Can you add an attribute store to Azure Active directory store like you can in ADFS?

Ron Houet 56 Reputation points
2021-07-01T14:00:47.557+00:00

We are looking to migrate our (on-premise) ADFS environment to Azure AD.
But we are using ID's from an external partner with extra security requirements, i.e. these attributes have to be stored in it's own encrypted secure database.
On-premise within ADFS this is solved by adding an extra SQL attribute store.

Is this possible with Azure AD?

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,195 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,569 questions
0 comments
Accepted answer
  1. Siva-kumar-selvaraj 15,551 Reputation points
    2021-07-13T07:41:33.313+00:00

    As of today, there are no attribute stores in AAD.

    If synchronizing from On-premises is not an option for you, then I would recommend Azure AD directory schema extension attributes which provides a way to store additional data in Azure Active Directory on user objects and other directory objects such as groups, tenant details, service principals. Only extension attributes on user objects can be used for emitting claims to applications.

    Directory schema extension attributes are always associated with an application in the tenant. To learn more about : https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-schema-extensions

    Hope this helps.

    Regards,
    Siva

    2 people found this answer helpful.
    0 comments

3 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee
    2021-07-01T17:56:50.367+00:00

    You might be able to synchronize things to the account itself through Azure AD Connect. But it will then be readable by the users (as there's no confidential attributes in AAD like in AD).

    As of today, there are no attribute stores in AAD.

    1 person found this answer helpful.
  2. Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee
    2021-10-13T01:34:19.04+00:00

    There is a sort of a workaround. Which might not fit your scneario, but worth a shot.

    You could keep the app in ADFS but use AAD as a Claim Provider Trust (CPT, inother words as an identity provider) in ADFS. You then associate this CPT with your app in ADFS. When users try to connect to the app, they get redirected to AAD for authentication. Then once you get your token, you can access ADFS and ADFS will give you a token. This token can be "enriched" with issuance claim rules which get the things you want (as long as ADFS can read the attribute).

    If your intent was to use AAD as an IDP, this way you can get AAD authentication in your app.
    But your app is not in AAD. AAD will see your ADFS farm as an app. So you can't really do Conditional Access Policies (well you can but you have to consider it is CAP for ADFS as an app, not your app). That shouldn't be a major issue if that app is the only one you want to use that workaround for. As soon as you have two, then you won't be able to distinguished them in AAD (and there won't be able to apply specific CAP).

    If your intent is to remove ADFS, that doesn't solve the problem as in that workaround you rely on ADFS to trust your app.

    1 person found this answer helpful.
  3. Ron Houet 56 Reputation points
    2021-07-07T11:42:44.573+00:00

    No one with an answer?
    Would be nice if someone of Microsoft's Azure team could answer whether this is possible or not.