A single security principal—usually a user account—that is created in Active Directory Domain Services (AD DS) and used to map to a single federated user.