User (Identity) Page

User (identity) page

In Petra, each person or account in a Microsoft 365 tenant is represented as an "identity." When you need to look at a specific user—their details, sign-in methods, or activity—you open that user's (identity's) page. This article explains what the user page is and how to use it.

What the user page is

The user page (or identity page) is a dedicated view for one user in one tenant. You get there by clicking a user from an incident, from the tenant's user list, or from search. The page shows everything Petra knows about that user in one place: their display name, email address, sign-in (authentication) methods, and often a slice of their recent activity (e.g., sign-ins or other logs filtered to that user). That makes it easy to answer questions like "who is this user?" and "what have they been doing?" without jumping between incidents and logs.

What you'll see

At the top you'll typically see the user's name and email (or user principal name). There's often a section on authentication methods—how they sign in (password, MFA, etc.)—which helps you understand their security posture. Below that you may see activity logs filtered to this user: sign-ins, email access, or other events depending on what's available. You can use the same date range and filter options as on the main tenant logs, but scoped to this identity. If the user has been involved in incidents, you may see links to those incidents so you can go from the user to the incident and back.

When to use the user page

Use the user page when you're investigating an incident and want to understand the affected user better, when someone asks "what did this user do last week?," or when you're assessing a user's risk (e.g., do they have MFA? have they had incidents before?). It's your single place to see identity details and activity for one person in one tenant, which simplifies investigation and reporting.