Syncing Active Directory attributes to Entra ID (directory extensions)

Overview

Opensense syncs user data from Microsoft Entra ID (formerly Azure Active Directory, or Azure AD). It can only sync attributes that exist in Entra ID. If a field you want in your signatures exists only in your on-premises Active Directory, for example a custom attribute your organization added, sync it to Entra ID first with the directory extensions feature of Microsoft Entra Connect (formerly Azure AD Connect). Opensense can then sync it like any other field.

For Microsoft’s full instructions, see Microsoft Entra Connect Sync: Directory extensions.

How it fits together

1. In Microsoft Entra Connect, sync the attribute to Entra ID as a directory extension. See Syncing an attribute with directory extensions.
2. Find the attribute name and your Azure tenant ID, and send them to your Opensense representative. See Syncing extension attributes from Azure AD (Entra ID).
3. Opensense syncs the field. Changes in Active Directory can take time to reach Entra ID and then Opensense. See Why Active Directory changes take time to reach Opensense.

Syncing an attribute with directory extensions

A Microsoft administrator does these steps on the server that runs Microsoft Entra Connect:

1. Open the Microsoft Entra Connect wizard, and use the custom settings.
2. On the Optional Features page, select Directory Extension attribute sync.
3. On the Directory Extensions page, select the attributes to sync. The Available Attributes field is case sensitive.
4. Finish the wizard.

New attributes in your Active Directory schema

Microsoft Entra Connect reads the list of attributes from the Active Directory schema when it is installed. If you added custom attributes to the schema later, refresh the directory schema in Microsoft Entra Connect before they appear.

What to know about directory extensions

Attribute name in Entra ID

A synced attribute appears in Entra ID as extension_{ApplicationId}_<attributeName>, where ApplicationId is the application ID of the Tenant Schema Extension App. Opensense needs this full name to sync the field.

Supported attributes

Attributes on user and group objects. Single-valued string, Boolean, integer, and binary attributes, and multi-valued string and binary attributes.

Limits

An object can have up to 100 directory extension values. A string value can be up to 256 characters; longer values are truncated.

Don’t delete the Tenant Schema Extension App

Microsoft Entra Connect registers an app named Tenant Schema Extension App in Entra ID to hold these attributes. Deleting its service principal breaks the synchronization.

What’s next

• Syncing extension attributes from Azure AD (Entra ID): find the attribute name and tenant ID, and send them to Opensense.
• What Azure Active Directory fields can be used when syncing with Opensense?: the fields Opensense syncs by default.
• Why Active Directory changes take time to reach Opensense: why directory changes take time to appear.