Cisco Secure Access Help

PDF

Cisco Secure Access Help

Manage Users, Groups, and Endpoint Devices

Updated: September 15, 2026

Want to summarize with AI?

Log in

Describes Manage Users, Groups, and Endpoint Devices in Cisco Secure Access. Cisco Secure Access supports the integration of users, groups, and endpoint devices through various identity providers (IdPs).

Cisco Secure Access supports the integration of users, groups, and endpoint devices through various identity providers (IdPs). Once integrated with Secure Access, you can protect and monitor the connections for the users and devices to internet and private destinations by configuring Access rules in the organization's policy.

In addition to integrations with identity providers for provisioning users and groups, we recommend that you configure user authentication profiles. Authentication profiles describe integrations with single sign-on (SSO) IdPs. SSO IdPs authenticate users that connect through the Secure Access Secure Web Gateway (SWG) or with Secure Access Zero Trust Access.

  • You can set up multiple authentication profiles in Secure Access.

  • An authentication profile describes the association between a provisioning IdP and an SSO IdP.

After you add user directory integrations and set up user authentication profiles, Secure Access displays the users and groups that you provisioned in the organization.

Get Started with User Configuration Management

First, configure a user directory integration with Secure Access. The directory integration provisions users and groups into Secure Access.

Then, set up SSO authentication for users that connect to the web through the Secure Web Gateway or communicate with private destinations through Zero Trust Access.

Step 1 – Manage User Directories

Step 2 – Manage User Authentication Profiles

Get Started with Endpoint Device Management

Configure your on-premise Active Directory integration and provision your identity endpoints in Secure Access, see Manage Active Directory Integration.

View Provisioned Users and Groups

After you provision users, group, and endpoint devices in Secure Access, you can view the information about these identities.

Manage Remote Access VPN and Zero Trust Device Connections

In Secure Access, manage the user connections.

Manage End-User Connectivity

Secure Access provides secure connectivity to the internet and your digital resources. To route network traffic from endpoints securely, you can:

  • Manage the DNS servers deployed in your organization

  • Manage private resources configured for Zero Trust access

  • Manage client IP address ranges and profiles used by virtual private networks (VPNs)

  • Protect or bypass traffic to certain internet resources

  • Configure comprehensive endpoint internet security settings

DNS Servers

Add DNS servers to resolve DNS requests for certain domains from remote clients. For more information, see Manage DNS Servers.

Traffic Steering for Cisco Secure Client Connections

View traffic steering rules for zero trust connections. For certain private resource configurations, you can specify subdomains to exclude from zero trust access. For more information , see Traffic Steering for Client-Based Zero Trust Connections.

Virtual Private Networks Settings and Profiles

Configure VPN settings and profiles. For more information, see Manage Virtual Private Networks.

Internet Security

Steer traffic from endpoints to Secure Access or directly to the internet. For more information, see Manage Internet Security.

View Users Provisioned in Secure Access

After an administrator provisions users in Cisco Secure Access, you can view details about the users including information about the access rules that apply to the users.

Before you begin

  • A minimum user role of Read-only. For more information, see Manage Accounts.

Procedure

  1. Navigate to Connect > Users, Groups, and Endpoint Devices, and click Users.

    Secure Access displays a table of users provisioned in your organization. You can use filters to refine your search, including components like VPN or ZTNA, and ZTNA filters for active or inactive connections.

  2. The table includes the following columns:

    • Name—The first and last names of the user.

    • Risk Alerts—The number of risk categories detected for the user in last seven days.

    • User Principal Name (UPN)—The User Principal Name for the user.

    • Auth Property—The property that Secure Access uses to authenticate the users in the organization.

    • Source—The method or identity provider (IdP) that provisioned the user.

    • Directory—The name of the user directory for the (IdP) integration.

    • Trust Level—The trust level of users provisioned by an IdP. This column is available as a table filter and within the User Details component. Trust Level in Secure Access requires integration with Cisco Identity Intelligence via Security Cloud Control. For more information, see Integrate Cisco Identity Intelligence. When enabled, eligible users will have Trust Levels from the following range of values:

      • Trusted—Indicates the user has an exceptional level of safety.

      • Favorable—Indicates the user has a minimum level of safety.

      • Neutral—Indicates the user has been evaluated and has neither positive nor negative behavior.

      • Questionable—Indicates the user is displaying behavior that may indicate risk or may be undesirable.

      • Untrusted—Indicates the user is displaying behavior that is exceptionally high risk, malicious, or undesirable.

      • Unknown—Indicates the user was not yet evaluated, or insufficient data is available to assert a trust level.

    • Connected (VPN)—The number of connections with Secure Access virtual private network (VPN) from the user's devices.

