Unauthorized Temporary Users Appearing in User List in Splunk Observability Cloud

Applicability

Description

Users with usernames ending in @@tenant appear in Splunk Observability Cloud user management despite no explicit role assignments or access permissions. These temporary users are created automatically when Splunk Cloud users access RTM or Related Content panels. They cannot log in until authenticated via Unified Identity. This behavior is expected and not a security issue. Temporary users remain until replaced by permanent users upon login or manually removed by admins if deleted from Splunk Cloud.

Investigation

1. Confirm presence of temporary users in Splunk Observability Cloud user management interface by looking for usernames with @@tenant suffix.
   
   
2. Verify if users can log in or only appear in the user list (temporary users cannot log in).
   
   
3. Check if RTM or Related Content features are enabled in Splunk Cloud, as these trigger temporary user creation.
   
   
4. Run the following audit query in Splunk Cloud Platform to check activity of temporary users over the last 30 days:
   
   

index=_audit user IN (
user1@yourdomain@@tenant,
user2@yourdomain@@tenant,
user3@yourdomain@@tenant
)
earliest=-30d@d latest=now
| dedup action
| table _time, user, action
| sort - _time

This query lists actions performed by specified temporary users, helping confirm their activity related to Observability features.

Resolution

1. Understand that temporary users with @@tenant suffix are automatically created by RTM or Related Content features when users access these integrations in Splunk Cloud.
   
   
2. Temporary users cannot log in to Splunk Observability Cloud until authenticated via Unified Identity, at which point they are replaced by permanent users with email-based usernames.
   
   
3. If temporary users are deleted from Splunk Cloud but never log in via Unified Identity, they remain in Observability Cloud until manually removed by an admin.
   
   
4. To audit temporary user activity, run the provided Splunk Cloud audit query.
   
   
5. Review SAML attribute mapping and auto-provisioning settings in Splunk Observability Cloud Global Settings to ensure no unintended default team or role assignments.
   
   
6. If concerned about user visibility, verify RTM and Related Content usage in Splunk Cloud and educate users about these features triggering temporary user creation.

Documentation references

• The Splunk Cloud Platform documentation for Real Time Metrics (RTM) can be found here under heading ' Create an observability metrics-based chart in Dashboard Studio'.
• An example of Related Content panels in Splunk Cloud Platform can be seen here. There is a troubleshooting page here.