An attribute is a unique identifier, such as a Distinguished Name, that correlates to a specific object in the directory, which can be a user, a computer, or another network entity. If your directory uses custom attributes that don’t use the following formats, specify the custom formats in the Cloud Identity Engine app (see Collect Custom Attributes with the Cloud Identity Engine).

To provide granular context for security policies and event logging, the Cloud Identity Engine automatically collects a comprehensive set of default attributes from your configured directories. For on-premises solutions like Active Directory and OpenLDAP, this includes standard identifiers such as sAMAccountName, userPrincipalName, mail, and group memberships defined by memberOf. OpenLDAP specifically requires the entryUUID attribute to successfully identify objects.

Cloud-based directories offer similar attribute mappings tailored to their specific schemas. For instance, Microsoft Entra ID (formerly Azure AD) synchronizes extensive user details, device compliance states, and role assignments to help prevent privilege escalation. Similarly, Okta and Google Directory integrations map fields like primaryEmail or nickName to standard Cloud Identity Engine attributes to ensure consistency across different identity providers. If you utilize the SCIM Connector, you gain further control by customizing exactly which attributes—such as enterprise_department—are provisioned to the engine. You can verify that these attributes are populating correctly by viewing the raw directory data within the Cloud Identity Engine app.