This ensures that the user is public, not necessarily that the tenant default is public