Troubleshooting Duplicate Users: Why Does One User Appear Twice in the 'Reporter' Field?

[Prasad Bonthu]

Hello everyone,

I've come across an interesting issue and would appreciate any insights.

An end user reported that she was unable to view all of the tickets she had submitted. During my investigation, I discovered two separate entries for the same user in the 'Reporter' field drop-down menu.

As a temporary fix, I manually updated the 'Reporter' field on her tickets to the correct user profile, which resolved her visibility problem.

However, I need to understand the root cause. I was able to extract the user IDs for both accounts and can confirm they are different. When I checked the audit logs for user invitations, I only found a single invitation sent on June 12th. The strange part is that the user showed me an email notification she received from our system on June 5th, a full week before she was formally invited.

My questions are:

1. What is the best way to identify and investigate this "ghost" user account?

2. How could she have been added to the system on June 5th without an official invitation?

Thanks in advance for your help!

[Marc - Devoteam · Accepted solution]

Hi @Prasad Bonthu 

This could be that this user was set as a request participant by another user or a request was shared from the portal.

This user or agent might have used a different email address, then the one you used to invite the user on the 12th.

[Prasad Bonthu]

@Marc - Devoteam and @Utkarsh Agarwal 

Thanks for the previous replies, they were very helpful.

I have confirmed that both user accounts have the same email address and the duplicate user is in the "Customer" category.

My question is, why is there no "Add Customer" event for this user in the audit logs? I feel like this action should have been recorded.

[Marc - Devoteam]

Hi @Prasad Bonthu 

Customer additions are not logged.

There is an open feature request you can vote for and follow, see JSDCLOUD-10450 

[Prasad Bonthu]

Voted

[Utkarsh Agarwal]

Hi @Prasad Bonthu 

This is an interesting case, and based on similar scenarios I’ve encountered, here are some possible causes and investigation steps:

Possible Reasons for the Duplicate ("Ghost") Account

1. Migration Artifacts – If your instance underwent an on-prem to cloud or cloud-to-cloud migration, a user might have been created earlier with a different account ID, resulting in two separate profiles.
2. Active Directory / Identity Provider Sync – If your site syncs with AD or an IdP (Okta, Azure AD, etc.), the user may have been provisioned automatically before the formal invitation.
3. Domain-Based Auto-Access – If your site access settings allow anyone with a specific domain to join automatically, the user could have been created on June 5th when she first accessed the site (even before being officially invited).

Steps to Investigate the "Ghost" Account

• Check User Management – Compare both accounts’ email addresses. Ensure there isn’t a typo or alias (e.g., jane.doe@ vs jane_doe@). Each user must have a single unique email.
• Audit Logs Beyond Invitations – Look for any "user created" or "site access granted" events around June 5th. Not all activities appear under “invitations,” so expand your search to product access logs.
• Check Site Access Settings – Review whether "Anyone with [company domain] can join" was enabled.
• Review Identity Provider Logs – If SCIM provisioning is used, check if the user was auto-provisioned via IdP before the formal invite.

Preventive Measures

• Ensure strict domain access controls are in place.
• Regularly audit for duplicate or inactive accounts.
• Follow best practices for user provisioning—SCIM/IdP syncs are more reliable than manual invitations.

Kind Regards
Utkarsh

[Marc - Devoteam]

Hi,

Thanks for this addition, but this is AI generated context an is not directly related to the question asked.

[Utkarsh Agarwal]

Sorry, but these are not AI-generated; these are based on my experiences.