Operator Identity Resolution

GraphnAI matches each person who signs in, each escalation contact, and its own service accounts to their directory account by the directory's permanent ID, never by name. Automation won't act until that match is confirmed.

Requires role: Viewer (see your own linked account) / Admin (the Directory account column on Users, the Safety list, remediation credentials, directory sign-in settings, the escalation channel)

Related: Profile & Sessions, Full-Auto Execution, Select Fire™, User Management & RBAC, Event Bus Notifications

---

Overview

Every name in a directory can change. A display name can be edited, a UPN reassigned, and a username reused after someone leaves. If GraphnAI protected its administrators, escalation contacts and service accounts by name, anyone who could rename an account could make it untouchable. They could also make an unrelated account look protected.

So GraphnAI matches each person and each of its own service accounts by an ID the directory never lets anyone change: the object's permanent ID. That's the object GUID in Active Directory, and the object ID in Microsoft Entra ID. When someone has an on-premises account and a cloud account for the same identity, GraphnAI links the two, so protecting one protects both.

The match decides whether unattended automation (Full-Auto) may touch an account at all. Automation acts on an administrator, an escalation contact or one of GraphnAI's own accounts only after it confirms which directory account that is. When it can't, it refuses the action and alerts your team.

Prerequisites

• At least one directory, Active Directory or Microsoft Entra ID, connected and synced. GraphnAI can only match against a directory it has collected.
• The Admin role, for the Safety list, arming Full-Auto, and the Directory account column on Admin > Users.
• Any signed-in user can see their own linked account on the Profile & sessions page.
• A sign-in through a directory-backed method: directory sign-in with Active Directory, or Entra ID single sign-on. An account from another identity provider, such as a personal Okta or Google account, can't be matched to a directory account. GraphnAI says so rather than guessing.

How It Works

• GraphnAI never matches accounts by email, username, display name or user principal name. It always uses the directory's permanent ID.
• When you sign in through Active Directory or Entra ID, GraphnAI records that ID.
• When your organization links an on-premises account and a cloud account for you, GraphnAI links them too. Automation treats both as the same protected person.
• GraphnAI checks the match again each time it matters. When an account is disabled or a directory falls out of sync, the next check shows it.

Checking Your Own Linked Account

1. Select your name or avatar at the top right of the page, then select Profile & sessions.
2. Find the Linked directory account row on the identity card.

The row shows a badge, a sentence that explains it, and when it was checked. Each matched account is listed by its directory and whether it's cloud or on-premises, for example "GraphnAI (cloud)". Your own name isn't repeated. Select an account to open its details.

Badge	What it means
Linked	Your sign-in is linked to this directory account.
Linked, on-premises and cloud	Your on-premises and cloud accounts are linked.
More than one match	More than one directory account matches your sign-in.
Not found	Your sign-in account wasn't found in the last directory sync.
Directory not connected	The directory you sign in with isn't connected to GraphnAI.
Not a directory account	Your sign-in isn't linked to a directory account, for example with a non-directory identity provider.
Out of date	The directory data for your account is out of date.
Couldn't check	GraphnAI couldn't check right now.

For any badge other than Linked or Linked, on-premises and cloud, the sentence says what's wrong and, where you can act, what to do. The most common is "Sign in again to confirm this account's directory link." It appears after an upgrade for anyone who hasn't signed in again since. Sign out and sign in again to clear it.

Reviewing Everyone's Linked Accounts (Admin)

1. Select Admin > Users in the sidebar.
2. Find the Directory account column.

Only Admins see this column. Each cell shows the same badge as the profile page. Hover it for the sentence and the matched account names. Sort by the column to bring the entries that aren't matched to the top.

The Safety List: Who Automation Will Never Act On

Before you turn on Full-Auto, check who is protected and who isn't yet.

1. Select Admin > AI Provider in the sidebar, then open the Autonomy tab.
2. Under Full-Auto arming, find the Safety list card.

