Microsoft Entra ID Provisioning: SelectUniqueValue and the "Apply this mapping" limitation
In Microsoft Entra ID's provisioning service, the SelectUniqueValue() expression has a specific restriction: When an attribute mapping uses SelectUniqueValue(), the "Apply this mapping" setting must be configured as "Only during object creation." It cannot be configured as "Always." This restriction is related to how the provisioning engine generates unique attribute values and how those values are maintained throughout an object's lifecycle. 1. How SelectUniqueValue() works The SelectUniqueValue() function evaluates a list of candidate values in priority order and selects the first value that does not conflict with an existing value in the target directory. For example, consider generating a user's userPrincipalName: SelectUniqueValue( Join("", [FirstName], [LastName], "@company.com"), Join("", [FirstName], ".", [LastName], "@company.com"), Join("", [FirstName], [LastName], [EmployeeID], "@company.com") ) The provisioning engine evaluates candidates in sequence: JohnSmith _AT_ company.com John.Smith _AT_ company.com JohnSmith12345 _AT_ company.com It selects the first available candidate. The important distinction is that this is a uniqueness-selection operation, not simply a string transformation. 2. Why the "Always" setting is incompatible Consider the following scenario. Initial provisioning Two employees exist: Employee Generated UPN John Smith (Employee 100) JohnSmith _AT_ company.com John Smith (Employee 200) John.Smith _AT_ company.com The second employee receives the alternate UPN because the preferred value is already taken. Subsequent provisioning cycles Suppose Employee 100 leaves the organization and email address removed for privacy reasons eventually becomes available. If SelectUniqueValue() were evaluated continuously as an ordinary update mapping, Employee 200 could potentially receive a different result: Attribute Value Existing UPN John.Smith _AT_ company.com Newly preferred candidate JohnSmith _AT_ company.com That could result in an unwanted identity change, even though Employee 200's name and other source attributes have not changed. Restricting the mapping to object creation avoids this class of problem. There is also an important implementation distinction: selecting a unique value during creation is different from evaluating whether an existing object's current value should be retained during an update. The latter requires preserving identity stability, not merely finding an available candidate. The example illustrates the design rationale; it does not establish that Microsoft's engine would actually perform that reassignment if the restriction were removed. 3. What Microsoft officially documents Microsoft explicitly states that: SelectUniqueValue() is intended only for object creation. The mapping must use Only during object creation. The function must be top-level and cannot be nested inside another function. The target attribute cannot have a matching precedence configured. These are documented product restrictions, not merely recommended practices. Microsoft Learn+1 Microsoft does not explain the internal implementation reason for the creation-only restriction in that documentation. The identity-stability explanation above is a plausible rationale, rather than a confirmed statement from Microsoft engineering. Official reference: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/functions-for-customizing-application-data?utm_source=chatgpt.com#selectuniquevalue 4. Implications for Workday-to-Active Directory (or any external directory) provisioning This limitation becomes particularly relevant when provisioning sAMAccountName or userPrincipalName from Workday. Suppose an employee's last name changes: Event Desired UPN Initial hire Jane.Smith _AT_ company.com Marriage/name change Jane.Jones _AT_ company.com With SelectUniqueValue() configured for object creation, the provisioning service will not reevaluate the UPN mapping for the existing AD user. Consequently, you cannot use that same mapping to both: Generate a collision-free UPN when creating a user. Automatically update the UPN when Workday reports a name change. 5. Feature Request / Future Development: Removing the SelectUniqueValue() Restriction Microsoft could significantly improve the Entra ID provisioning service by extending SelectUniqueValue() to support the "Always" attribute mapping setting, allowing uniqueness validation during both object creation and subsequent updates. The current restriction creates a functional gap in identity lifecycle management, particularly for organizations integrating authoritative HR systems such as Workday with Active Directory. 5.1 Proposed enhancement Microsoft should introduce an update-aware implementation of SelectUniqueValue() that supports the following behaviors: Preserve existing values: If the target attribute already contains a valid value and the source attributes have not changed, retain that value rather than selecting a different candidate. Detect source attribute changes: When an authoritative source attribute changes, such as FirstName, LastName, or PreferredName, reevaluate the expression and determine whether an identity update is appropriate. Perform uniqueness validation: Evaluate candidate values against existing objects in the target directory, excluding the object currently being updated. Support collision-free updates: If the preferred candidate is already assigned to another object, evaluate subsequent candidates in the expression, just as the function does during initial provisioning. Maintain identity stability: Prevent unintended renaming simply because a previously unavailable candidate becomes available. 5.2 Proposed configuration options Rather than simply removing the restriction, Microsoft could introduce an additional configuration setting governing how uniqueness expressions behave during updates. Proposed mode Behavior Creation Only Current behavior; evaluate only during initial provisioning Always — Preserve Existing Retain the existing value unless it is empty or an explicit reevaluation condition is met Always — Reevaluate on Source Change Recalculate when relevant source attributes change Always — Force Reevaluate Recalculate on every provisioning cycle, even when source attributes remain unchanged The "Always — Reevaluate on Source Change" option would be particularly valuable for HR-driven identity provisioning. 5.3 Technical considerations for Microsoft To implement this functionality reliably, Microsoft would need to address several technical challenges. Self-exclusion during uniqueness checks When evaluating a candidate against Active Directory, the provisioning engine must exclude the current object's identity from the uniqueness search. Otherwise, the existing user could incorrectly be identified as a collision with themselves. Concurrency and race conditions Two provisioning operations could generate the same candidate simultaneously. Microsoft should ensure that uniqueness is revalidated immediately before committing an attribute change, with appropriate conflict handling. Distinguishing source changes from directory changes A newly available username should not automatically trigger a rename. The engine should distinguish between changes in authoritative source attributes and changes in the availability of candidate values. Safe updates to identity attributes Updates to userPrincipalName, sAMAccountName, and other identity-related attributes can affect authentication, email addressing, and downstream applications. The feature should provide optional controls for preserving existing values, auditing changes, and restricting automatic renaming. 