In Lumos, the Categories column highlights accounts with elevated risk or requiring special attention. Below is a breakdown of each category, what it means, and how Lumos identifies it.
Category
What It Means
How Lumos detects it
Privileged
This means the user likely has some kind of “admin” access to the app.
Lumos scans entitlement names for keywords like "Admin", "SuperUser", or "Super User". See how this Tag is applied to Permissions here.
Terminated
The employee is no longer with your company.
Detected via inactive employment status from your source of truth (e.g., HRIS, IdP).
Service Account
Lumos detected that the account is a system/service account in the app.
Based on the Identity Type configured in Lumos. See Managing Identitiesfor more details on tagging service accounts.
Unmatched
The account isn’t linked to an employee. Usually these are guest accounts, system/service accounts, or contractor accounts.
Lumos flags accounts not associated with any source-of-truth identity.
SOD Violation
The account has entitlements that conflict with a Segregation of Duties (SoD) policy.
Lumos calculates this using the SoD rules defined in your environment.
