nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Troubleshooting Duplicate Users: Why Does One User Appear Twice in the 'Reporter' Field?

Prasad Bonthu

Hello everyone,

I've come across an interesting issue and would appreciate any insights.

An end user reported that she was unable to view all of the tickets she had submitted. During my investigation, I discovered two separate entries for the same user in the 'Reporter' field drop-down menu.

As a temporary fix, I manually updated the 'Reporter' field on her tickets to the correct user profile, which resolved her visibility problem.

However, I need to understand the root cause. I was able to extract the user IDs for both accounts and can confirm they are different. When I checked the audit logs for user invitations, I only found a single invitation sent on June 12th. The strange part is that the user showed me an email notification she received from our system on June 5th, a full week before she was formally invited.

My questions are:

What is the best way to identify and investigate this "ghost" user account?
How could she have been added to the system on June 5th without an official invitation?

Thanks in advance for your help!

Accepted answers

Marc -Devoteam-

Hi @Prasad Bonthu

This could be that this user was set as a request participant by another user or a request was shared from the portal.

This user or agent might have used a different email address, then the one you used to invite the user on the 12th.

All comments

Marc -Devoteam-

Hi @Prasad Bonthu

This could be that this user was set as a request participant by another user or a request was shared from the portal.

This user or agent might have used a different email address, then the one you used to invite the user on the 12th.

Utkarsh Agarwal

Hi @Prasad Bonthu

This is an interesting case, and based on similar scenarios I’ve encountered, here are some possible causes and investigation steps:

Possible Reasons for the Duplicate ("Ghost") Account

Migration Artifacts – If your instance underwent an on-prem to cloud or cloud-to-cloud migration, a user might have been created earlier with a different account ID, resulting in two separate profiles.
Active Directory / Identity Provider Sync – If your site syncs with AD or an IdP (Okta, Azure AD, etc.), the user may have been provisioned automatically before the formal invitation.
Domain-Based Auto-Access – If your site access settings allow anyone with a specific domain to join automatically, the user could have been created on June 5th when she first accessed the site (even before being officially invited).

Steps to Investigate the "Ghost" Account

Check User Management – Compare both accounts’ email addresses. Ensure there isn’t a typo or alias (e.g., jane.doe@ vs jane_doe@). Each user must have a single unique email.
Audit Logs Beyond Invitations – Look for any "user created" or "site access granted" events around June 5th. Not all activities appear under “invitations,” so expand your search to product access logs.
Check Site Access Settings – Review whether "Anyone with [company domain] can join" was enabled.
Review Identity Provider Logs – If SCIM provisioning is used, check if the user was auto-provisioned via IdP before the formal invite.

Preventive Measures

Ensure strict domain access controls are in place.
Regularly audit for duplicate or inactive accounts.
Follow best practices for user provisioning—SCIM/IdP syncs are more reliable than manual invitations.