HR records.
  </Card>

  <Card title="VIP coverage check" icon="user-shield">
    Tag executives via Logic Engine, then verify every VIP device meets your strictest security baseline.
  </Card>

  <Card title="License reclaim" icon="recycle">
    Cross-reference users who haven't logged in recently with software licenses to identify reclaim candidates.
  </Card>

  <Card title="Phishing follow-up" icon="fish">
    Tag users who clicked a phishing link, then build a follow-up Action checking device-level vitals.
  </Card>
</CardGroup>

## How user matching works

Protect matches a user across tools using **email (the `mail` property)** as the primary key — *not* UPN, which can differ.

The same matching strategy is used for [SSO user enablement](/access-control#single-sign-on). If your IdP doesn't populate the `mail` attribute, see [Troubleshooting](/reference/troubleshooting#user-matching).

## Cross-references

<CardGroup cols={3}>
  <Card title="Device Management" icon="laptop" href="/device-management">
    Pivot users → devices
  </Card>

  <Card title="Tags & Logic Engine" icon="tag" href="/tags-and-logic-engine">
    Apply user tags via rules
  </Card>

  <Card title="Access Control" icon="users-gear" href="/access-control">
    Manage Protect users themselves (separate from end-user inventory)
  </Card>
</CardGroup>

<Info>
  **Two kinds of "users":** This page documents the **end-user inventory** — every person in your organisation pulled from identity providers. To manage **Protect platform users** (people who log into the Protect console itself), see [Access Control](/access-control) and [Settings → Users](/settings/users).
</Info>