Users | Axonius SaaS Management

The Axonius SaaS Management Users module provides insight into the users in your organization. Using the various graphs, tables, and filters, you'll be able to better understand:

• What applications your users are accessing
• How they are accessing the applications
• To what extent they are accessing SaaS applications NOT approved by the organization (shadow SaaS)
• Whether their SaaS accounts are paid or unpaid
• Which external users have access to your environment
• How to find and manage a service account
• Which devices are accessing coporate applications
• and more...

The SaaS Users Page

The SaaS Users page consists of three main sections:

The Filter section allows you to select filter values to define what data is displayed on the page including the graphs in the Overview section, search for a specific item to filter by, or configure an advanced filter to apply to the page.

The Overview section contains three visual displays of the SaaS application usage in your organization.

• The Users Count graph shows the number of users using each detected SaaS application.
  

• The Users in Managed Applications graph shows a breakdown of managed and unmanaged users for each of the managed applications in your organizations SaaS environment.
  

• The Applications by Usage graph shows the number of inactive users for each SaaS application.
  

You can click to hide the graphs in the Overview section. Click it again to display the graphs.

The bottom section of the page displays information on application use per user.

The Users View shows a per user breakdown of applications used by the user and allows you to expand a user record to show their details for each application.

The Detailed View is a static table with more details for each users' SaaS application usage.

Set Filters

You can filter your SaaS Management data according to any of the following available filters:

• Application - Filter for users of specific applications. Divided up between managed and unmanaged applications.
• Account - Select specific accounts in given applications.
• Tags: Discovery method - Filter for how a user was discovered.
• Tags: Account - Filter for operational, suspended, or deleted users.
• Tags: Shadow - Filter for specific types of shadow users.
• Tags: Attributes - Filter for user attributes.
• Admin permissions - Filter for users with or without admin permissions for a given application.
• Paid user - Filter for users who do or do not have paid accounts for a given application.
• Department - Filter users by their departments.
• Last login - Filter by users who last logged in to their applications within a selected date range.
• SSO last login - Filter by users who last logged in to their applications via SSO within a selected date range.

You can also use the Search bar to filter for specific values such as user names, email addresses, etc.

To reset the filters to their default settings, click Reset.

For information about the various values you can select for the filters, see User Filters.

Configure an Advanced Filter

The advanced filter gives you more options for saving a filter set. It provides access to more filters than the displayed filter drop-downs do. In addition, you can select operators such as OR, AND NOT, and OR NOT.

Some possible use cases for the advanced filter may include filtering for users associated with devices or filtering users from a specific email domain to remove auto-generated users or users with a specific level of access from the displayed data set.

To configure an advanced filter on user data

1. Click Advanced Filter.
2. From the Default filters drop-down, select AND for the advanced filter to apply alongside the other configured filters or select AND NOT for the advanced filter to apply instead of the other configured filters.
3. Select an operator (AND, OR, AND NOT, OR NOT) for the filter conditions.
4. Select a filter.
5. Select filter values.
6. To add more conditions, click Add condition.
7. To delete a condition click corresponding to the condition you want to delete.
   

Save a Filter Set

You can save a set of filters or an advanced filter to be applied to the Users page at later date. The description you enter is displayed as a tooltip next to the filter option.

To save a filter set

1. Once the filters are configured the way you want, click Save.

2. Enter a name and short description for the filter set you want to save.

3. Click Save.
   

4. (Optional) To update, delete, or save changes as a new filter set, click Actions and select the option you want.
   

5. (Optional) To undo any changes to the saved filter, click Reset.

6. (Optional) To clear all filters and return to the default settings, click Clear filter.

Load a Saved Filter

Once a filter is saved, you can apply it to the data in the Users screen.

To load a saved filter

1. Open the filter drop-down in the top-left corner of the screen.
2. Select the filter you want to apply.
   

Review User View Table

The User View shows all the application data for each user account. Among other items, it shows the relevant tags for the user, all of the applications the user has an account for, the number of admin permissions the user has, the number of paid accounts, and more.

The user status displayed can vary by SaaS app. For more information on what each status means for different applications see User Statuses.

If the filtered criteria match one of the user's application records, the table will show all of the records, unless the Exact Match Only toggle is enabled.

If you have an Axonius Cyber Asset Management account, it also provides a link to the devices that belong to the user. This allows you to ensure that corporate apps are only be accessed by corporate devices.

You can expand a user record to display each of the user's applications in a separate row.

If the user record is expanded, you can click corresponding to each application to view the user data for that application in the Detailed view.

Review Detailed View Table

The Detailed view shows discovered user account data for every instance discovered by Axonius SaaS Management. This means that a user can appear multiple times for the same application if they accessed it from multiple devices or have multiple tenants within the application.
Because there are so many data points in this table, it is important to approach it with the right filters that match the needs of your use case.

Regarding the various columns displayed in the detailed view, here are a few points to keep in mind while reviewing the data:

• Depending on the method used to discover a user some of the accounts may be left blank.
• The Admin Permissions column is shorthand for any permission or role as priveliged or access to a certain level considered as admin level access.
• Last Login represents the last time a user was asked to authenticate with that application. Note that for apps where last login isn't available or aapplicable, SaaS Management relies on the last recorded activity in the app.
• SSO Last Login - Another potential method for providing information for apps that are connected to your SSO application (for example Ota, Google, Microsoft, etc.) regarding whether a user is active or inactive. Please note that this column displays the last attempted login, but doesn't indicate if the login was successful or not.
• The resource column displays what items or resources the user has access to within a given application

You can click to export the information in the user table to a .csv file.