The card shows the automation state (Running, Paused, Not armed or Can't be armed yet) and four sections. Each lists its members and whether each one matches a directory account.

Section	Who's in it
Administrators	Every Admin user and group.
Escalation contacts	The person who armed the escalation channel, and everyone who receives escalation alerts.
Operators	Every Operator user and group, with whether each one can be reached now.
Platform accounts	GraphnAI's own accounts: each bridge's sync account, the account that makes remediation changes, and the account directory sign-in uses.

Reachable operators shows how many operators GraphnAI can confirm are able to respond, against the minimum your settings need. An operator is reachable when they signed in recently and their account is enabled, not locked and not expired. The bar turns orange below the minimum.

At or below the minimum, automation also won't act on any operator it can match. If any operator can't be matched at that point, automation stops: the operator it can't see might be the last one who could reach the kill switch.

An operator who isn't reachable shows why, for example "Not reachable: no sign-in in the last 30 days", "Not reachable: the directory account is locked out" or "Not reachable: their directory hasn't synced recently."

Why You Can't Arm Full-Auto Yet

If any administrator or escalation contact isn't matched to a directory account, Arm Full-Auto is disabled. The line beside it says "Match every administrator and escalation contact to a directory account first." The Safety list card also says "Automation can't run until everyone below is matched to a directory account."

If a settings save would arm Full-Auto anyway, it's refused. The card then lists each account that can't be matched yet, with what to do about it.

Shadow Mode Report

If Full-Auto runs in shadow mode, recording what it would do without acting, its report includes a section headed:

These would stop automation from running once it's armed. They aren't counted in the estimate above.

It lists the same gaps: unmatched administrators or escalation contacts, unreachable operators, and unconfirmed platform accounts. They stay out of the shadow numbers, which would otherwise make the "how often would this have acted" estimate look safer than it is.

When Automation Can't Confirm an Account

Once armed, if automation meets an account it can't confirm, it refuses the action before it changes anything. The same happens when the reachable operator minimum would be at risk. It then sends an alert through your escalation channel, webhook or email. This applies both to the account being acted on and to the administrator whose policy authorized the automation.

Select Fire™: Protecting Yourself from Self-Lockout

When you run a fix yourself in Select Fire, GraphnAI checks whether the change affects your own account, and warns you before you run it.

• When the change affects your account, the banner says "This change affects your own account."
• When GraphnAI can't be sure, it says "This might be your own account." and the reason. For example, your own sign-in couldn't be matched, or the change affects more accounts than could be checked.
• In a step that removes group members or memberships, your own account is never selected for you. Its row notes that it's your own account.

When a change that removes members or memberships affects your account, or might, you acknowledge it first. A check box reads "I understand this change affects my own account." or "I understand this change may affect my own account."

The controls that run the change appear only after you check the box. You can still go ahead, even to remove your own access. The check only makes sure you saw it coming.

Platform Accounts

GraphnAI protects its own accounts the same way it protects people: by the directory's permanent ID, confirmed the first time GraphnAI uses the account successfully. Until then, automation won't run with that account, and the Safety list says what confirms it.

Account	Confirmed by
A bridge's sync account	The bridge's next completed sync.
The remediation write account	Saving the remediation credentials, or selecting Validate on them.
The directory sign-in service account	Saving or testing the directory sign-in settings.

Entra ID apps that GraphnAI signs in with or makes changes through are matched by their application ID, so they need no confirmation.

For example, until the write account is confirmed, the Remediation Credentials page says:

Needs verification. Select Validate to confirm the account that makes changes. Automation stays off until then.

Once it's confirmed, it says "Write account confirmed by the directory on date."

