End users and user groups

The Users section lists the people who use your endpoints and the accounts they sign in with. It exists so that settings can follow a person: a profile assigned to a user or a user group reaches every endpoint that person uses. These people are end users. They never sign in to the console. Your team’s console accounts are on Invite your team.

The section has three pages: All users, User groups, and Merge suggestions.

Before you begin

• Reading people and user groups needs identity:read.
• Adding, changing, merging, and removing them needs identity:manage.

How people get onto the list

Outpost adds people on its own from the accounts your endpoints report. Each account is matched to a person by its security identifier first, so a person who is renamed in the directory keeps their record. You can also add people by hand.

The Source column says where each person came from:

Shown	Meaning
Discovered	Outpost created this person from an account an endpoint reported.
Added by hand	Someone on your team created this person.
Needs review	Only a local account on one computer vouches for this person. They may be a duplicate of someone else. See Merge duplicate people.

Statuses

A person is active, disabled, or departed. A departed person keeps their history but stops picking up policy. New people are active unless you choose otherwise.

The list opens on the Still on the roster view, which shows active and disabled people. The other built-in views are Active only, Recently added, and Departed.

Search matches the beginning of a word in a name or an email address. Names and addresses are stored encrypted, so a search for the middle of a word finds nothing: “grant” finds Alicia Grant, and “rant” does not.

Add a person by hand

1. Go to Users > All users, and select New user.
2. In Display name, enter the person’s name.
3. Optional: enter their Primary email. It identifies the person and is not used to sign them in.
4. Optional: in Site, choose the site this person belongs to, so a site-scoped profile reaches them.
5. Select Create user.

Their logins are added afterwards.

Add a login

A login is an account a person signs in with. Outpost matches what endpoints report against logins.

1. Open the person, and select the Logins tab.
2. In Provider, choose where the account lives: Windows local, Active Directory, Microsoft Entra ID, Okta, Google Workspace, macOS local, or Linux local.
3. In Identifier, enter the account name as the endpoint reports it, such as CONTOSO\jokafor. Case and domain form do not matter.
4. Optional: select This is their primary login. A person has at most one.
5. Select Add login.

Assign endpoints to a person

Assigning an endpoint to a person decides whose settings apply to it when nobody is signed in, such as during a maintenance run at night.

1. Open the person, and select the Endpoints tab.

2. Under Assign another endpoint, find the endpoint by hostname, serial number, model, or user.

3. In Assign as, choose how the person uses it:

   Choice	Meaning
   primary	The endpoint is theirs. Their policy applies with nobody at the console.
   shared	They are one of several people who use it.
   service	A non-human account that runs on the endpoint.

4. Select Assign beside the endpoint.

This person’s endpoints lists every endpoint assigned to them. An endpoint where they are signed in at the console is marked At the console. Select Unassign to remove one.

Group people

A user group is a named set of people a profile can be assigned to.

1. Go to Users > User groups, and select New group.
2. Enter a Name and, optionally, a Description.
3. In Mirrored from, leave Local group unless the group mirrors a group in a directory. For a mirrored group, choose the directory and enter its Source id.
4. Select Create group.

To add someone, open the group and, in Add a member, choose the person. Or open the person, select the Groups tab, and use Add to a group. Adding a person to a group changes which profiles resolve for them.

Merge duplicate people

Outpost suggests people it believes are the same human, for example a local account that matches someone from your directory. Nothing is merged until you decide.

1. Go to Users > Merge suggestions.
2. For each suggestion, compare Keep and Fold in. A Strong match has strong evidence. A Weak match needs a closer look.
3. Select Merge to fold the second person into the first, or Not the same to dismiss the suggestion for good.

A merge moves everything that pointed at the folded-in person to the one you keep: their logins, group memberships, endpoint assignments, and the profiles assigned to them. The folded-in person is removed.

Caution

A weak match on an account that exists on five or more computers with no matching full name often belongs to a shared or break-glass account, not a person. The suggestion says so. Merging it moves that account’s policy onto a real person.

Other tabs on a person

Tab	Contents
Profile	Name, email, phone, title, site, and status. Remove user is here. On the MSP plan, also the person’s contact tags. See Client contacts, sites, and contact tags.
Groups	The user groups this person is in.
Sync	Their Outpost Sync status and files. See Outpost Sync.
Documentation	Articles and assets that name this person. See Documentation.

Verify

Open a person you merged into. Their Logins tab lists the logins of both people, and Merge suggestions no longer shows the pair.

Next steps

• Profiles
• Organize endpoints with sites, device groups, and tags