: Cloud Identity Engine Attributes
Focus
Focus

Cloud Identity Engine Attributes

Table of Contents

Cloud Identity Engine Attributes

An attribute is a unique identifier, such as a Distinguished Name, that correlates to a specific object in the directory, which can be a user, a computer, or another network entity. If your directory uses custom attributes that do not use the following formats, specify the custom formats in the Cloud Identity Engine app (see Collect Custom Attributes with the Cloud Identity Engine).

On-Premises Active Directory

You can collect the following types of default attributes and their associated Active Directory fields:

User Attributes

Directory Sync Attribute
Directory Field
Admin Count
adminCount
Common-Name
cn
CompanyName
companyName
Country
co
Department
department
Distinguished Name
dn
Groups
memberOf
Last Login
lastLogon
Last Logon Time
lastLogonTimestamp
Location
l
MSDSAllowedDelegatedTo
msDS-AllowedToDelegateTo
MSDSAllowedToActOnBehalfOfOtherIdentity
msDS-AllowedToActOnBehalfOfOtherIdentity
MSDSSupportedEncryptionTypes
msDS-SupportedEncryptionTypes
Mail
If you do not configure a value for the
Mail
attribute, the Cloud Identity Engine uses the value of the
User Principal Name
.
mail
Manager
manager
NETBIOS Name
nETBIOSName
Name
displayName
Object Class
objectClass
Primary Group ID
primaryGroupID
SAM Account Name
sAMAccountName
SID
objectSid
SID History
sIDHistory
Service Principal Name
servicePrincipalName
Title
title
Unique Identifier
objectGUID
User Principal Name
userPrincipalName
User Account Control
userAccountControl
When Changed
whenChanged

Organizational Unit (OU) Attributes

Directory Sync Attribute
Directory Field
Canonical Name
canonicalName
Common-Name
cn
Distinguished Name
dn
Name
displayName
Object Class
objectClass
Unique Identifier
objectGUID
When Changed
whenChanged

Group Attributes

Directory Sync Attribute
Directory Field
Admin Count
adminCount
Common-Name
cn
Distinguished Name
dn
Group Type
groupType
Groups
memberOf
Mail
If you do not configure a value for the
Mail
attribute, the Cloud Identity Engine uses the value of the
User Principal Name
.
mail
Member
member
Name
name
Object Class
objectClass
SAM Account Name
sAMAccountName
SID
objectSid
Unique Identifier
objectGUID
When Changed
whenChanged
WhenCreated
whenCreated

Container Attributes

Directory Sync Attribute
Directory Field
Canonical Name
canonicalName
Common-Name
cn
Distinguished Name
dn
Name
displayName
Object Class
objectClass
Unique Identifier
objectGUID
WhenChanged
whenChanged
WhenCreated
whenCreated

Computer Attributes

Directory Sync Attribute
Directory Field
Admin Count
adminCount
Common-Name
cn
Distinguished Name
dn
Groups
memberOf
Host Name
dNSHostName
Last Login
lastLogon
Last Logon Time
lastLogonTimestamp
MSDSAllowedDelegatedTo
msDS-AllowedToDelegateTo
MSDSAllowedToActOnBehalfOfOtherIdentity
msDS-AllowedToActOnBehalfOfOtherIdentity
MSDSSupportedEncryptionTypes
msDS-SupportedEncryptionTypes
NETBIOS Name
nETBIOSName
Name
displayName
OS
operatingSystem
OS Service Pack
operatingSystemServicePack
OS Version
operatingSystemVersion
Object Class
objectClass
Primary Group ID
primaryGroupID
SAM Account Name
sAMAccountName
SID
objectSid
SID History
sIDHistory
Serial Number
serialNumber
Service Principal Name
servicePrincipalName
Unique Identifier
objectGUID
User Principal Name
userPrincipalName
UserAccountControl
userAccountControl
WhenChanged
whenChanged
WhenCreated
whenCreated

Azure Active Directory

You can collect the following types of default attributes and their associated Active Directory fields:

User Attributes

Directory Sync Attribute
Directory Field
BusinessPhones
businessPhones
CompanyName
companyName
Country
country
Department
department
EmployeeId
employeeId
FaxNumber
faxNumber
Given Name
givenName
Groups
memberOf
IsResourceAccount
isResourceAccount
LastPasswordChangeDateTime
lastPasswordChangeDateTime
Location
officeLocation
Mail
If you do not configure a value for the
Mail
attribute, the Cloud Identity Engine uses the value of the
User Principal Name
.
mail
Manager
manager
MobilePhone
mobilePhone
Name
displayName
OnPremisesDistinguishedName
onPremisesDistinguishedName
OnPremisesExtensionAttributes
onPremisesExtensionAttributes
OnPremisesImmutableId
onPremisesImmutableId
OnPremisesLastSyncDataTime
onPremisesLastSyncDateTime
OnPremisesProvisioningErrors
onPremisesProvisioningErrors
OnPremisesSamAccountName
onPremisesSamAccountName
OnPremisesSyncEnabled
onPremisesSyncEnabled
OtherMails
otherMails
PasswordPolicies
passwordPolicies
PasswordProfile
passwordProfile
PostalCode
postalCode
PreferredLanguage
preferredLanguage
SignInSessionsValidFromDateTime
signInSessionsValidFromDateTime
State
state
StreetAddress
streetAddress
Sur Name
surname
Title
jobTitle
Unique Identifier
objectGUID
UsageLocation
usageLocation
User Principal Name
userPrincipalName
UserAccountControl
accountEnabled
UserType
userType
WhenChanged
createdDateTime
onPremisesSecurityIdentifier
onPremisesSecurityIdentifier
onPremisesUserPrincipalName
onPremisesUserPrincipalName