After an Upgrade: Checklist

After an upgrade that turns this feature on, nothing matched by name before is trusted. Unattended automation stays paused until GraphnAI confirms everyone by their permanent ID. Work through this list:

1. Everyone signs in again. Anyone signed in before the upgrade signs out and in once, so GraphnAI records their ID. Until then, their profile says "Sign in again to confirm this account's directory link."
2. Run a sync on each bridge. This confirms each bridge's sync account.
3. Validate the remediation credentials. Select Admin > Remediation Credentials, then Validate, or save them again.
4. Test the directory sign-in settings. On Admin > Identity Providers, open the directory sign-in settings, then test or save them.
5. Arm the escalation channel again. If it was armed before the upgrade, arm it again so GraphnAI records who owns it.

Until every item is done, Full-Auto stays paused and refuses to run. An unconfirmed account counts the same as an unmatched one, and automation never assumes that what was fine before still is.

Troubleshooting

Badge or message	What it means	What to do
"Sign in again to confirm this account's directory link."	The account signed in before GraphnAI recorded directory IDs, and hasn't signed in since.	Ask the person to sign in again.
More than one match	More than one directory account matches this sign-in's ID.	Check the directory for duplicate accounts with this ID.
Not found	The account wasn't in the last directory sync.	Run a directory sync, then check again.
Directory not connected	The directory this person or account signs in with isn't connected to GraphnAI.	Connect that directory, or have them sign in through a connected one.
Not a directory account	The sign-in method has no connected directory behind it, for example a personal identity provider.	Give this role to someone who signs in with a directory account.
Out of date	The account's directory hasn't finished a sync recently, so whether it's enabled, locked or expired is stale.	Run a directory sync, then check again.
Couldn't check	A temporary problem stopped the check.	Try again shortly.
"Re-arm the escalation channel so automation can confirm who owns it."	The channel was armed before GraphnAI recorded owners' IDs.	Arm the escalation channel again.
"Test the directory sign-in settings to confirm which account signs people in."	The directory sign-in service account isn't confirmed yet.	Test or save the directory sign-in settings.
"Test the remediation credentials to confirm which account makes changes."	The account GraphnAI makes directory changes with isn't confirmed yet.	On Admin > Remediation Credentials, select Validate.
"Run a sync to confirm which account the bridge signs in with."	A bridge's sync account hasn't completed a sync since this feature was turned on.	Run a sync on that bridge.
A fix shows On hold with "The platform's own accounts aren't confirmed yet."	One of GraphnAI's own accounts isn't confirmed, so GraphnAI can't be sure the fix won't touch it. Every fix waits until it is.	Run a sync, then validate the remediation credentials and test the directory sign-in settings. The Safety list names the missing account.
The Safety list says "One of the platform's own accounts isn't confirmed yet, so automation holds every action."	The same cause, seen from the Autonomy tab.	The same fix: sync, validate, test.
Saving, testing or turning on directory sign-in says "The service account signed in, but its own entry couldn't be read."	The service account signed in, but GraphnAI couldn't find exactly one matching entry for it, so it can't confirm which account it is. Nothing was saved or turned on.	Check that the service account DN is exact and sits under the base DN, then try again.
Arm Full-Auto is disabled with "Checking who automation will never act on." or "Couldn't check who automation will never act on. Try again shortly."	The check is still loading, or it failed. Arming waits for a complete answer.	Wait a moment, or reload the page if the check failed.
Arm Full-Auto is disabled with "Match every administrator and escalation contact to a directory account first."	At least one administrator or escalation contact isn't matched yet.	On the Safety list, find the unmatched person and follow the steps shown for them.
The Safety list shows an operator as "Not reachable"	The operator's account is disabled, locked or expired, or hasn't signed in within the window. It can also mean the directory doesn't collect the attribute GraphnAI needs to tell.	Fix the account, or ask the operator to sign in again. This blocks nothing on its own. It matters only when reachable operators drop to or below your minimum.
Automation refused a fix, and an escalation alert names an account	Automation met an administrator, escalation contact or platform account it couldn't confirm. It can also be a cloud account whose on-premises account isn't linked yet.	Follow the steps the Safety list shows for that account. Automation resumes by itself once the account is confirmed.