Overview

The Users tab gives a risk-based view of every user account in your client's Microsoft 365 tenant. Each user gets a risk score based on their security posture, so you can quickly find and prioritize high-risk accounts.

How It Works

Summary cards

Four summary cards at the top give an instant overview:

• Total Mailboxes — number of mailboxes in the tenant
• Licensed Users — number of users with active licenses
• MFA Not Enabled — users without multi-factor authentication (shown as a fraction of the total)
• Inactive — users who haven't signed in within a configurable number of days (default: 30)

User table

The table lists every user with these columns:

• Type — Member or Guest
• Account Enabled — whether the account is active
• Risk Score — numeric score (0–100) based on combined risk factors
• Risk Level — High, Medium, or Low
• Risk Factors — specific issues (e.g., "MFA not enabled", "No license assigned", "Guest account")
• Countries — countries associated with sign-in activity
• Location Anomalies — unusual sign-in locations detected
• Risk Detections — Identity Protection risk detections
• Risk Types — categories of detected risks
• Last Sign-in — when the user last authenticated

You can search for specific users, change the number of results per page, and export the full list as a CSV.

User detail panel

Click a user to open a side panel with a full breakdown of their security posture:

• Status badges — Account Enabled, MFA Enabled, Privileged User, Risk level
• Risk Score — visual score bar (0–100) with context (e.g., "Privileged user")
• Basic Information — user type, department, job title, license status
• Sign-in Activity — last sign-in, password changed, total sign-ins, failed sign-ins
• Device & Location Info — unique devices, IPs, countries, CA blocks
• Security Status — MFA registered, privileged status, risk detections
• Assigned Licenses — licenses assigned to the user

Best Practices

• Start with users at a High risk level, then users counted under MFA Not Enabled.
• Review Guest accounts and Inactive users regularly; both appear as risk factors.

Related Articles

• License Info
• Conditional Access Policies
• App Registrations