OpenAI User

Represents an individual user within an organization

Part of the OpenAI inventory.

Scan settings

Default scanning interval	Allowed scanning intervals	Data removal during incremental scan
Daily	Daily, Weekly, Bi-Weekly, Monthly, Never, Initial	Yes

Properties

Property	Type	Description	Automation placeholder
Key	String	Internal.	{{OpenAIUser.ApiKeyEncrypted}}
Country	String	Country of the M365 user.	{{OpenAIUser.Country}}
Initially Scanned	DateTime	Shows when this object was initially found in a scan.	{{OpenAIUser.CreatedTime}}
Department	String	Department of the M365 user.	{{OpenAIUser.Department}}
Display Name	String		{{OpenAIUser.DisplayName}}
Email	String	Email of the user.	{{OpenAIUser.Email}}
Is External	Boolean	True if M365 user is guest.	{{OpenAIUser.IsExternal}}
Last scan update	DateTime	Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change.	{{OpenAIUser.LastModifiedTime}}
M365 User	User	Parent M365 user.	{{OpenAIUser.M365User}}
Organization Name	String	Parent M365 user.	{{OpenAIUser.M365UserName}}
Risk Score	Int32	Stores risk score	{{OpenAIUser.RiskScore}}
Risk Score Update	DateTime	Stores risk score update	{{OpenAIUser.RiskScoreLastUpdate}}
Risk Score Value	String	Stores risk score value like Low_Low	{{OpenAIUser.RiskScoreValue}}

Relations

Relation	Service	Description
User	Microsoft 365	All users registered in your tenant (internal, external)
OpenAI Admin API Key	OpenAI	Represents an individual Admin API key in an org
OpenAI Project API Key	OpenAI	Represents an individual API key in a project

Segments

Segment	Description
External OpenAI Users	Shows OpenAI users who are external (guest) users in Entra ID

Actions

• Delete User
• Change User Role

Policies that check this object

Policy	Severity	Description
External Entra ID users have access to OpenAI	Medium	Detects OpenAI user which are external users in the Entra ID tenant
OpenAI User is deactivated in Entra ID	Medium	Detects OpenAI users that have been disabled in the tenant
External (guest) user	High	External guest accounts are a common attack vector, raising the likelihood of risky access