Employee Identification

ControlUp identifies the employee using a device by their UPN (the user's work email address). All Employees dashboards group data by this UPN.

How ControlUp finds the UPN depends on the device's operating system. On Windows, ControlUp uses the account the user signed in to the device with. On macOS, there's no single sign-in UPN, so ControlUp looks for a work email address in accounts signed in on the Mac.

Identification on Windows devices

ControlUp identifies the employee on a Windows device using the following rules:

1. Device sign-in account: If the user signs in to the device with an Active Directory or Microsoft Entra ID account, ControlUp uses that account's UPN.
   • If you haven't created an approved domains list, the UPN is accepted as is.
   • If you have created an approved domains list, the UPN's domain must be on the list.
2. Application accounts: If the first rule doesn't identify the employee, and you have created an approved domains list, ControlUp checks the accounts used to sign in to Microsoft 365, Microsoft Teams, Microsoft Edge, Google Chrome, and the Remote Desktop client.
   • An application account identifies the employee only if the account's domain is on the approved list. This prevents ControlUp from identifying users by non-corporate accounts.
   • If multiple approved application accounts are found, the one matching the primary domain takes priority. If none of the accounts are in the primary domain, the most common account is used.

On Windows, a domain on the approved list also matches its subdomains. For example, if example.com is approved, oliver.smith@uk.example.com is accepted.

Identification on macOS devices

macOS doesn't have a single sign-in UPN, so ControlUp looks for email addresses in accounts signed in on the Mac. It checks these sources, in order:

1. The user's macOS directory account, including Microsoft Entra Platform SSO
2. Microsoft Teams and Microsoft Office sign-in
3. Google Chrome profile sign-in
4. Other email sources on the Mac

ControlUp uses an address in the primary domain first. If it doesn't find one, it uses an address in any other approved domain.

To identify employees on macOS, all of the following must be true:

• You have created an approved domains list. If the list is empty, ControlUp doesn't identify any Mac users, and macOS devices don't appear in Employees dashboards. This prevents personal email addresses, such as a Gmail account signed in to Chrome, from identifying the employee.
• The user's email domain exactly matches an approved domain. On macOS, subdomains don't match. If example.com is approved, oliver.smith@uk.example.com isn't accepted. Add each subdomain your Mac users' email addresses use.
• The user is signed in to a work account on the Mac in an approved domain, for example through Platform SSO, Teams or Office, or Chrome. A Mac with only a local account and no work sign-ins can't identify the employee.
• A user is logged in at the Mac. ControlUp can't identify the employee while the Mac is at the login window.

Approved domains

An approved domains list controls which accounts can identify employees. When you approve at least one domain, accounts in domains not on the list are excluded.

You need an approved domains list if you have macOS devices, or if you want to identify Windows employees by the accounts signed in to applications.

To create a list of approved domains:

1. Go to Settings > Experience Score > Privacy.
2. Click +Approve Domain, enter a domain (for example, controlup.com), and click Submit.
3. Repeat step 2 for each additional domain. If you have Mac users, include every subdomain their email addresses use.

Primary domain

If you create a list of approved domains, you must set one of the domains as the Primary Domain. When a user has accounts in more than one approved domain, the account in the primary domain takes priority.

• Windows: The primary domain applies when the device sign-in account doesn't identify the employee and there are multiple approved application accounts. If none of the accounts match the primary domain, the most commonly used account identifies the employee.
• macOS: ControlUp looks for an address in the primary domain first, then in any other approved domain.

Examples

Windows: Identification without an approved domains list

In these scenarios, no domains are in the approved domains list (the default configuration).

Windows: Identification with an approved domains list

In this scenario, controlup.com is the only approved domain.

Windows: Identification with a primary domain

In these scenarios, acme.org and controlup.com are both approved domains. controlup.com is the primary domain.

macOS: Identification