Sync'ing on-prem AD Device attributes to Azure for use in Device Filters for Conditional Access (Moved Post)

Question

Sync'ing on-prem AD Device attributes to Azure for use in Device Filters for Conditional Access (Moved Post)

Dingo Digits 6

<<Note: Originally posted to Microsoft 365 community but was told Azure community would be a more appropriate place for this question.>>

We have a Hybrid AD Joined setup with our devices and I've added a value to a Windows Active Directory attribute "extensionAttribute1", that I'd like to be able to use in the "Filter for Devices" in our Conditional Access policies.

This is a device attribute and I know it's not working as I created an Azure AD dynamic device group to test.

I suspect it may be a Azure AD Connect issue as when I go to add the Windows Active Directory attribute "extensionAttribute1", there is a "user" and a "group" extensionAttribute1 available but not a "device" attribute. I've seen there's an AD Connect mapping component but I don't know if something can be mapped if it doesn't exist as an option to begin with. I also haven't figured out how to check Azure AD to verify if the value had propagated to AAD in any form.

Any help in how to get Active Directory attributes into Azure AD to use for Device Filters for Conditional Access would be appreciated!!

Thanks

2 answers

Your answer

Answer 1

Hello,

Unfortunately, these attributes are online synchronized for Users for Exchange Online and SharePoint online.

You can find this, and other attributes that are synchronized by Azure AD here:
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-sync-attributes-synchronized

In order to request this feature and propose the functionality, you can submit a Feedback directly to Microsoft through the official Azure Feedback portal:
https:// feedback. azure. com/d365community/forum/79b1327d-d925-ec11-b6e6-000d3a4f06a4

-------------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

Dingo Digits 6

Thanks Limitless, maybe then I'm looking at the wrong place. I want to Azure AD sync my Active Directory device "extensionAttribute1" to the device "ExtensionAttribute1" attribute shown in the Filter for Devices options dropdown:

Surely this can be done but I can't find how to do that in a sync rule. Any ideas?
Thanks!

Dingo Digits 6 Reputation points

2022-08-29T14:08:36.16+00:00

-Hello, from everything I've read, AzureAD Sync is built to map on-prem values to Azure values so I'm fairly sure this can be done, I just need some assistance. Does anyone of a more appropriate forum for AzureAD Sync questions?

Thanks
Mark T 6 Reputation points

2022-09-20T14:20:39.62+00:00

Hi Dingo

Did you ever find a solution for this. I am having the exact same issue. I want to be able to sync out a custom extension attribute for all my computer objects in AD to Azure AD so I can then target a conditional access polices to certain devices based on that custom attribute. From everything I have found you can only sync out extension attributes for user and group objects and for whatever reason not for computer objects via Azure AD connect.

What I have tested in MS Graph (probably can do the same via Azure AD powershell) is add a custom extension attribute to a Hybrid AAD device so the customization is done out in Azure AD removing the need to sync it out. I didn't think it would be possible to edit the attribute for a Hybrid AAD devices out in Azure. I thought it would have to be done on-prem first. But it looks like it can be done.

However it would be a lot easier to add the custom extension attribute to the computer objects (via a script ran against the OU the device is in) on prem first and let it sync out.
Sam 0 Reputation points

2023-03-28T18:29:37.06+00:00

@Mark T , I've yet to find an easier way to do this, but your solution seems to be the best I've seen so far to get this working. I still wish there was a way to sync device attributes on-prem to AAD, though.

Share via

Sync'ing on-prem AD Device attributes to Azure for use in Device Filters for Conditional Access (Moved Post)

2 answers

Your answer