Identity Sources
Identity Sources lists every Active Directory domain and EntraID tenant you have connected. Open it from the Identity sidebar.
To add one, click Add identity source. See Connect Identities.
Columns
| Column | Meaning |
|---|---|
| Directory | The display name you gave the source. |
| Integration | The integration type. |
| Source | Active Directory or EntraID. |
| Domain | The domain, e.g. authnull.lab. |
| Sensors | DC sensors reporting for this domain. See below. |
| Mode | Monitoring or Enforcing. See below. |
| Protection | Whether sign-ins are protected. See below. |
| Last Sync | When users were last synced. Shows Never synced until the first sync. |
| Action | Row menu. |
Sensors
| Shows | Meaning |
|---|---|
| A DC hostname and "x ago" | One sensor, with the time of its last event. |
| "N of M live" (+N more) | Several sensors; N of them are live. |
| No sensor detected | No sensor has reported yet. |
A sensor is live if it sent an authentication event in the last 15 minutes. There is no separate heartbeat.
Mode
Use the Mode dropdown to switch between Monitoring and Enforcing.
- Switching to Enforcing asks Start enforcing MFA?
- Switching to Monitoring asks Stop enforcing MFA?
The change applies from the next authentication. You do not need to download a new sensor.yml.
In Monitoring, every sign-in is allowed and no push is sent. Decisions are still logged.
Protection
| State | Meaning |
|---|---|
| Not protected | No sensor, or the sensor is not reporting. |
| Monitoring only | Sensor is reporting, Mode is Monitoring. |
| Protected | Sensor is reporting, Mode is Enforcing. |
Protected can show even when no policy matches your users. A sign-in with no matching policy is allowed. Check Policies to confirm MFA is actually required.
Filters
| Filter | Use it to |
|---|---|
| Directory name | Search by name. |
| Identity source | Show Active Directory or EntraID. |
| Integration type | Filter by integration type. |
| Status | Filter by status. |
Row menu
| Action | What it does |
|---|---|
| View users | Opens the users synced from this source. |
| Delete | Asks Delete directory? and removes the source from AuthNull. |
There is no edit screen and no manual sync button. To change sync scope or Fallback, download a new sensor.yml and restart the sensor. See Connect Identities.
Sync intervals
| Source | How it syncs | Interval |
|---|---|---|
| Active Directory | The DC Sensor pushes users, groups and OUs. | Every 10 minutes |
| EntraID | AuthNull pulls from Microsoft Graph. | Every 5 minutes |
Users
Open Users in the Identity sidebar. It lists directory and service account identities synced from your identity sources.
The chips at the top show counts for Users, Active and Pending. Click Add Users to Add User or Import Users. See Add users.
| Column | Shows |
|---|---|
| Username | Username, with the directory below. |
| OU | The OU, with the logon name below. |
| Type | The identity type. |
| Status | Active, Inactive or Pending. |
| ⋯ | Row actions. |
Filters: Search email, Status and Sort.
When your tenant uses Duo Security or Okta Verify, the expanded row shows "MFA managed by" the provider. The user's second factor is enrolled with that provider, not with AuthNull. See MFA providers.