Application Extended attribute for user mapping - how can I populate it when a new Azure AD user is created?

Question

We're using Azure Connect to populate Azure with users. There's a couple of attributes that I need to use when provisioning a user to an application but the user mapping doesn't support some of the attributes for said mapping (onPremisesDistinguisedName and a multi-value extended attribute).

Is there a way to, when a user is synced from AD, have a flow or some automated routine populate a couple of application extended attributes?

Answer 1

To succinctly summarize the below: Not all attributes are available for Azure AD Provisioning, and there may not always be a workaround. The longer explanation is:

The Azure AD Provisioning service uses AAD Graph API to read data from Azure AD, and that API has a limited set of attributes that can be read. This is documented here (https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/customize-application-attributes#editing-the-list-of-supported-attributes) specifically with the link in this bullet point:

Azure Active Directory (Azure AD Graph API default attributes and custom directory extensions are supported). Learn more about creating extensions and known limitations.

onPremisesDistinguishedName can only be read via MS Graph, and is therefore not usable by AAD Provisioning.

Multi-valued directory/schema extensions can be populated by Azure AD Connect, but cannot be read by most(or all? not sure on the current state) services, including AAD Provisioning.

You also cannot use the Azure AD Connect Directory Extensions feature to extend distinguishedName into Azure AD, as the DN attribute is referential and therefore not eligible for extending.

Specific to the distinguishedName problem, you should be able to create a custom sync rule in Azure AD Connect to flow the string value of the DN into an empty string attribute - something like ExtensionAttribute15 for instance, and then consume that with Azure AD Provisioning. .

Answer 2

Thanks for the direct response ZollnerD.