Investigating users
Use the Identity pages to find risky Microsoft 365 users, read their issues and drill into live sign-in detail.
Updated
On this page
Identity shows the people in each customer's Microsoft 365 tenant. It's for your MSP team only. RevoSecure reads each connected tenant once a day (and on Sync now, up to six times an hour) into one record per user, and works out each user's issues, most serious first.
Across customers
In the portfolio, Identity shows the most common issues and People needing attention: users with a critical or high issue, worst first, with their customer. Click one to open them in their customer's workspace.
In a customer
| Tab | What's there |
|---|---|
| Overview | Users at risk, administrators, Secure Score, What needs fixing, sign-in strength, sign-in policies, licences, threats and mail (risky users, external forwarding, shared mailboxes that can sign in), account hygiene, dark web exposure |
| Users | Everyone, with search, filters by issue, quick views (members, administrators, guests, shared mailboxes), sign-in strength, dark web status; sorted by risk. CSV exports the filtered list |
| Admins | Directory roles and their members, including people holding a role through a role-assignable group (shown via the group), and break-glass accounts |
| Licences | Subscriptions with purchased, assigned and available counts, and licences held by disabled or unused accounts |
| Policies | Conditional Access, authentication methods, security defaults, consent and guest settings, SharePoint and OneDrive sharing, each with a plain-language assessment |
| Secure Score | See Microsoft Secure Score |
Investigate one person
- Open the customer's Identity → Users, click a name anywhere in Identity, or find them with ⌘K.
- Narrow the list: an issue (for example Forwards mail outside the organisation), Administrators, or a sign-in strength tier.
- Open the user. What's wrong lists their issues with the fix for each. Issues for a control left out of the customer's ideal state are marked Outside ideal state and don't count.
- Read the stored facts: MFA and sign-in methods, roles, licences, mailbox type and external forwarding rules, risk state, and related alerts and open Microsoft 365 findings.
- For live detail open Recent sign-ins (last 50; needs Entra ID P1), authentication methods, Devices and Groups. These are read from Microsoft when you open them and cached for two minutes; the refresh button reads them again.
Phone numbers and email addresses used as sign-in methods are masked.
Typical issues
| Issue | Why it matters |
|---|---|
| No MFA method registered | One password away from takeover |
| Administrator relies on text or call MFA | Phone methods can be intercepted or SIM-swapped |
| Excluded from an MFA policy | Conditional Access doesn't protect this account |
| Forwards mail outside the organisation | A common sign of a compromised mailbox |
| Guest with an admin role | An outside account controls the tenant |
| Disabled but still licensed | Licence waste |
| Mailbox found in breach data | The address appeared in breach data; check the password changed since |
Break-glass accounts
Emergency access accounts are deliberately excluded from Conditional Access and rarely used. Name them in Identity → Admins → Break-glass accounts so RevoSecure doesn't raise Conditional Access exclusion or inactivity issues for them.
Dark web exposure
The user list has a Dark web column and filter (In breach data, None found, Partial when the latest lookup failed, Not checked). A user's page lists each source and how far it covers the mailbox. A clean result means "none found in the sources checked". See Dark web and exposure checks.
Users who leave
Users who disappear from the tenant are marked deleted and kept for 90 days. A cut-short user list never marks anyone deleted.