Create Custom User Attribute in Azure AD

Like on-premises Active Directory, Azure AD is used to store various objects (users, groups, or devices). All AAD objects have a predefined set of attributes that can be configured using the Azure AD portal or PowerShell. In addition to the standard set of attributes, you can add additional attributes for your AAD users. For example, custom ADDS attributes can be added to the on-premises Active Directory schema and then synced as an extension attribute of Active Directory users using Azure AD Connect.

Azure AD recently introduced a new feature that allows you to create your own custom security attributes to help you extend user profiles. Custom security attributes are business-specific attributes (key-value pairs) that can be configured and assigned to Azure AD objects. Custom user security attributes are supported in the Azure portal, PowerShell, and the Microsoft Graph API (but not in the Microsoft 365 Admin Center).

To create custom security attributes in Azure AD:

• You have at least an Azure AD Premium P1 subscription.
• The Attribute definition administrator role must be assigned to your account (by default, the Global Administrator and Privileged Role Administrator roles do not have privileges to add custom security attributes).

1. Sign in to Azure AD Portal.
2. Go to Azure Active Directory > Roles and administrators.
   Assign the following roles to your account:
   — Attribute assignment administrator.
   — Attribute assignment reader.
   — Attribute definition administrator.
   — Attribute definition reader/
   
3. Sign out of the Azure Portal and sign in again before you will be able to create attribute definitions;
4. Go to Azure Active Directory > Custom security attributes, click on the Add attribute button;
   
5. Type the name of the new attribute set and the maximum number of attributes in it;
6. Now select your attribute set and click on Add attribute;
7. You need to specify the attribute name, description, data type (String/Boolean/Integer);
8. You can use multi-value attributes. Also, you can set a predefined list of values for String and Integer attribute types;
9. Now you need to assign the new set of attributes to a supported AAD object type. In this example, we’ll assign a new set of attributes to the user;
10. Go to AAD Users > select a user > select the Custom security attributes > click on Add assignment;
11. Select the previously created attribute and set its value.

Note that user attributes and attribute sets cannot currently be deleted. They can only be deactivated.

AAD’s custom security attributes are currently in the preview stage, but should soon be available to all Azure tenants.