> For the complete documentation index, see [llms.txt](https://docs.arnica.io/arnica-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.arnica.io/arnica-documentation/inventory/identities.md).

# Identities

Cross-SCM inventory of every person and service account with access to your code

The [Identities](https://app.arnica.io/#/inventory/users-v2) page gives a holistic cross-SCM view of every person and service account with access to your code. Arnica consolidates the separate Source Code Management (SCM) accounts belonging to the same person into a single identity, consolidating users across the enterprise and creating a rich profile for each user.

## How Arnica builds an identity

Arnica groups the SCM accounts it discovers by correlating their email addresses: two accounts that share at least one email address are deduplicated into a single identity, and the grouping is transitive — if account A shares an email with B, and B shares a different email with C, all three become one identity.

Arnica then defines a primary email which is used as the contact and notification email for the identity. The primary email is identified using this order of precedence:

1. An email that is both a Single Sign-On (SSO) email and on a verified domain.
2. An SSO email.
3. An email on a verified domain.
4. An email matching the most common non-webmail domain in your tenant.
5. The most frequently seen email for the identity.

The primary display name is selected based on frequency of appearance or manual override. A primary email or display name set manually in Arnica takes precedence over both lists and is retained on subsequent syncs, as long as the value still exists on one of the linked accounts.

Because linking is driven by email addresses, manually adding an email to an account merges the identities that share it, and removing a shared email splits them apart again. See [Correcting identity linking](#correcting-identity-linking).

## Identity scope

The **Total**, **Active**, and **Contributors** buttons switch the set of identities shown, each with its current count:

| Button           | What it shows                                                                                                |
| ---------------- | ------------------------------------------------------------------------------------------------------------ |
| **Total**        | Every identity in the tenant, service accounts and departed users included.                                  |
| **Active**       | Identities that are not service accounts and hold at least one active, non-deleted, organization membership. |
| **Contributors** | Active identities with at least one contribution in the last 90 days.                                        |

## Last Contribution

Contributing identities are defined as active identities which are responsible for a contributing activity in the last 90 days. The "Last Contribution" column will display the most recent activity which counts as a contribution. Contributing activies must include one of the following activities:

1. Committing code
2. Creating a Pull/Merge Request
3. Commeting on a Pull/Merge Request
4. Conducting a Pull/Merge Request review

## Identity page Columns

The table is sorted by **Last Activity**, most recent first, even though that column is hidden by default. Column and rows-per-page choices made in **Table Settings** are saved between sessions.

* **Name** — the primary display name, with any alternative names Arnica has seen on the linked accounts listed alongside it.
* **Email** — the primary email, marked with a star, followed by the other emails on the identity. A checkmark means the email is a verified SSO email, an email on a verified domain, or both.
* **Contributing** and **Active** — the same flags as the **Contributors** and **Active** scope buttons.
* **Last Contribution** — the most recent commit, pull request created, pull request review, or pull request comment across all linked accounts.
* **Last Contribution Type** — which of those four events was the most recent: **Committed Code**, **Created Pull Request**, **Commented on Pull Request**, **Reviewed Pull Request**, or **None**.
* **Service Account** — `Yes` when any linked account is flagged as a service account by the SCM, or is the account an Arnica integration authenticates as.
* **Last Activity** — the broadest activity signal: the most recent repository activity, organization login, or organization action across all linked accounts.
* **Highest Role** — the strongest organization-level role the identity holds in any organization, ranked **Admin**, **Member**, **Service**, **External**, **Stakeholder**. Repository-level roles are not counted.

Both date columns show `> 90 days ago` for anything older than 90 days.

{% hint style="info" %}
**Last Activity** and **Last Contribution** answer different questions. An identity that logs into the SCM daily but has not committed in a year has a recent **Last Activity** and a stale **Last Contribution**. To find departed or dormant accounts, filter on **Last Activity** — the same signal behind the **Stale Users** insight on the [Git Summary](/arnica-documentation/inventory/git-summary.md) page.
{% endhint %}

## Identity details

Clicking any row opens a detail panel for that identity. The arrow keys step through identities without closing it, and the rotate control moves the panel between the bottom and the right of the screen.

### Scorecard

* **Authored risks** — findings in SLA branches where the author, committer, or pusher was associated with this identity, broken down by status.
* **Risks resolved** — resolved or dismissed findings in feature branches where the author, committer, or pusher was associated with this identity, broken down by severity. The person who resolved the finding may be someone else.

### Activity

* **Recently contributed repositories** — commit counts per repository over the last 90 days.
* **Activity** — a radar chart of the identity's engagement over the last 90 days across **Commits**, **Authored PRs**, **Approved PRs**, **Change Requested PRs**, and **Commented on PRs**.

### Competencies

**Languages** gives the share of the identity's contributions written in each programming language. **Technologies** gives the share in each file category, such as infrastructure as code or CI/CD configuration.

### Security Championship, Product Ownership, and Memberships

Three tabs list the products the identity is attached to, as a security champion, a product owner, and a member respectively. **Add Product** attaches the identity to another product.

Memberships carry a **Type**:

* **Manual** — the identity was added to the product in Arnica, and can be removed.
* **Automatic** — the membership is derived from the identity's read access to the product's repositories, and cannot be removed.

{% hint style="info" %}
Product ownership drives routing for notifications and dismissal reviews. See [Products](/arnica-documentation/inventory/products.md).
{% endhint %}

### Accounts

Lists every SCM account linked into this identity, each with its username and SCM profile link, the organizations it belongs to and its role in each, and all of its email addresses and display names.

## Correcting identity linking

The **Accounts** tab is where you correct Arnica's automatic linking — either to merge accounts that were not correlated, or to separate accounts that were correlated incorrectly.

* **To merge two identities**, add a shared email address to one of the accounts. Arnica rejects an invalid address, an empty value, or an address already present on that account.
* **To split an identity**, remove the email the accounts have in common. The accounts that no longer share an address move to their own identities, and each new identity re-runs primary field selection.

Only email addresses added in Arnica can be edited or removed; addresses discovered from the SCM cannot be changed. Display names behave the same way, except that any display name other than the primary one can be removed.

To change which name or email is primary, click the pencil icon next to it in the panel header and select from the values Arnica has seen on the linked accounts.

{% hint style="warning" %}
Viewing the Identities page and editing identities both require the **Security Reviewer** role or above.
{% endhint %}