any—(default) Include any user, regardless of user data.

pre-logon—Include remote users who are connected to the network using GlobalProtect™, but are not logged into their system. When the Pre-logon option is configured on the Portal for GlobalProtect apps, any user who is not currently logged into their machine will be identified with the username pre-logon. You can then create policies for pre-logon users and although the user is not logged in directly, their machines are authenticated on the domain as if they were fully logged in.

known-user—Includes all authenticated users, which means any IP address with user data mapped. This option is equivalent to the “domain users” group on a domain.

unknown—Includes all unauthenticated users, which means IP addresses that are not mapped to a user. For example, you could select unknown for guest-level access to something because they will have an IP address on your network, but will not be authenticated to the domain and will not have IP address-to-user mapping information on the firewall.