Group Attributes

Directory Sync Attribute
Directory Field
Classification
classification
DeletedDateTime
deletedDateTime
Description
description
Group Type
groupTypes
Groups
memberOf
Mail
If you do not configure a value for the
Mail
attribute, the Cloud Identity Engine uses the value of the
User Principal Name
.
mail
Mail Nick Name
mailNickname
MailEnabled
mailEnabled
Member
member
Name
displayName
OnPremisesLastSyncDateTime
onPremisesLastSyncDateTime
OnPremisesProvisioningErrors
onPremisesProvisioningErrors
OnPremisesSecurityIdentifier
onPremisesSecurityIdentifier
OnPremisesSyncEnabled
onPremisesSyncEnabled
RenewedDateTime
renewedDateTime
SAM Account Name
onPremisesSamAccountName
SID
securityIdentifier
SecurityEnabled
securityEnabled
Unique Identifier
objectGUID
Visibility
visibility
WhenChanged
createdDateTime

Computer Attributes

Directory Sync Attribute
Directory Field
ComplianceExpirationDateTime
complianceExpirationDateTime
Device ID
deviceId
Groups
memberOf
IsCompliant
isCompliant
IsManaged
isManaged
LastLogonTime
approximateLastSignInDateTime
Manufacturer
manufacturer
MdmAppId
mdmAppId
Model
model
Name
displayName
OS
operatingSystem
OSVersion
operatingSystemVersion
Profile Type
profileType
Serial Number
deviceId
SystemLabels
systemLabels
TrustType
trustType
Unique Identifier
objectGUID
UserAccountControl
accountEnabled
WhenChanged
createdDateTime

Application Attributes

Directory Sync Attribute
Directory Field
App Id
appId
App Roles
appRoles
Description
description
DisabledByMicrosoftStatus
disabledByMicrosoftStatus
Identifier Uris
identifierUris
Name
displayName
Unique Identifier
objectGUID
createdDateTime
createdDateTime
web
web

SCIM Directory

You can collect the following types of default attributes and their associated SCIM Connector fields:

User Attributes

The following section lists the default attributes for users that the directory provisions to Directory Sync using SCIM.
Directory Sync Attribute
SCIM Field
Common-Name
name_formatted
CompanyName
addresses_work_formatted
Country
addresses_work_country
Department
enterprise_department
EmployeeId
enterprise_employeeNumber
FaxNumber
phoneNumbers_fax_value
Given Name
name_firstName
Groups
groups
Location
locale
Mail
If you do not configure a value for the
Mail
attribute, the Cloud Identity Engine uses the value of the
User Principal Name
.
emails_work_value
MobilePhone
phoneNumbers_mobile_value
Name
displayName
PostalCode
addresses_work_postalCode
PreferredLanguage
preferredLanguage
PreferredName
nickName
StreetAddress
addresses_work_streetAddress
Sur Name
name_familyName
Title
title
Unique Identifier
objectGUID
User Principal Name
userName
UserType
userType
The SCIM gallery app does not support the userType attribute.
createdDateTime
meta_created

Group Attributes

The following section lists the default attributes for groups that the directory provisions to Directory Sync using SCIM.
Group names for the
displayName
attribute must be unique. For more information, refer to Troubleshoot Cloud Identity Engine Issues.
Directory Sync Attribute
SCIM Field
Description
displayName
Group Type
groupTypes
Member
members
Name
displayName
Unique Identifier
objectGUID
createdDateTime
meta_created

Okta Directory

You can collect the following types of default attributes and their associated Okta Directory fields:

User Attributes

Directory Sync Attribute
Okta Directory Fields
City
city
CompanyName
companyName
Country
countryCode
Department
department
Distinguished Name
dn
EmployeeId
employeeNumber
Given Name
firstName
Groups
memberOf
Last Login
lastLogin
LastPasswordChangeDateTime
passwordChanged
Mail
If you do not configure a value for the
Mail
attribute, the Cloud Identity Engine uses the value of the
User Principal Name
.
email
Manager
managerDN
MobilePhone
mobilePhone
Name
displayName
PostalCode
zipCode
PreferredLanguage
preferredlanguage
PreferredName
nickName
Primary Group ID
primaryGroupID
SID
objectSid
State
state
StreetAddress
streetAddress
Sur Name
lastName
Title
title
Unique Identifier
objectGUID
User Principal Name
userName
UserType
userType
createdDateTime
created

