Ghost Accounts report¶
How to view or generate this report
Go to Reports > Applications > Ghost Accounts.
The Ghost Accounts report lists every application user account that has no matched identity at all — accounts Permission Assist could not associate with any person in the system. These are unaccounted-for accounts: nobody Permission Assist knows about has been linked to them, which means the matching rules didn't fire, the underlying identity wasn't imported, or the account belongs to something the directory source doesn't represent (a shared mailbox, a service account that wasn't classified, a legacy account left behind after a migration).
The report shares its column layout with the Application Users report. The Summary and Details modes are identical in structure.
When to use this report¶
- Matching-rule tuning. A long ghost-accounts list often means the matching rules need to be updated — for example, when a username pattern in the source application doesn't line up with anything in the directory source.
- Service-account inventory. Ghost accounts are commonly service or system accounts. Use the report to inventory them and classify each (legitimate service vs. orphaned vs. unknown).
- Pre-review cleanup. Before opening a review, running this report can surface accounts that should be matched, retired, or classified before the review compiles its items.
- Audit response. Examiners ask whether every account is attributable to a person or a documented system identity. This report is the list of accounts that aren't yet.
What this report includes¶
Every application user where the matched identity is null — no identity match exists at all. Accounts where the matched identity exists but is disabled are not included here; those are Orphaned Accounts.
Output formats¶
The report is exported from an application's Reports section. Four export options are available:
| Format | Mode | Best for |
|---|---|---|
| Excel | Summary | A compact spreadsheet of every ghost account, one row each. |
| Excel | Details | A per-account spreadsheet with the account info and full privilege list. |
| Summary | A printable summary, one row per account. | |
| Details | A printable per-account document. |
Filter¶
| Option | Effect |
|---|---|
| Search Term | Narrows the report to accounts whose username contains the term. |
Section structure and columns¶
The output structure and column layouts are identical to the Application Users report — the only difference is the filter (this report shows only accounts with no matched identity). See that page's Excel — Summary and Excel — Details sections for the full column reference.
The Matched Identity, Matched Status, and Match Reason columns are blank on every row by definition — these accounts have no matched identity.
Sample¶
