Azure AD and Microsoft Graph Extensions and Attributes
A comparison of the five different types of Microsoft Azure AD + Graph extensions and attributes.
| Extension Attributes 1-15 (aka onPremisesExtensionAttributes) | Directory extensions / Custom extension properties (aka AAD extensions) | Schema extensions | Open extensions | Custom security attributes | |
|---|---|---|---|---|---|
| Audience | IT Admins • Devs | IT Admins • Devs | Devs | Devs | IT Admins • Devs |
| Dynamic group membership rule | ✅ | ✅ | ❌ | ❌ | ❌ |
| Conditional Access - Users and groups | ✅ | ✅ | ❌ | ❌ | ❌ |
| Conditional Access - App Filter | ❌ | ❌ | ❌ | ❌ | ✅ |
| Conditional Access - Device Filter | ✅ | ❌ | ❌ | ❌ | ❌ |
| Admin user interface | ✅ | ❌ | ❌ | ❌ | ✅ |
| Cross-Tenant synchronization | ✅ | ✅ | ❌ | ❌ | ❌ |
| App user provisioning | ✅ | ✅ | ❌ | ❌ | ❌ |
| Entitlement Management automatic assignment | ✅ | ✅ | ❌ | ❌ | ❌ |
| Lifecycle Workflows execution conditions scope | ✅ | ✅ | ❌ | ❌ | ❌ |
| Filterable | ✅ | ✅ | ✅ | ❌ | ✅ |
| External identities - Self-service sign up flow | ✅ | ✅ | ❌ | ❌ | ❌ |
| Usable for customizing token claims | ✅ | ✅ | ❌ | ❌ | ❌ |
| Requires AAD P1/P2 license | ❌ | ❌ | ❌ | ❌ | ✅ |
| Azure ABAC | ❌ | ❌ | ❌ | ❌ | ✅ |
| Block read access | ❌ | ❌ | ❌ | ❌ | ✅ |
| Strongly typed | ❌ | ✅ | ✅ | ❌ | ✅ |
| Support multi-valued attributes | ✅ | ✅1 | ❌ | ❌ | ✅ |
| Azure AD Connect and Cloud Sync | ✅ | ✅ | ❌ | ❌ | ❌ |
| Supported resources | user • device | user • group • administrativeUnit • application • device • organization | user • group • administrativeUnit • application • contact • device • event • message • organization • post | user • group • contact • device • event • message • organization • post • todoTask • todoTaskList | user • servicePrincipal |
| Data types | String | Binary • Boolean • DateTime • Integer • LargeInteger • String (256 char) | Binary • Boolean • DateTime • Integer • String | String | Boolean • Integer • String |
| Max limits | 15 per object | 100 extensions across all types and all applications | 100 per resource | 2 per creator app per resource | 50 per object • 500 attributes per tenant • More info |
| When to use | • Simpler way to leverage on-prem data or Exchange data • Wanting a simple string attribute on a user/device which can be used in multiple applications as a claim |
• Extending AAD resources with more attributes • Need more strongly-typed attributes than extension attributes 1-15 • With AAD Connect Sync, can also sync on-prem or SharePoint data |
• To extend Graph resources • Don’t require attributes as part of user authentication and as a claim |
Directly add attributes to single Graph object, rather than through an extension schema | Store confidential data |
| Key notes | • Can only sync for users with onPremisesSyncEnabled • Cannot be updated by Microsoft Graph unless users/devices are cloud only (not synced from on-prem) |
• Extension is created on an app object, then target resource(s) are manually updated with value • AAD Connect Sync uses directory extensions |
Extension is created as stand-alone resource, then applied to object | Simple setup and usage | Built with security and least privilege |
1 Multi-value support in directory extensions is limited to attributes synchronized from on-prem. It is not possible to create new multi-valued directory extensions in Azure AD.