Credential Governance
View Account
Help desk agents see a user's account status on every connected system in one view.
Completes when each selected system's account details are displayed.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run View Account from the AI Assistant You Already Use
Read-only: nothing is changed. In Avabot and MCP you verify your own identity first, then name the user and get an account-status summary for each system. One completed lookup = one Secure Outcome; failed attempts are never billed.
You: Is jlee locked out anywhere? Avatier: verify: passed · user: jlee · Active Directory: locked · password expires: soon · Entra ID: enabled
Why it matters
The Help Desk Should See the Whole Account Before It Acts.
Locked, disabled or expired, and on which system? The answer decides what the help desk does next.
What a lookup needs
Each connected system's view of the user's account: locked or disabled status, account and password expiry, password age and last logon, plus the user's groups, manager and contact details.
What goes wrong by hand
Checking a user's status in each system's own admin console slows every call and misses the system nobody checked.
What View Account does
The agent selects the user and the systems, and the user card opens each system's account details, with export to Excel or PDF.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether the help desk looks anything up this month or not. Pay Per Identity Action™ charges only for completed lookups.
The Action
How View Account Runs
On the web, View Account walks through these screens. In Avabot and MCP you verify yourself, name the user and get a status summary for each system.
Verify in Avabot or MCP
Avabot and MCP only. You prove your own identity in the conversation first, or reuse the connector sign-in where that is enabled. The user you look up is not challenged. On the web, your sign-in is enough.
Identity Verification (Avabot and MCP)
Select the User
Help desk agents who hold the View Account delegation select the user. In Avabot, name the user.
Pick the Systems
Choose the systems to check. Only systems with account information enabled are listed.
Review the User Card
The user card opens each system's account details, the user's group memberships, manager, contact information and access. In Avabot chat, the summary is shown as a card.
Export
Optionally export to Excel or PDF, then manage another user.
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A lookup completes when each selected system's account details are displayed. Nothing is changed, and no request is created. On the current (.NET 10) server, an audit entry records that the agent viewed the user's account information. One completed lookup = one Secure Outcome.
Evidence
- An audit entry recording the view (on the current .NET 10 server)
- The user card, with each system's account details
- An Excel or PDF export, when you choose one
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Pay Per Identity Action™
Pay per Completed Lookup
Pay per completed lookup. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | View Account, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed lookups only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Each selected system's account status for the user is displayed, and nothing is changed |
| Evidence | Silent failures and missing audit trails | An audit entry for each view on the .NET 10 server, and an Excel or PDF export |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems a Lookup Reads
View Account reads each connected system where account information is enabled: Active Directory, LDAP, Entra ID and other connectors.
- LDAP
- Microsoft
- Active Directory and Entra ID. On the current (.NET 10) server, Entra ID accounts also show Microsoft-side details, such as job title, department and when the password was last changed. Entra ID has no lockout status.
- Other Connectors
- Each system shows what its connector reports, such as locked or disabled status, account and password expiry, password age and last logon.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
What can the help desk see in View Account?
For each connected system: whether the account is locked or disabled, account and password expiry, password age and last logon, as that system reports them. It also shows the user's groups, manager and contact details. Entra ID sign-in details are included on the current (.NET 10) server.
Is it logged when an agent looks at someone's account?
On the current (.NET 10) server, yes: each view is written to the audit log.
Can Avabot show me another user's account status?
Yes, if you hold the View Account help desk delegation.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
View Account
You've Automated the System. Now Secure the Credentials.
Help desk agents see a user's account status on every connected system before they act.