What sorts of extension attributes can be found in Entra ID?

Extension attributes in Entra ID supply extra flexibility and customization choices. Customized attributes help you retailer further data to extra successfully handle person accounts and personalize functions. Find out how extension attributes and schema extensions differ, together with their use circumstances and limitations.

What are extension attributes in Entra ID and what varieties are there?

In Entra ID (previously Azure AD) there are two fundamental classes for the implementation of customized attributes: Extension attributes and schema extensions. This distinction permits versatile customization of identification objects resembling person accounts and teams to satisfy particular necessities of organizations that transcend the usual attributes.

Extension attributes

Extension attributes present a easy and immediately accessible methodology of storing further data in identification objects. Entra ID accommodates a lot of ready-made extension attributes (for instance, extensionAttribute1 to extensionAttribute15) which can be accessible with out prior configuration. These attributes are notably helpful as they allow fast implementation with out the necessity for complicated changes to the schema. The values of those attributes might be set each by way of the Entra ID Admin Middle and programmatically by way of the Microsoft Graph API, which permits a excessive diploma of flexibility in administration.

Schema extensions

Along with the usual extension attributes, there are schema extensions that permit deeper customization of the Entra ID schema. In distinction to the predefined extension attributes, schema extensions permit the addition of utterly user-defined attributes to numerous identification objects. This flexibility makes it doable to help extra complicated necessities and eventualities. In these circumstances, particular knowledge fashions are required that transcend the usual attributes and the easy extension attributes. Nonetheless, using schema extensions requires cautious planning and implementation as they immediately change the underlying schema of Entra ID.

Extension attributes play an essential position in Entra ID

In abstract, extension attributes and schema extensions in Entra ID present two highly effective mechanisms for extending and personalizing identification administration inside a corporation. Whereas extension attributes present a easy and out-of-the-box answer for extra person knowledge, schema extensions permit deep customization of the listing schema for extra complicated necessities. The selection between these choices will depend on the particular wants and eventualities of a corporation.

Why are Entra ID extension attributes wanted?

The customized attributes can be utilized to retailer person addresses, for instance within the house workplace, or safety features and knowledge that’s essential for person task. Lastly, the attributes make the person accounts extra versatile and simpler to filter.

Attribute extensions will also be used to filter dynamic teams. The filters might be arrange on the idea of the company-specific Entra ID extension attributes and might due to this fact be used flexibly.

Create guidelines for dynamic memberships in Entra ID

If further options resembling my-IAM DynamicSync are used on this context, the customized attributes are shortly and simply added as filters within the DynamicSync configurator. These attributes are then completely accessible as a dynamic filter.

The attributes additionally play an essential position within the synchronization of native AD environments with Entra ID.

Prolong Entra ID listing schema with AD attributes

The listing schema in Entra ID might be prolonged with your individual attributes from a neighborhood Lively Listing. This performance permits organizations to retailer further details about person accounts that goes past the usual attributes. This may be helpful, for instance, for managing worker IDs, departmental affiliations that aren’t immediately mapped in the usual attribute set, or for particular use circumstances resembling entry management and personalization of functions.

This makes it doable to convey your individual attributes from the AD to the cloud by way of person synchronization and use them there. This provides varied benefits, for instance:

• simpler filtering of customers and teams,
• extra versatile task of authorizations and roles and
• a company-specific task of customers from Entra ID to your individual functions.

With Microsoft Entra Join, corporations can proceed to handle user-defined attributes for business software program domestically and use them within the cloud on the similar time.

What are some great benefits of customized attributes?

Let’s assume an organization desires to get a fast overview of all workers engaged on a selected undertaking who even have a selected safety clearance. For this goal, user-defined attributes resembling “ProjectID” and “SecurityClearanceLevel” might be created and assigned to the person profiles. In the identical means, it’s also doable to create attributes for task to dynamic teams.

Directors can outline a question utilizing dynamic filter queries within the administration console or by way of the API. This question solely lists the customers whose ProjectID corresponds to a sure undertaking and whose SecurityClearanceLevel exceeds a sure worth.

Microsoft has made customized attributes accessible as an possibility in Entra ID, however has made administration fairly sophisticated. Corporations that wish to use their very own filters, for instance to manage membership in dynamic teams, shouldn’t have a straightforward time with the customized attributes. By default, the filters should be added individually for every group. With numerous teams, that is very cumbersome and time-consuming.

By utilizing options resembling my-IAM DynamicSync, this drawback might be solved shortly, because the task of attributes might be solved immediately in a transparent interface. As well as, the attributes are completely accessible within the filter for all teams. Handbook task of attributes for every particular person group, as in Entra ID, is due to this fact not obligatory. This makes using customized attributes much more efficient, as they can be utilized shortly and clearly.

The place can extension attributes not be used?

In standardized authentication and authorization processes we frequently can not use customized attributes immediately. Authentication protocols resembling OAuth2 or OpenID Join require particular customizations or extensions so as to add customized attributes to the standardized declare units.

The built-in safety and compliance features of Entra ID, resembling Conditional Entry or Identification Safety, don’t help using user-defined attributes. These providers use Entra ID’s default attributes and identification knowledge. Normally, user-defined attributes can’t be referenced or evaluated immediately inside these safety mechanisms.

When customers use third-party software program and providers that permit integration with Entra ID, they usually can not use customized attributes. Until the combination has been particularly designed to help them.

Many functions are primarily configured to deal with commonplace attributes. They don’t supply native help for importing or processing user-defined attributes.

You should use conditional entry to drive entry requests if sure situations are met.

For synchronization with different identification suppliers or listing providers resembling Lively Listing on-premises, using customized attributes might be difficult. Whereas Entra ID Join can synchronize sure customized attributes between Entra ID and the native Lively Listing, this requires further configuration and isn’t appropriate for all customized attributes or eventualities.

Customized attributes should not all the time displayed within the person interface of ordinary Entra providers and administration instruments or can’t be edited. In such circumstances, directors might have to make use of superior instruments or the Microsoft Graph API to work with customized attributes.

These limitations don’t imply that customized attributes in Entra ID should not helpful, however that organizations have to suppose via their use fastidiously. They could must be supported by further growth or configuration in order that they are often successfully built-in into a corporation’s current processes and programs.

Entra ID extension attributes with DynamicSync

With DynamicSync, my-IAM provides a cloud service that permits dynamic filters to be created and managed very flexibly in Entra ID. DynamicSync additionally helps user-defined attributes.

The improved configuration interface permits directors to assign customized attributes and use them immediately for the dynamic filters. This new function ensures that attributes are completely accessible as soon as they’ve been outlined. This provides a substantial benefit over the present dealing with in Entra ID.

DynamicSync creates filter queries for dynamic group memberships in Entra ID: Choose customized safety attributes for dynamic filters

DynamicSync additionally permits the creation of as much as 50 nested filters for dynamic teams. This helps granular and versatile group administration, even at the side of dynamic teams.

E book a DynamicSync demo

DynamicSync opens up new potentialities for position administration inside Entra ID. In distinction to the restrictions of Entra ID, DynamicSync permits the dynamic task of roles based mostly on departmental affiliations or different standards. For instance, workers can routinely obtain the suitable entry rights to view sure areas inside a cloud setting.

Neither a neighborhood set up nor an Entra ID P1 subscription is required to make use of DynamicSync. The answer can synchronize teams in Entra ID and add group members by way of dynamic filters. DynamicSync is due to this fact a complete answer for managing teams in Entra ID.

Article created: 22.04.2024