Extension attributes

A predefined set of attributes is available for user entities and is routinely imported and managed. To extend this set, additional user attributes can be configured, up to a maximum of 45. In this article, these are referred to as extension attributes.

This functionality allows extension attributes to be configured in the portal. They can be imported through full imports and on-premises imports, managed through supported management actions, and used in Virtual Tenant filters, reports, and user entities.

Configuration requirements for cloud-only attributes

These attributes are hosted in Microsoft Entra ID as directory extensions / extension properties.

Microsoft documentation:

• Add custom data to resources using extensions - Microsoft Graph
• extensionProperty resource type (directory extensions) - Microsoft Graph v1.0

$applications = Get-MgApplication
foreach ($app in $applications) {
    $extensionProperties = Get-MgApplicationExtensionProperty -ApplicationId $app.Id
    if ($extensionProperties) {
        Write-Output "Application ID: $($app.Id)"
        Write-Output "Application Name: $($app.DisplayName)"
        Write-Output "Extension Properties:"
        $extensionProperties | Format-Table Id, Name, DataType
        Write-Output "`n"
    }
}

On-premises directory extensions

The default Active Directory schema includes the main attributes most organizations need. In some scenarios, additional attributes may need to be created and linked to the user class.

This article does not describe how to create new attributes directly in Active Directory. For that process, refer to the Microsoft Entra Connect documentation when the goal is to synchronize on-premises attributes to Microsoft Entra ID as directory extensions.

To obtain a list of on-premises attributes that can be integrated with the platform, use the PowerShell command below:

PowerShell command

#include DataTypes: Bool(1), Int(2), GeneralizedTime (23-24) and DirectoryString(64)
$allowedTypes = 1,2,23,24,64
$schemaNaming = (Get-ADRootDSE).schemaNamingContext
$attr = (Get-ADObject -SearchBase $schemaNaming -Filter * -Properties lDAPDisplayName, omSyntax).Where({ $allowedTypes -contains $_.omSyntax}) | Select-Object lDAPDisplayName, @{
Name = 'DataType'; Expression ={
if( $_.omSyntax -eq 1){
"Bool"
}
elseif( $_.omSyntax -eq 2){
"Int"
}
elseif( $_.omSyntax -eq 23 -or $_.omSyntax -eq 24){
"DateTime"
}
else{
"String"
}
}
} | Sort-Object lDAPDisplayName
$attr | Out-GridView

Attributes that cannot be imported into CoreView

Unicode string attributes that can contain multiple values are not currently supported. This occurs when the value returned from Active Directory is stored as an ADPropertyValueCollection.

To check whether an on-premises attribute can be imported, run the following commands:

$user = Get-ADUser -Identity $identity -Properties postOfficeBox

$user.postOfficeBox.GetType()

If the result is ADPropertyValueCollection, the attribute cannot be imported, because it is an array and not a string.

 

 

 

The script output includes two properties: LDAP display name and Data type.
The attributes listed below cannot be configured, because they are already imported automatically:

Synchronized directory extensions

These are on-premises Active Directory attributes synchronized to Microsoft Entra ID.

To synchronize on-premises attributes to Microsoft Entra ID as directory extensions, refer to the Microsoft guide: Microsoft Entra Connect Sync: Directory extensions.

Synchronized attributes may keep their on-premises name or appear with the cloud extension naming pattern. Because of this, the recommended approach is to use the name as it appears after synchronization. This helps ensure the attribute is recognized correctly in both on-premises and cloud environments.

To synchronize these attributes, the on-premises attributes must first be selected for synchronization in Microsoft Entra Connect. After synchronization completes, the attributes are also available in the cloud and can be listed using the cmdlet provided in the cloud section.

Once synchronized, these attributes can be assigned to all users, whether they are cloud-only, on-premises, or synchronized users.

Instructions for setting attributes in CoreView

Although several data types can exist in the local environment, CoreView supports only four data types. Each type has a fixed number of slots:

• String - 30 slots
• Integer - 5 slots
• Boolean - 5 slots
• DateTime - 5 slots

If the required permissions to modify organization settings are available, these attributes can be configured as follows:

1. Go to Settings > My organization > Settings > Extension attribute mapping.
2. For each attribute, configure the following values:

• Account Type (On-Cloud, On-Premises, or Synchronized)
• Extension Name (Microsoft name)
• Friendly Name
• Data Type (String, Int, Bool, or DateTime)

 

 

Extension name formats

The extension name format depends on the selected account type:

extension_{applicationId}_{attributeGivenName}

extension_{applicationId}_{attributeGivenName}

Friendly name

The friendly name is an internal label used to identify each configured attribute clearly. It is the value shown in reports as the column title, in Virtual Tenant settings, and in management actions.

For on-cloud patterns, the friendly name defaults to attributeGivenName. A different label can be assigned if needed.

Using configured attributes in CoreView

Configured extension attributes can be used in several areas of the portal:

Import functions

• Full import: every 24 hours.
• On-premises import: every 6 hours.

Reports

In user-related reports, columns can be added using the configured friendly names, and filters can be applied accordingly.

Virtual Tenant

Configured attributes appear as delegation filters for users. They can be searched by friendly name and used in Virtual Tenant configurations.

Management actions (accessible only through the wizard)

• User category:
  • Create user
  • Edit user properties
  • Edit user properties in bulk
  • Set portal attributes
• On-premises category:
  • Create on-premises user
  • Create synchronized user
  • Edit user properties
  • Edit synchronized user

Basic rules for actions

• If the attribute is on-cloud, it is available for all cloud users and synchronized users. For synchronized users, it is written only in Microsoft Entra ID.
• If the attribute is on-premises, it is available for on-premises users and synchronized users. For synchronized users, it is written only in the local Active Directory.
• If the attribute is synchronized, it can be set for all users. Depending on the user type, it is visible only in Microsoft Entra ID for cloud users, only in local Active Directory for on-premises users, or in both directories for synchronized users.