Technical Tip: Differences between the blue and orange icons for the people icon in logs

[VinayHM]

Description	This article explains the differences between the blue and orange icons in the forward logs.
Scope	FortiGate.
Solution	There are two icons displayed in the forward traffic or the FortiView session.   Blue Icon: Represents user sessions authenticated via centralized authentication methods like FSSO (Fortinet Single Sign-On), LDAP, RADIUS, etc. These sessions are tied to users authenticated through external identity providers. Orange Icon: Indicates device detection-based sessions, where Fortinet identifies users or devices directly through device detection mechanisms rather than centralized authentication. This could include devices detected via network traffic or device fingerprinting.