    • Enrolled (ZTNA)—The number of connections with Secure Access Zero Trust Access from the user's devices.

    • Associated Rules—The number of access rules that include the user.

  3. Navigate to a user.

    The User Details interface.

View User Details

Get the information about a user provisioned in the Secure Access organization.

Before you begin

  • Ensure you have at least a Read-only user role. For more information, see Manage Accounts.

Procedure

  1. Navigate to Connect > Users, Groups, and Endpoint Devices, and click Users.

  2. Select a user, and then click their name to view the details.

    The attributes for the user include:

    • Name—The name of the user.

    • Email—The email of the user.

    • User Principal Name—The User Principal Name for the user.

    • Auth Property—The name and value of the property that Secure Access uses to authenticate the users in the organization.

    • Identity Provider—The identity provider that manages the user account.

    User Attributes

    The number and information of user devices connected.

    • Connection—The type of connection

    • IP address—The IP address of the device.

    • OS Version—The version of the device's operating system.

    If the user has not enrolled in any device, the Devices and Connectivity area will not show any device details.

    Number of devices user has enrolled

    In the Devices and Connectivity area, you can view the number of Endpoint Data Loss Prevention (DLP) devices that you have enrolled. Each device shows the details such as device name, device identification number, serial number, hostname, operating system version.

    View number of Endpoint DLP devices user has enrolled along with the device details

    When you click the View device activity link, you will be directed to the Data Loss Prevention report, which displays a list of devices that are currently active.

    You can also check the certificate status, module version of Endpoint DLP, date and time when the Endpoint DLP device was last configured, and date and time when the certificate was last issued.

    View other details of Endpoint DLP device

    If you want to cancel the enrollment, click Unenroll device.

    The Risk Alerts section displays alerts upto past thirty days for the user. The alerts appear based on their categories. It also displays the number of associated events for each alert category.

    View Risk alerts from the past seven days for the user

    To view details for each risk alert, click View details to display details of each event for the risk alert category.

    View details of each event for the risk alert category

    To view all the events that are associated with a risk alert, click View more in Events.

    View all events associated with a risk alert

    This opens the Events page and automatically applies necessary filters to display the events for that specific risk alert. For more information on Events, see Events Report.

    View list of events for a specific risk alert

    The Trust Level section displays the user's current trust level, an explanation of that trust level, and the date and time the trust level was last updated.

    View the user's trust level details

    For a description of each possible trust level value (Trusted, Favorable, Neutral, Questionable, Untrusted, Unknown), refer to View Users Provisioned in Secure Access. For more information, see Integrate Cisco Identity Intelligence with Secure Access.

    • Groups—The number of groups that include the user and the name of the groups.

    • Events—The number of events created by the user and the status of the events.

    The User Groups Events interface.

    The Secure Access rules in the Access policy applicable to the user.

    The Associated Rules interface.

Export Users to CSV

The robust filtering and search capabilities on the Users, Groups, and Endpoint Devices page help you quickly narrow down and analyze significant security and network activities. You can use a combination of basic search box filters and advanced filter options to focus on specific events. Export the results for troubleshooting, record keeping, and more.

Before you begin

You must use at least one filter and apply it to the table before you can export the information into a .csv.

Procedure

  1. Navigate to Connect > Users, Groups, and Endpoint Devices.

  2. Click the Users tab.

  3. Beside the search bar, click Filters and launch the pop-up window for selections. You have the following options in drop-down menus:

    • Directory – Select the directory type currently configured for your users.

    • Risk alert – Select the risk alert you want to filter on.

    • Trust level – Select the trust level you want to filter on.

    • (Optional) VPN Filters – Check this box to only show active VPN sessions. Note that using this option disables the other filter options listed above.

    • VPN profile - Select the VPN profile you want to filter on.

  4. Filters are automatically applied. Once you have modified the filter selections, review the table. Click on the Name of an entry to examine the details of the user, such as devices and connectivity, device ID, OS version, VPN access information and more.

  5. To export the table, click Export CSV.

  6. Enter an Exported Report Name. This is what the file is saved as once it is exported locally.

  7. Enter the Results Row Limit to limit the exported report to a certain number of rows. There is a maximum limit of 1,000,000 rows allowed per report; if you do not express a specific value for your report and the number of rows from your filter exceeds the max number, the report is truncated to 1,000,000 rows by default.

  8. Click Export. Alternatively, click Cancel to not save the report.

View Group and Organizational Unit Details

View the provisioned groups in Secure Access.

Administrators can use Identity Providers (IdPs) that are integrated with Secure Access to provision IdP groups and Google Chromebook Organizational Units (OUs) in Secure Access. Once groups and OUs are provisioned, you can view their details and access rules that apply to users and endpoint devices in the groups or OUs.

