1 Open the Accounts list
Navigate to Administration → Identity → Accounts
From any page in EmpowerNow, open the Administration menu in the top navigation bar. Under the Identity section, click Accounts. The page loads at /identity-core/accounts showing all accounts across every configured identity provider.
Understanding the two views
The Accounts page has two tabs, each with its own URL. The browser URL bar always reflects which tab you are viewing:
| Tab | URL | What it shows |
|---|---|---|
| All Accounts | /identity-core/accounts |
Every authentication account in the system — active, disabled, and orphaned — across all configured providers. |
| Orphan Accounts | /identity-core/accounts/orphans |
Only accounts that have no linked person identity. These require immediate attention as they bypass governance workflows. |
If orphan remediation is a recurring task for your team, bookmark /identity-core/accounts/orphans directly. The URL is stable and always shows the current orphan count.
2 Reading the table
The All Accounts table lists every authentication account discovered across all identity providers. Each row is one account.
Accounts table — all columns explained
| ☐ | Account ID | Provider | Linked Person | Status | Created | Actions | |
|---|---|---|---|---|---|---|---|
| ☐ | usr_jane_01 | EmpowerNow IdP | Jane Smith | jane@example.com | ● ACTIVE | 2d ago | 👤 View Person |
| ☐ | ea_bob_02 | Entra ID | Bob Carter | bob@corp.example.com | ● ACTIVE | 5d ago | 👤 View Person |
| ☐ | okta_orp_99 | Okta | — Not linked — | unknown.user@example.com | ● ACTIVE | 14d ago | 🔗 Link⏸ Disable |
| Column | What it shows |
|---|---|
| ☐ Checkbox | Select for bulk operations. Header checkbox selects or deselects all visible rows. |
| Account ID | The unique identifier for this account within its provider, displayed in monospace. Not editable. |
| Provider | Badge showing which identity provider owns this account: EmpowerNow IdP (violet), Entra ID (blue), Okta (amber), or other configured providers. |
| Linked Person | The person identity this account is governed under. If linked, shows the person's display name in green. If unlinked, shows — Not linked — in red. |
| The email address associated with this account in the provider. | |
| Status | ● ACTIVE (green) = account can authenticate. ○ DISABLED (muted) = authentication blocked. |
| Created | When this account record was first seen by EmpowerNow (relative time). |
| Actions | Linked accounts show 👤 View Person. Unlinked accounts show 🔗 Link and ⏸ Disable. |
Identifying the source provider
Every account row carries a colour-coded provider badge. The badge colour lets you quickly identify which system manages the account's credentials and lifecycle:
| Badge | Provider | Notes |
|---|---|---|
| EmpowerNow IdP | EmpowerNow local IdP | Accounts managed directly within EmpowerNow. Passwords and credentials are controlled from IdP User Management. |
| Entra ID | Microsoft Entra ID / Azure AD | Federated accounts from your Microsoft tenant. Managed in Entra; EmpowerNow receives claims at login. |
| Okta | Okta | Federated accounts from Okta. Credentials managed in Okta; only the claim mapping is governed here. |
| LDAP | LDAP / Active Directory | Accounts synced from on-premises LDAP or Active Directory via the LDAP connector. |
3 Filter by provider & status
Find accounts by ID or email
The search bar at the top of the table accepts partial matches against two fields: Account ID and Email. Results update server-side approximately 300 ms after you stop typing (debounced). There is no need to press Enter.
Filter by identity provider
Use the Provider dropdown to narrow the table to accounts from a single source. This is useful when investigating federation issues or auditing a specific connector's accounts.
| Option | What it shows |
|---|---|
| All Providers | Accounts from every configured provider (default). |
| EmpowerNow IdP | Only local IdP accounts managed natively by EmpowerNow. |
| Entra ID | Only accounts federated from Microsoft Entra ID. |
| Okta | Only accounts federated from Okta. |
| LDAP | Only accounts synced from on-premises LDAP or Active Directory. |
Filter by account status
Use the Status dropdown to focus on a particular lifecycle state. Filters apply in combination — you can combine Provider + Status to narrow results precisely.
| Option | What it shows |
|---|---|
| All Status | Every account regardless of state (default). |
| Active | Accounts that can currently authenticate. |
| Disabled | Accounts that are blocked from authenticating. Useful for auditing dormant or suspended accounts. |
| Orphaned | Accounts with no linked person identity — these bypass governance. Equivalent to switching to the Orphan Accounts tab. |
Set Provider = Entra ID and Status = Orphaned to instantly surface every federated Entra account that has no person identity. These accounts can authenticate via federation but receive no governance coverage — remediate them before your next access review cycle.
4 Orphan Accounts tab
Click the Orphan Accounts tab or navigate directly
Click the Orphan Accounts tab at the top of the Accounts page, or navigate directly to /identity-core/accounts/orphans. The view switches to a specialised orphan management table.
