How to properly create a custom user attribute and assign it to a SAML app

Question

How to properly create a custom user attribute and assign it to a SAML app

Todd Wolfe 25

I am trying to create a custom attribute in Entra called FederationID. This attribute will be used by a SAML application as the unique identifier for the application. The attribute is formatted as:

<IDStringFromIdP>:user.objectID

I'm looking for the proper steps to take to create the attribute and apply as an app claim for SAML.

Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-03-13T21:28:47.2566667+00:00

Hello Todd Wolfe

Following up to see if the below provided information was helpful. If you have any further queries do let us know.
Todd Wolfe 25 Reputation points

2026-03-16T19:23:27.71+00:00

Somewhat, but not completely. I know I definitely need to configure a Join Transformation for the string to create the specific attribute (FederationID) with the format of "<IDP Provider ID>:<user.object>". I believe we need to use that created "FederationID" attribute as the nameidentifierID for the SAML application but I can't seem to reference that particular custom attribute when selecting the required NameID. I can select the source as the Join Transformation there but can't set the custom attribute name to "FederationID". I also don't know if I need to create a Custom Security Application for this. I am used to doing this in Google but this is a first time forcing it this way in Entra.
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-03-16T19:35:38.4333333+00:00
Hello Todd Wolfe

To use the value as the NameID in a SAML token, Microsoft Entra ID does not require the creation of a special directory attribute like FederationID. In contrast to many other identification platforms, Entra lets you use a Transformation in the claim setting to directly produce this value.

If your requirement is to produce the value in the format:

<IDP Provider ID>:<user.objectId>

you can configure this using a Join transformation in the SAML claim settings.

Steps:

Go to Entra admin center → Enterprise applications → Your SAML application.

Select Single sign-on → Attributes & Claims.

Edit the Unique User Identifier (NameID).

Set Source to Transformation.

Choose Join and configure:

Value 1: Constant → <IDP Provider ID>

**Value 2:** `user.objectId` **Separator:** `:`

This will generate the value dynamically in the format:

<IDP Provider ID>:<user.objectId>

When choosing the NameID source, you won't see or refer to a directory attribute called FederationID because the transformation itself becomes the NameID source. You can also use the same Join transformation to create a new claim in the same Attributes & Claims section if the application expressly needs a claim named FederationID. Furthermore, in this case, developing a Custom Security Application or Custom Security Attribute is not necessary. For creating concatenated SAML claim values, Entra recommends using this method.
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-03-17T18:33:15.7033333+00:00

Hello Todd Wolfe

Following up to see if the above provided information was helpful. If you have any further queries do let us know.

2 answers

Your answer

Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-03-13T21:28:47.2566667+00:00

Hello Todd Wolfe

Following up to see if the below provided information was helpful. If you have any further queries do let us know.
Todd Wolfe 25 Reputation points

2026-03-16T19:23:27.71+00:00

Somewhat, but not completely. I know I definitely need to configure a Join Transformation for the string to create the specific attribute (FederationID) with the format of "<IDP Provider ID>:<user.object>". I believe we need to use that created "FederationID" attribute as the nameidentifierID for the SAML application but I can't seem to reference that particular custom attribute when selecting the required NameID. I can select the source as the Join Transformation there but can't set the custom attribute name to "FederationID". I also don't know if I need to create a Custom Security Application for this. I am used to doing this in Google but this is a first time forcing it this way in Entra.
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-03-16T19:35:38.4333333+00:00

Hello Todd Wolfe

To use the value as the NameID in a SAML token, Microsoft Entra ID does not require the creation of a special directory attribute like FederationID. In contrast to many other identification platforms, Entra lets you use a Transformation in the claim setting to directly produce this value.

If your requirement is to produce the value in the format:

<IDP Provider ID>:<user.objectId>

you can configure this using a Join transformation in the SAML claim settings.

Steps:

Go to Entra admin center → Enterprise applications → Your SAML application.

Select Single sign-on → Attributes & Claims.

Edit the Unique User Identifier (NameID).

Set Source to Transformation.

