Azure AD Connect sync: Directory extensions

You can use directory extensions to extend the schema in Azure Active Directory (Azure AD) with your own attributes from on-premises Active Directory. This feature enables you to build LOB apps by consuming attributes that you continue to manage on-premises. These attributes can be consumed through Azure AD Graph API directory extensions or Microsoft Graph. You can see the available attributes by using Azure AD Graph Explorer and Microsoft Graph Explorer, respectively.

At present, no Office 365 workload consumes these attributes.

You configure which additional attributes you want to synchronize in the custom settings path in the installation wizard.


The Available Attributes box is case-sensitive.

Schema extension wizard

The installation shows the following attributes, which are valid candidates:

  • User and Group object types
  • Single-valued attributes: String, Boolean, Integer, Binary
  • Multi-valued attributes: String, Binary


Although Azure AD Connect supports synchronizing multi-valued Active Directory attributes to Azure AD as multi-valued directory extensions, there is currently no way to retrieve/consume the data uploaded in multi-valued directory extension attributes.

The list of attributes is read from the schema cache that's created during installation of Azure AD Connect. If you have extended the Active Directory schema with additional attributes, you must refresh the schema before these new attributes are visible.

An object in Azure AD can have up to 100 attributes for directory extensions. The maximum length is 250 characters. If an attribute value is longer, the sync engine truncates it.

During installation of Azure AD Connect, an application is registered where these attributes are available. You can see this application in the Azure portal.

Schema extension app

The attributes are prefixed with the extension _{AppClientId}_. AppClientId has the same value for all attributes in your Azure AD tenant.

These attributes are now available through the Azure AD Graph API. You can query them by using Azure AD Graph Explorer.

Azure AD Graph Explorer

Or you can query the attributes through the Microsoft Graph API, by using Microsoft Graph Explorer.


You need to ask for the attributes to be returned. Explicitly select the attributes like this:$select=extension_9d98ed114c4840d298fad781915f27e4_employeeID,extension_9d98ed114c4840d298fad781915f27e4_division.

For more information, see Microsoft Graph: Use query parameters.

Next steps

Learn more about the Azure AD Connect sync configuration.

Learn more about Integrating your on-premises identities with Azure Active Directory.