Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://learn.microsoft.com/en-us/entra/fundamentals/custom-security-attributes-overview below:

What are custom security attributes in Microsoft Entra ID? - Microsoft Entra

Custom security attributes in Microsoft Entra ID are business-specific attributes (key-value pairs) that you can define and assign to Microsoft Entra objects. These attributes can be used to store information, categorize objects, or enforce fine-grained access control over specific Azure resources. Custom security attributes can be used with Azure attribute-based access control (ABAC).

Here are some scenarios where you could use custom security attributes:

• Extend user profiles, such as add Hourly Salary to all my employees.
• Ensure only administrators can see the Hourly Salary attribute in my employees' profiles.
• Categorize hundreds or thousands of applications to easily create a filterable inventory for auditing.
• Grant users access to the Azure Storage blobs belonging to a project.

Custom security attributes include these capabilities:

• Define business-specific information (attributes) for your tenant.
• Add a set of custom security attributes on users and applications.
• Manage Microsoft Entra objects using custom security attributes with queries and filters.
• Provide attribute governance so attributes determine who can get access.

Custom security attributes aren't supported in the following areas:

• Microsoft Entra Domain Services
• Security Assertion Markup Language (SAML) token claims

Custom security attributes include these features:

• Available tenant-wide
• Include a description
• Support different data types: Boolean, integer, string
• Support single value or multiple values
• Support user-defined free-form values or predefined values
• Assign custom security attributes to directory synced users from an on-premises Active Directory

The following example shows several custom security attributes assigned to a user. The custom security attributes are different data types and have values that are single, multiple, free-form, or predefined.

You can add custom security attributes for the following Microsoft Entra objects:

• Microsoft Entra users
• Microsoft Entra enterprise applications (service principals)

While both extensions and custom security attributes can be used to extend objects in Microsoft Entra ID and Microsoft 365, they are suitable for fundamentally different custom data scenarios. Here are some ways that custom security attributes compare with extensions:

For more information about working with extensions, see Add custom data to resources using extensions.

1. Check permissions

   Check that you are assigned the Attribute Definition Administrator or Attribute Assignment Administrator roles. If necessary, someone with at least the Privileged Role Administrator role can assign these roles.

2. Add attribute sets

   Add attribute sets to group and manage related custom security attributes. Learn more

3. Manage attribute sets

   Specify who can read, define, or assign custom security attributes in an attribute set. Learn more

4. Define attributes

   Add your custom security attributes to your directory. You can specify the date type (Boolean, integer, or string) and whether values are predefined, free-form, single, or multiple. Learn more

5. Assign attributes

   Assign custom security attributes to Microsoft Entra objects for your business scenarios. Learn more

6. Use attributes

   Filter users and applications that use custom security attributes. Learn more

   Add conditions that use custom security attributes to Azure role assignments for fine-grained access control. Learn more

To better understand custom security attributes, you can refer back to the following list of terms.

The following table lists the properties you can specify for attribute sets and custom security attributes. Some properties are immutable and cannot be changed later.

Here are some of the limits and constraints for custom security attributes.

Microsoft Entra ID provides built-in roles to work with custom security attributes. The Attribute Definition Administrator role is the minimum role you need to manage custom security attributes. The Attribute Assignment Administrator role is the minimum role you need to assign custom security attribute values for Microsoft Entra objects like users and applications. You can assign these roles at tenant scope or at attribute set scope.

Important

By default, Global Administrator and other administrator roles do not have permissions to read, define, or assign custom security attributes.

You can manage custom security attributes programmatically using Microsoft Graph API. For more information, see Overview of custom security attributes using the Microsoft Graph API.

You can use an API client such as Graph Explorer to more easily try the Microsoft Graph API for custom security attributes.

Using this feature is free and included in your Azure subscription.

• Add or deactivate custom security attribute definitions in Microsoft Entra ID
• Manage access to custom security attributes in Microsoft Entra ID
• Assign, update, list, or remove custom security attributes for a user
• Provision custom security attributes from HR sources (preview)

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4