An orphaned account can authenticate — a user can still log in — but because there is no person identity attached, the account will never appear in access reviews, JML (Joiner / Mover / Leaver) workflows, or access reports. This creates a blind spot in your governance posture. Remediate all orphans before any certification campaign.
The orphan count alert
At the top of the orphans view, an amber alert banner shows the current count:
| ☐ | Account ID | Provider | Suggested Person | Actions | |
|---|---|---|---|---|---|
| ☐ | okta_orp_99 | Okta | unknown.user@example.com | Jane Smith (92%) |
🔗 Link to Suggestion
🔗 Link to Other
⏸ Disable
|
| ☐ | ea_orp_14 | Entra ID | m.jones@corp.example.com | Marcus Jones (78%) |
🔗 Link to Suggestion
🔗 Link to Other
⏸ Disable
|
| ☐ | idp_orp_07 | EmpowerNow IdP | svc-automation@example.com | No suggestion |
🔗 Link to Other
⏸ Disable
|
Understanding the orphan table columns
| Column | What it shows |
|---|---|
| ☐ Checkbox | Select multiple orphans for bulk operations. |
| Account ID | Unique provider account identifier in monospace. |
| Provider | Colour-coded provider badge identifying the source system. |
| Email address known to the provider for this account. | |
| Suggested Person | The ML-suggested person match and a confidence percentage (e.g. Jane Smith (92%)). If no confident match is found, shows No suggestion in muted text. Confidence is calculated from name, email domain, and department attribute similarity. |
| Actions | 🔗 Link to Suggestion — auto-link to the ML suggestion. 🔗 Link to Other — open a person search to pick manually. ⏸ Disable — block authentication without linking. |
5 Link an orphan to a person
Click 🔗 Link to Suggestion
When the ML engine has identified a likely person match, the 🔗 Link to Suggestion button appears. Clicking it opens a confirmation dialog that shows the account details, the suggested person, and the confidence score so you can verify before committing.
Confirming will create a BELONGS_TO relationship between this account and Jane Smith in the membership service. The account will be removed from the orphan list immediately.
Click ✨ Link to confirm. On success:
- A success toast appears in the bottom corner.
- A brief celebration animation plays on the row.
- The account moves out of the orphan list immediately (optimistic update).
- The linked person's Accounts tab now lists this account.
Click 🔗 Link to Other
Use 🔗 Link to Other when the ML suggestion is wrong, absent, or when you want to link to a specific person you already have in mind. This opens a person search modal.
Type any part of the person's name or email. Matching records from the membership directory appear as suggestions. Click the correct person row to select them, then click 🔗 Link to Selected to confirm.
Verify the link was successful
After linking via either method, navigate to the person's profile in Identity Core People. Their Accounts tab now shows the newly linked account with provider, account ID, and status. The account also disappears from the Orphan Accounts tab.
Once linked, this account's sessions will be tracked under the person's identity. The person will appear in access reviews, their account activity will be visible in the audit trail, and JML lifecycle workflows will apply to them.
6 Bulk disable orphans
Select multiple orphan accounts
On the Orphan Accounts tab, check the checkboxes on the left side of each orphan row you want to act on. To select all visible orphans at once, check the header checkbox. A bulk action bar slides in above the table once at least one row is selected.
| ☑ | Account ID | Provider | Suggested Person | |
|---|---|---|---|---|
| ☑ | okta_orp_99 | Okta | unknown.user@example.com | Jane Smith (92%) |
| ☑ | ea_orp_14 | Entra ID | m.jones@corp.example.com | Marcus Jones (78%) |
⏸ Disable Selected
Click ⏸ Disable Selected to block all selected orphan accounts from authenticating. A confirmation dialog appears showing the count of accounts that will be disabled. Confirm to proceed.
After disabling: the accounts remain in the Orphan tab (they still have no person link) but their status changes to ○ DISABLED and they can no longer log in. This is a safe holding state — the accounts can be re-enabled later once a person identity is linked.
🔗 Auto-link All
Click 🔗 Auto-link All to run the ML suggestion engine for all selected orphans and automatically link each one to its suggested person match if the confidence score meets the configured threshold (default: ≥ 85%).
After the operation completes, a summary toast shows:
- How many accounts were successfully linked.
- How many were skipped because the confidence was below threshold.
- How many failed (review the Operations Center for details).
Only use 🔗 Auto-link All when you trust the ML confidence scores for your entire selection. For any account with a confidence below 85%, the system will skip it — but review those manually after the bulk operation. Never auto-link accounts that show No suggestion in the Suggested Person column.
Deselect all rows
Click Cancel in the bulk action bar, or uncheck the header checkbox, to deselect all rows. The bulk bar disappears with no changes made.