Custom Attributes in Entra ID -- Use Cases

By DavidLundell October 1, 2025

This article is the seventh in a series about Custom Attributes in Entra ID and will discuss the use cases

of each these approaches.

  1. Names and aliases
  2. Naming Conventions
  3. Resource Types
  4. Data Types
  5. Lifecycle
  6. Limitations
  7. Use Cases
  8. Decision Tree
Use Cases Extension attributes Directory Extensions Schema Extensions Open Extensions Custom Security Attributes
Visible on Profile Card Y N N N N
Exchange Dynamic Groups Y N N N N
Group Dynamic Membership Rule Y Y N N N
Administrative Unit Dynamic Membership rule Y Y N N N
Inbound Cloud Provisioning Y Y N N N
Cloud User App Provisioning Y Y N N N
User App Provisioning Filtering Y Y N N N
On Premise Sync Y Y N N N
Cross Tenant Sync Y Y N N N
Customized Token Claims Y Y N N N**
Entra ID DS Y Y N N N
Graph Filterable Y Y Y N Y
Azure B2C Y Y N N N
External ID Custom User Attributes N Y N N N
Restricted Access/Sensitive Data N N N N Y
Conditional Access Filter on Enterprise Applications N N N N Y
Conditional Access Filter on Devices Y N N N N
Conditional Access Filter on Users and Groups (via Dynamic Group Membership) Y Y N N N
UI to manage the customizations N/A N* N N Y
Azure ABAC N N N N Y
Lifecycle Workflows: Scope Filter Y Y N N Y
Lifecycle Workflows: Trigger Attributes N N N N N
Access package assignment Policy Y Y N N N

Recall that we only have 15 Extension Attributes and there are two use cases for users that can only be done using them: Making custom data visible on the Profile Card and using Custom Data in membership rules for Exchange Online Dynamic Groups. We have no other way to do these things.

Only Extension Attributes can be added to the Profile Card and show up “Teams, Outlook, or other Office apps and services.”

Extension Attributes also have an exclusive on using Custom Data for Conditional Access Filters for Devices.

Custom Security Attributes have three exclusive use cases:

Custom Security Attributes can be used in conjunction with resource tags inside of Azure ABAC to do finer grained access control. For example you could grant read and/or write permissions to certain Azure resources, such as blobs that have an index tag that matches a custom security attribute on a user or Enterprise Application.

Conditional Access Filter on Enterprise Applications can provide a great help to categorizing Enterprise Applications (Service Principals, which includes Managed Identities) and then being apply to apply Conditional Access Policies in systematized categoric way. For example one client has many Storage Account Enterprise Apps that they had excluded individually creating a management headache.

Search

Categories

Tags