Active Directory User

Active Directory User: An account object for people or technical use. It contains identity attributes, logon settings, group memberships, and potentially service principal names. Lifecycle, password and logon policy, and privileged memberships require control; obsolete or shared accounts substantially increase the risk of abuse.

How it works and where it fits

Active Directory User separates the subject, digital identity, authentication factor, and authorization decision. Authentication establishes who or what is presenting an identity; authorization then determines which action is permitted in the current context. Session state, device trust, request origin, and risk signals can further influence that decision.

Practical security relevance

Effective implementation requires a controlled identity lifecycle from creation through role and entitlement changes to suspension and removal. Strong authentication, least privilege, periodic recertification, and traceable logs are central. Controls must also identify abuse of legitimate accounts, because valid credentials alone do not prove that an action is legitimate.

Related concepts

• Security PrincipalSecurity PrincipalIdentity with a security identifier to which permissions can be assigned and whose access Windows can evaluate.: Identity with a security identifier to which permissions can be assigned and whose access Windows can evaluate.
• Active Directory GroupActive Directory GroupDirectory object used to assign permissions collectively or to form email distribution lists.: Directory object used to assign permissions collectively or to form email distribution lists.
• AuthenticationAuthenticationVerification of the claimed identity of a user or system.: Verification of the claimed identity of a user or system.
• User ProvisioningUser ProvisioningCreation, modification, and removal of user accounts and permissions.: Creation, modification, and removal of user accounts and permissions.