How to Add Custom Security Attribute Definitions in Microsoft Entra ID?

Question

I’m currently working with Microsoft Entra ID and need to manage custom security attributes for my environment. Specifically, I’d like to understand the process and best practices for the following:

1. How to create (add) new custom security attribute definitions.
2. How to deactivate or remove existing custom security attribute definitions that are no longer required.

Could you please guide me with the correct steps or share any official documentation on how to perform these actions safely, without impacting existing assignments or users?

Answer 1

To create a new custom security attribute definition:

1. Sign in to the Microsoft Entra admin center as a Global Administrator, Attribute Administrator, or Privileged Role Administrator.
2. Navigate to: Identity -> Custom security attributes -> + Add attribute set
3. Define an attribute set name (used to group related attributes).
4. Within that set, select + Add attribute to create a new attribute definition.
   • Specify the attribute name, data type (string, integer, boolean), multi-valued or not, and allowed values if applicable.
   • Choose whether the attribute is mutable or non-mutable and whether it can be assigned to users, applications, or service principals.
5. Save your changes.

Once created, you can assign these attributes to directory objects via Graph API, PowerShell, or portal interfaces.

More at https://learn.microsoft.com/en-us/entra/fundamentals/custom-security-attributes-overview and https://learn.microsoft.com/en-us/entra/fundamentals/custom-security-attributes-define

To safely deactivate or remove attributes that are no longer required:

1. Before removal, review whether any objects currently have values assigned for the attribute. Removing an attribute that’s still assigned can cause data loss and may affect dependent apps or policies.
2. To deactivate:
   • Go to the specific attribute in the Entra portal.
   • Select Deactivate to make it unavailable for new assignments while retaining existing data.
   • This is recommended when you may need the attribute later or want to transition assignments gradually.
3. To delete:
   • Ensure no assignments exist for that attribute (remove them first).
   • In the portal, select Delete for the attribute definition or its entire attribute set.
   • Once deleted, the attribute and its values are permanently removed.

Details at https://learn.microsoft.com/en-us/entra/fundamentals/custom-security-attributes-manage

To follow best practices, consider the following:

• Use attribute sets to logically group related attributes (e.g., HR, Finance) for easier management.
• Avoid deleting attributes immediately—deactivate first, confirm no dependencies, then remove.
• Audit periodically using Microsoft Graph to check where custom attributes are assigned.
• Document schema changes and communicate them to teams using those attributes in provisioning or access policies.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin