A user domain is the part of an organisation’s environment that centres on people and their identities rather than on specific devices or networks. It includes employees, contractors and partners as users, the accounts that represent them in directories, their credentials and multifactor tokens, and the permissions, roles and group memberships that decide what they can access. It also covers the places where users interact with systems, such as logging in to laptops and mobiles, signing in to SaaS applications, using email and collaboration tools, and working remotely through VPNs or identity providers. Typical data flows here are authentication and authorisation exchanges, single sign-on hand-offs, and synchronisation of profile attributes from HR systems into directories. Common threats in this domain arise from people being targeted or making mistakes, so you see phishing, credential theft, social engineering, accidental data disclosure and misuse of privileges. The user domain meets the workstation domain at the endpoint a person holds, the application or system domain at the services they reach, and the network domains where their traffic travels. In many reference models, such as the seven-domain view used in training, it is the starting point for describing how risk enters an organisation because every other domain is reached through a user’s identity and actions.
