SSH Professional
      Back to home
      1. Smallstep Knowledge Base
      2. Smallstep Solutions Documentation
      3. SSH Professional

      Entra ID SSO Custom Attributes to Smallstep

      Guide to setting up SCIM sync with Entra ID user and group IDs

      Part 1:

      Create a Custom User Attribute

      1. Sign in to the Azure portal as an Azure AD administrator.

      2. Under Azure services, select Azure Active Directory.

      3. In the left menu, select External Identities.

      4. Note: There may be an additional step to enable a feature flag and allow this.

      5. Select Custom user attributes.

      6. To add an attribute, select Add.

      7. Fill in the add attribute information page and create.

      Part 2:

      Add the custom attribute to users using Microsoft GraphExplorer:

      1. Visit: https://developer.microsoft.com/en-us/graph/graph-explorer

      2. You may need to grant permissions on behalf of your organization

        1. Select your user profile on the top right → Consent to Permissions

          1. Not that the app doesn't give you hints on what permissions you need.

      1. Create a patch user request for the extension attributes using the convention extension_<extensions-app-id>_attributename.

        • The <extensions-app-id> is specific to your tenant. To find this identifier, navigate to Azure Active Directory > App registrations > All applications. Search for the app that starts with "aad-extensions-app" and select it. On the app's Overview page, note the Application (client) ID.


      Part 3:

      Add the custom attribute to the Smallstep Provisioning App 

      1. Sign in to the Azure portal, select Enterprise Applications, select your application, and then select Provisioning.

      2. Under Mappings, select the object (user or group) for which you'd like to add a custom attribute.

      3. At the bottom of the page, select Show Advanced Options.

      4. Select Edit attribute list for AppName.

      5. At the bottom of the attribute list, enter information about the custom attribute in the fields provided. Then select Add Attribute.

      Additional Documentation:


      This documentation helps - https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/customize-application-attributes#editing-the-list-of-supported-attributes

       https://portal.azure.com/?Microsoft_AAD_Connect_Provisioning_forceSchemaEditorEnabled=true.