Choose Join and configure:

Value 1: Constant → <IDP Provider ID>

**Value 2:** `user.objectId` **Separator:** `:`

This will generate the value dynamically in the format:

<IDP Provider ID>:<user.objectId>

When choosing the NameID source, you won't see or refer to a directory attribute called FederationID because the transformation itself becomes the NameID source. You can also use the same Join transformation to create a new claim in the same Attributes & Claims section if the application expressly needs a claim named FederationID. Furthermore, in this case, developing a Custom Security Application or Custom Security Attribute is not necessary. For creating concatenated SAML claim values, Entra recommends using this method.
Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2026-03-17T18:33:15.7033333+00:00

Hello Todd Wolfe

Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Answer 1

Todd Wolfe 25

I have found the solution. For that particular application it requires specific Name ID formatting that joins the IDP Provider ID and the user.objectID that is sent as the unique identifier. Also, it requires the additional custom attribute FederationID claim with the same formatting along with other typical attributes (email, firstName, lastName, userName) entries.

0 comments

Answer 2

Use two building blocks in Microsoft Entra ID:

A custom attribute in the directory schema (or custom security attribute) to hold FederationID.
A SAML claim mapping on the Enterprise application that emits that attribute as the NameID (or another claim) in the required format.

Below is the supported path from the provided material.

1. Create a custom attribute in Entra ID

If using custom security attributes (recommended for new scenarios):

Sign in to the Microsoft Entra admin center as Attribute Definition Administrator.
Go to Entra ID → Custom security attributes.
Either select an existing attribute set or choose Add attribute set to create one (for example, FederationAttributes).
Open the attribute set and select Add attribute.
Configure the attribute:
- Attribute name: FederationID (no spaces or special characters, max 32 chars).
- Description: e.g., Federation identifier for SAML apps.
- Data type: String (since the value is <IDStringFromIdP>:user.objectID).
- Allow multiple values to be assigned: No (typically a single ID per user).
- Only allow predefined values to be assigned: No (values will differ per user).
Save the attribute.

High-level steps are summarized in the “Steps to use custom security attributes” and “Add a custom security attribute definition” sections in the context.

Next, assign this attribute to users that need it (per your business rules) using the “Assign attributes” step from the overview.

Note: The context only covers defining and assigning custom security attributes, not concatenating values. If concatenation is required (<IDStringFromIdP>:user.objectID), store the full combined value directly in the FederationID attribute for each user.

2. Add the attribute as a SAML claim for the app

Once the attribute exists and is populated on users, configure the SAML app to emit it.

Sign in to the Microsoft Entra admin center as at least Cloud Application Administrator.
Go to Entra ID → Enterprise apps → All applications.
Select the SAML application.
Select Single sign-on.
In the User Attributes / Attributes & Claims section, select Edit.

To add the attribute as a SAML claim:

On the Attributes & Claims page, select Add new claim.
Set Name to FederationID (or whatever the SAML app expects).
For Source, choose the appropriate option for your attribute type:
- If using a directory schema extension (B2C-style custom attribute), select Directory schema extension, then pick the extension attribute from the b2c-extensions-app as shown in the context.
- If using a built-in attribute or other mapped attribute, choose Attribute and select the correct source attribute from the drop-down.
Save the claim.

If the SAML app expects this value as the NameID (User Identifier):

Still under Single sign-on, in User attributes, change the User Identifier to the claim that carries FederationID.
If the app requires a specific NameID format, adjust it per the “Change the NameID format” guidance referenced in the context.

The context shows similar patterns for SaaS apps (Pega Systems, RStudio Connect) where custom attributes are added and mapped to specific SAML claims or NameID.

3. Verify attributes are present in the SAML response

If the app reports that attributes are missing or cannot identify the user:

Confirm the FederationID attribute is populated on the user object.
Confirm the SAML claim mapping exists and is saved on the Enterprise app.
Re-sign in and inspect the SAML response (using the app’s logs or a SAML tracer) to verify that the FederationID claim or NameID is present and in the expected format.

If the app still cannot identify the user, adjust the User Identifier selection or NameID format as described in the troubleshooting section in the context.

References: