1Open People list
Administration → Identity → People
From any page in EmpowerNow click Administration in the top navigation. In the plugin picker, under the Identity column, click People. The URL changes to /identity-core/people.
Press Cmd+K (or Ctrl+K) from anywhere in the People list to jump focus to the search bar.
2Reading the list
What each column means
| ☐ | Person | Lifecycle | Risk | Status | Department | Last Login | Actions |
|---|---|---|---|---|---|---|---|
| ☐ | Jane Smith jane@example.com · HR Manager |
⬆ Joiner | ● Low | ● Active | Human Resources | 2h ago | View⏸ |
| ☐ | Bob Carter bob@example.com · Engineer |
↔ Mover | ▲ Medium | ● Active | Engineering | 1d ago | View⏸ |
| ☐ | Carla Reyes carla@example.com · Analyst |
⬇ Leaver | ⬆ High | ○ Suspended | Finance | 8d ago | View▶ Restore |
| Column | What it shows |
|---|---|
| Person | Display name, email, and job title. Clicking the name opens the Person Detail page. |
| Lifecycle (JML) | Joiner, Mover, or Leaver badge inferred from HR data. Leavers with active access need immediate review. |
| Risk | Risk level (Low / Medium / High) inferred from access breadth, stale sessions, and policy violations. High-risk persons appear in red. |
| Status | Active, Inactive, Suspended, or Pending. Only Active persons can authenticate. |
| Department | HR-sourced department. Used in dynamic collection rules. |
| Last Login | When the person last authenticated. Empty means no logins recorded. |
| Actions | Quick-access buttons: View (→ detail page), Suspend/Restore. |
3Search & filter
Type to search — server-side, 300 ms debounce
The search bar at the top of the People list queries the search service with a 300 ms debounce. You can search by name, email, job title, or department. Results are paginated at 50 per page and sorted by display name ascending by default.
Click any column header to sort by that column. Click again to reverse the sort order. The sort is server-side.
Status and Department filters
Below the search bar are two quick-filter dropdowns:
| Filter | Options | Use case |
|---|---|---|
| Status | All, Active, Inactive, Suspended, Pending | Show only suspended persons during an offboarding audit |
| Department | All + any department from HR data | Review all Engineering persons for over-provisioning |
Click the Filters button next to the search bar to open the Advanced Filter Panel. This lets you combine JML status, risk level, department, last-login range, and identity type in one query.
4Create a person
Click + New Person or press N
The + New Person button is in the top-right of the People list. Pressing N (when not typing in a field) also opens the modal. This creates a person identity only — it does not create login credentials. To add login, use Create Auth Account afterwards.
| Field | Required | Notes |
|---|---|---|
| First / Last Name | Yes | Combined into display_name. Used throughout the UI and audit logs. |
| Yes | Must be unique. This is the identity email — not necessarily the login email. | |
| Job Title | No | Shown in the person card and used in advanced filters. |
| Department | No | Used by dynamic collection rules. Must match expected values if rules depend on it. |
| Status | No | Defaults to Active. Set to Pending for pre-hires whose access hasn't started yet. |
| Photo URL | No | Displays in the person's avatar. Must be a publicly reachable HTTPS URL. |
5Person detail tabs
Click any person's name in the list
Clicking a name or the View button navigates to /identity-core/people/:personId. The page loads in the background while showing a skeleton animation. At the top you see a hero card with the person's avatar, name, status badge, risk indicator, and JML badge.
8 tabs on the detail page
| Tab | What you see |
|---|---|
| Overview | Identity details card (name, email, department, job title, created date), quick stats, and linked account summary. |
| Accounts (N) | All authentication accounts linked to this person across all providers (EmpowerNow IdP, Entra ID, Okta, etc.). Count shown in tab badge. Buttons: Unlink, Add Auth Account. |
| Access (N) | Collection memberships — which cohorts this person belongs to and therefore which application roles they hold. Each entry shows collection name, role, scope, and grant date. |
| Permissions | Effective RBAC permissions computed by the PDP — what this person can actually do in EmpowerNow right now. Uses the AccessEligibilityCard component. |
| Delegations | Any access delegations this person has granted to others, or received from others. |
| Activity (N) | Last 20 events for this person: logins, access changes, role assignments, suspensions. Sortable timeline. |
| Governance | Risk signals, policy violations, certification status, and governance notes for this identity. |
| Journey | JML lifecycle timeline — when the person joined, changed roles, or is scheduled to leave. |
Visualise identity relationships
On the Overview tab, click View in Graph (or navigate to /identity-core/graph) to open the Graph Explorer. It renders the person's relationships — linked accounts, collection memberships, delegated access — as a force-directed graph. Hover any node for details. Click to expand a node's own connections.
If a user has unexpectedly broad access, the graph makes it immediately visible — you can trace exactly which collection grant gave them which role.
6Edit a person
Click ✏️ Edit on the Person Detail page
The ✏️ Edit button in the Person Detail hero opens an Edit Person modal pre-filled with all current values. You can also trigger it from the list by hovering the row and clicking the edit icon.
| Field | What changes |
|---|---|
| Display Name | Shown in the table, detail page header, audit logs, and any access reviews that reference this person. |
| The person's identity email. Changing this does not automatically update their login email — that is a separate IdP account field. | |
| Job Title | Updated in the person card and used by any dynamic collection rules that match on job title. |
| Department | Critical for dynamic collection rules. Changing department may add or remove the person from collections automatically if rules are based on department. |
| Status | Set to Active, Inactive, or Pending. Changing to Inactive does not revoke access but removes the person from active governance workflows. |
| Photo URL | Updates the avatar displayed throughout the UI. |
If you change a person's department and there are dynamic collection rules that match on department, their collection memberships may be automatically updated within the next sync cycle. Review their Access tab after saving to confirm the expected state.
7Suspend & reactivate
Click ⏸ Suspend — blocks access without deleting
The ⏸ Suspend button appears both in the list's Actions column and in the Person Detail header (when the person is active). Clicking it opens a confirmation dialog. On confirm, the person's status changes to Suspended immediately (optimistic update).
Suspension blocks the person from authenticating across all linked accounts. It does not remove their collection memberships or access assignments — those are preserved for audit and can be reviewed during offboarding.
When suspending multiple people via bulk action, the confirmation dialog requires a written justification. This is recorded in the audit log alongside the action.
Click ▶ Restore to re-enable access
For a suspended person, the Suspend button is replaced by ▶ Restore. Clicking it immediately sets status back to Active with no confirmation. The person can authenticate again right away. A success toast confirms the change.
Suspending a person is reversible and preserves all data. Deleting a person (if the API supports it) would remove the membership record permanently. For leavers, the recommended workflow is: suspend → review access → offboard (remove collections) → optionally delete after retention period.
8Bulk operations
Check the header checkbox to select all visible rows
Each row has a checkbox. Clicking the header checkbox selects all people on the current page (up to 50). A blue bulk-action bar slides in at the top of the table showing the count of selected people.
Three bulk operations
| Action | What it does | Requires justification? |
|---|---|---|
| ⏸ Bulk Suspend | Sets all selected people to Suspended status. Blocks all their linked accounts from authenticating. | Yes — written justification required in the confirmation dialog |
| 👥 Add to Group | Opens the AddToGroup modal to add all selected people to a chosen collection or group simultaneously. | No |
| ⬇ Export CSV | Downloads a CSV of selected people with fields: ID, Name, Email, Status, Created, Last Login. | No |
Use bulk export to generate a snapshot of all people in a department for a periodic access review. Filter by department first, select all, then export.