Our system has users that login via external IdP (inbound federation) and some which use okta as their identity provider (IdP). External IdP users are created without credentials. From time to time we have issues in the field where a user is incorrectly created without credentials and cannot login because they have no password (and for that reason they cannot reset their password). We usually figure this out because we see a PASSWORD_BASED_LOGIN_DISALLOWED error in the log. Aside from waiting until someone complains that they cannot login and then looking for the error in the log, is there any way to inspect a user in okta and proactively determine whether they were created as a credentialed user or whether they are configured for inbound federation?