user enrichment user duplication

[mekkimuyeeb]

The documentation states that enabling user enrichment might result in user duplication. Is there a way to identify if this will occur, is there away to fix it if it does occur and is there a work around?

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 0d1ddbec-2517-6111-942c-305df8b725f8
• Version Independent ID: 4565cf20-c44b-d79b-73e1-327049687db3
• Content: Enrich Cloud App Security Discovery data with Azure AD usernames
• Content Source: CloudAppSecurityDocs/cloud-discovery-aad-enrichment.md
• Service: cloud-app-security
• GitHub Login: @rkarlin
• Microsoft Alias: rkarlin

[rkarlin]

There are 2 possible scenarios in which this could happen:

1. User enrichment was enabled after non-enriched old data was already ingested by Cloud App Security.
2. Username format was changed and now there are 2 different “identities” for the same user.

If either of these is true in your environment, this will most likely occur.
Since user data that was already pushed into Cloud App Security won’t be reprocessed, the way to overcome this case is to wait 90 days after the last time the “old” username accessed the network, then data will be deprecated and automatically deleted.

[mekkimuyeeb]

Thank you. This helps a lot

…

On Mon, Jan 28, 2019, 7:25 AM rkarlin ***@***.*** wrote: There are 2 possible scenarios in which this could happen: 1. User enrichment was enabled after non-enriched old data was already ingested by Cloud App Security. 2. Username format was changed and now there are 2 different “identities” for the same user. If either of these is true in your environment, this will most likely occur. Since user data that was already pushed into Cloud App Security won’t be reprocessed, the way to overcome this case is to wait 90 days after the last time the “old” username accessed the network, then data will be deprecated and automatically deleted. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#90 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AmYRfB4zbd_gvKpVwGWzJSOlcx0MK8-Nks5vHuw6gaJpZM4aRPYu> .

[rkarlin]

#please-close
@msmbaldwin