Group Attributes

Directory Sync Attribute
Okta Directory Fields
Description
description
Group Type
groupTypes
Groups
memberOf
Member
member
Name
name
SAM Account Name
samAccountName
SID
objectSid
Unique Identifier
objectGUID
createdDateTime
created

Application Attributes

Directory Sync Attribute
Okta Directory Field
App Id
appId
Description
description
Name
displayName
Unique Identifier
objectGUID

Google Directory

To identify users and apply security policy, the Cloud Identity Engine collects the following attributes from Google Directory:

User Attributes

Directory Sync Attribute
Google Directory Field
BusinessPhones
phones
Country
country
Given Name
givenName
Groups
memberOf
Last Logon Time
lastLoginTime
Location
locations.area
Mail
If you do not configure a value for the
Mail
attribute, the Cloud Identity Engine uses the value of the
User Principal Name
.
primaryEmail
Name
fullName
OtherMails
emails
PreferredLanguage
languages
SID
id
State
state
StreetAddress
streetAddress
Sur Name
familyName
Title
title
Unique Identifier
objectGUID
User Principal Name
userName
UserAccountControl
suspended
UserType
isAdmin
createdDateTime
creationTime

Organizational Unit (OU) Attributes

Directory Sync Attribute
Google Directory Field
Description
description
Name
name
Unique Identifier
objectGUID

Group Attributes

Directory Sync Attribute
Google Directory Field
Group Type
kind
Groups
memberOf
Mail
If you do not configure a value for the
Mail
attribute, the Cloud Identity Engine uses the value of the
User Principal Name
.
email
Member
member
Name
name
SID
id
Unique Identifier
objectGUID

Computer Attributes

Directory Sync Attribute
Google Directory Field
Groups
memberOf
HostName
dNSHostName
Last Login
lastLogon
LastLogonTime
lastLogonTimestamp
NETBIOS Name
nETBIOSName
OS
operatingSystem
OSServicePack
operatingSystemServicePack
OSVersion
operatingSystemVersion
Primary Group ID
primaryGroupID
SID
deviceId
SID History
sIDHistory
Serial Number
serialNumber
Service Principal Name
servicePrincipalName
Unique Identifier
objectGUID
User Principal Name
userPrincipalName
User Account Control
status

On-Premises OpenLDAP

You can collect the following types of default attributes and their associated Active Directory fields:

User Attributes

Directory Sync Attribute
OpenLDAP Directory Field
Common-Name
cn
Country
co
Department
department
Distinguished Name
dn
Groups
memberOf
Last Login
lastLogon
Last Logon Time
lastLogonTimestamp
Location
l
Mail
If you do not configure a value for the
Mail
attribute, the Cloud Identity Engine uses the value of the
User Principal Name
.
mail
Manager
manager
Name
displayName
Object Class
objectClass
SAM Account Name
sAMAccountName
SID
objectSid
Title
title
Unique Identifier
entryUUID
User Principal Name
userPrincipalName
WhenChanged
modifyTimestamp
WhenCreated
createTimestamp

Organizational Unit (OU) Attributes

Directory Sync Attribute
OpenLDAP Directory Field
Canonical Name
canonicalName
Common-Name
cn
Distinguished Name
dn
Name
displayName
Object Class
objectClass
Unique Identifier
entryUUID
WhenChanged
modifyTimestamp
WhenCreated
createTimestamp

Group Attributes

Directory Sync Attribute
OpenLDAP Directory Field
Common-Name
cn
Distinguished Name
dn
Group Type
groupType
Groups
memberOf
Mail
If you do not configure a value for the
Mail
attribute, the Cloud Identity Engine uses the value of the
User Principal Name
.
mail
Member
uniqueMember
Name
name
Object Class
objectClass
Unique Identifier
entryUUID
WhenChanged
modifyTimestamp
WhenCreated
createTimestamp

Container Attributes

Directory Sync Attribute
OpenLDAP Directory Field
Canonical Name
canonicalName
Common-Name
cn
Distinguished Name
dn
Name
displayName
Object Class
objectClass
Unique Identifier
entryUUID
WhenChanged
modifyTimestamp
WhenCreated
createTimestamp

Computer Attributes

Directory Sync Attribute
OpenLDAP Field
Common-Name
cn
Distinguished Name
dn
Groups
memberOf
Host Name
dNSHostName
Last Login
lastLogon
Last Logon Time
lastLogonTimestamp
NETBIOS Name
nETBIOSName
Name
displayName
OS
operatingSystem
OS Service Pack
operatingSystemServicePack
OS Version
operatingSystemVersion
Object Class
objectClass
Primary Group ID
primaryGroupID
SAM Account Name
sAMAccountName
SID
objectSid
Serial Number
serialNumber
Unique Identifier
entryUUID
User Principal Name
userPrincipalName
User Account Control
userAccountControl
WhenChanged
modifyTimestamp
WhenCreated
createTimestamp

Recommended For You