Before you begin

  • A minimum user role of Read-only. For more information, see Manage Accounts.

Procedure

  1. Navigate to Connect > Users, Groups, and Endpoint Devices, then click Groups and Organizational Units.

    Secure Access lists the provisioned groups and OUs.

    • Name—The name of the group or OU.

    • Type—Group or OU.

    • Source—The method or identity provider (IdP) that provisioned the group or OU.

    • Directory—The name of the IdP that provisioned the group or OU.

    • Users and AD Devices—The number of users in the group or OU.

    • Path—The path for the OU.

    • Associated Rules—The Access rules that include the group or OU.



  2. Click on the name of a group to view the details about the group or OU.

Group Details

Information about the user group.

  • Name—The name of the group.
  • Identity Provider—The source of the provisioned group.
  • Users—The number of users in the group and the group label.
  • Devices—The number of endpoint devices in the group and the group label.
  • Events—Number of user or device connection events by connection status (Blocked or Allowed).
  • Associated Rules—The number and names of access rules applied to users in the group.

Organizational Unit Details

Information about the OU.

  • Name—The name of the OU.

  • Identity Provider—The source of the provisioned OU.

  • Path—The directory path of the OU.

  • Users—The number, names, and email addresses of users in the OU.

  • Child OUs—The number and names of child OUs of the OU.

  • Associated Rules—The number and names of access rules applied to users in the OU.

View Details for Endpoint Devices

After an administrator provisions endpoint devices in Cisco Secure Access, you can view details about the devices including information about the access rules that apply to the endpoint devices.

Before you begin

Procedure

  1. Navigate to Connect > Users, Groups, and Endpoint Devices, and then click Endpoint Devices. Secure Access lists the devices provisioned in the organization.

    • Name—The AD display name of the device.

    • Device Type—The type of identity provider (IdP) integration that provisioned the device. Secure Access supports the AD Device type only.

    • Auth Property—The value of the property used to authenticate the device in Secure Access.

    • Directory—The name of the Active Directory IdP.

    • Associated Rules—The number of access rules that apply to the device.

  2. Navigate to an endpoint device.


    The Endpoint Devices Table View interface.

View a Configured AD Device

Click a device name to view the details about the device.

Before you begin

Procedure

  1. Navigate to Connect > Users, Groups, and Endpoint Devices, and then click Endpoint Devices.

  2. Navigate to an endpoint device, and then click the name of the device.

    1. View the general properties for the endpoint device.

      • Display Name—The AD display name of the device.

      • Auth Property—The name and value of the property that Secure Access uses to authenticate the device.

      • Identity Provider—The name of the identity provider that manages the user device.


      The AD Device Details General interface.
    2. View the information about the access rules that apply to the endpoint device.

      • The number of access rules that apply to the endpoint device.


        The AD Device Details Assoc Rules interface.

      • Rule Name—The name of the access rules that apply to the endpoint device.

        • Click View more in Policy to navigate to the Access Policy in Secure Access.

Export User Data to CSV

You can filter, view, and export User data into a .csv file for troubleshooting and monitoring purposes. The robust filtering and search capabilities on the Users, Groups, and Endpoint Devices page help you quickly narrow down and analyze significant security and network activities. You can use a combination of basic search box filters and advanced filter options to focus on specific events. Export the results for troubleshooting, record keeping, and more.

Note

You must use at least one filter and apply it to the table before you can export the information into a .csv.

Procedure

  1. Navigate to Connect >

    Users, Groups, and Endpoint Devices.

  2. Click the Users tab.

  3. Beside the search bar, click Filters and launch the pop-up window for selections. You have the following options in drop-down menus:

    • Directory – Select the directory type currently configured for your users.

    • Risk alert – Select the risk alert you want to filter on.

    • Trust level – Select the trust level you want to filter on.

    • (Optional) VPN Filters – Check this box to only show active VPN sessions. Note that using this option disables the other filter options listed above.

    • VPN profile - Select the VPN profile you want to filter on.

  4. Filters are automatically applied. Once you have modified the filter selections, review the table. Click on the Name of an entry to examine the details of the user, such as devices and connectivity, device ID, OS version, VPN access information and more.

  5. To export the table, click Export CSV.

  6. Enter an Exported Report Name. This is what the file is saved as once it is exported locally.

  7. Enter the Results Row Limit to limit the exported report to a certain number of rows. There is a maximum limit of 1,000,000 rows allowed per report; if you do not express a specific value for your report and the number of rows from your filter exceeds the max number, the report is truncated to 1,000,000 rows by default.

  8. Click Export. Alternatively, click Cancel to not save the report.