5.4 Business justification This enhancement would deliver several benefits: Complete identity lifecycle automation: Support initial provisioning and subsequent identity changes using the same expression framework. Reduced administrative overhead: Eliminate the need for custom PowerShell scripts, scheduled tasks, or external automation solely to manage uniqueness during updates. Consistent naming policies: Apply the same collision-handling rules throughout an employee's lifecycle. Improved reliability: Reduce the risk of duplicate identities and inconsistent naming conventions. Better HR integration: Allow Workday and other authoritative HR systems to drive name changes without requiring separate provisioning mechanisms. 5.5 Recommended feature request to Microsoft Feature Request: Support SelectUniqueValue() with "Always" Attribute Mapping in Microsoft Entra ID Provisioning Product: Microsoft Entra ID — Inbound HR Provisioning / Workday to Active Directory Current Limitation: The SelectUniqueValue() expression is restricted to attribute mappings configured with "Apply this mapping" set to "Only during object creation." This prevents organizations from using the provisioning service's built-in uniqueness validation when updating existing Active Directory objects. Requested Enhancement: Extend SelectUniqueValue() to support the "Always" mapping option, enabling uniqueness validation during both object creation and updates. The enhanced functionality should: Exclude the current target object from uniqueness checks. Support reevaluation when relevant source attributes change. Preserve existing values when no relevant changes have occurred. Evaluate alternate candidates when a proposed value conflicts with another directory object. Provide configurable controls to prevent unintended identity changes. Business Impact: Organizations using Workday or other HR systems as authoritative identity sources cannot fully automate changes to identity attributes such as userPrincipalName and sAMAccountName while maintaining uniqueness through the native provisioning expression engine. This limitation requires additional automation outside Microsoft Entra ID, increasing operational complexity, maintenance requirements, and potential points of failure. Expected Outcome: Enable Microsoft Entra ID provisioning to provide consistent, collision-aware identity attribute management throughout the complete employee lifecycle, including initial hiring, name changes, rehiring, and other HR-driven identity updates. This enhancement would reduce dependence on external scripts and improve the completeness of Microsoft's native HR-driven identity provisioning capabilities. 5.6 Current Microsoft position Microsoft's documentation continues to explicitly restrict SelectUniqueValue() to object creation. I found no documented commitment or announced release date for update support. Microsoft Learn+1 The feature request above is therefore a proposed product enhancement, not an existing capability or announced roadmap item.Microsoft Launches Preview for Entra ID Conditional Access Policy Plans
Conditional access policy plans are now available in preview. The idea is to define common rules, conditions like breakglass accounts and have the details inherited by CA policies. Microsoft provides a migration facility to move existing policies to plans, but it’s probably going to take some time for tenants to inventory their current CA policies, understand points of commonality, and slowing move towards rationalization. https://office365itpros.com/2026/10/29/conditional-access-policy-plans/Entra ID Drops the memberOf Rule Operator for Dynamic Groups and Dynamic Admin Units
MC1448379 (5 August 2026) announces the retirement of the MemberOf rule operator from Entra ID in early November 2026. The removal of the rule operator might affect the membership rules used for dynamic groups, dynamic administrative units, and auto-assigned entitlement management policies. If a tenant doesn’t act, Entra ID will stop processing the rules and memberships will become increasingly inaccurate. And that’s a bad thing! https://office365itpros.com/2026/08/07/memberof-rule-operator/Entra ID Allows Users to Change Passwords Without Knowing Their Old Password
Now rolling out to Entra tenants is the preview of the ability to configure the change password method for user accounts through the My Sign Ins page without knowing the original password. Although many Entra users are going passwordless, that approach only works when applications support passkeys. The need to update someone’s password to allow them to access an application still exists, and the new method allows the user to do it themselves even when they can’t remember their original password. https://office365itpros.com/2026/11/03/change-password-no-original/Add custom attributes to users (or devices) to map hardware peripherals
Hello everyone, I am seeking some help, guidance or suggestions with the following situation. We are looking for a solution that could map peripherals (such as monitors) to a user or a device. Once we have that info, we will utilize an additional tool to extend our visibility over the assets & assignments. I reviewed a few documentations and videos about potential solutions, and I just want to know if that's possible or I should not invest time on it any longer. The scope is the following: 1. We've collected information about connected monitors using Intune Script detection. That's perfect. It already maps devices with monitor's serial numbers and other details. 2. Export in CSV is fine (although, the data is not a 100% accurate, we have an internal data base that we can compare). 3. Now, how can we properly map that data to the cloud objects? What the best approach is? Logically, the monitors should be added to the devices, but Intune Custom Attributes are not easily populated/managed (?). On the other hand, Entra AD is capable of managing such expressions and overall has better capabilities (or am I wrong?) when it comes to operating with cloud objects. I am really looking for a human response; more of a knowledge share. I'd appreciate if someone shares their experience with similar scenarios. :) I apologise in advance if my question is not in the right section. Docs: https://learn.microsoft.com/en-us/graph/extensibility-overview?tabs=http https://www.reddit.com/r/AZURE/comments/1e5z3kv/add_customextension_attribute_in_entra_id/ https://www.reddit.com/r/AZURE/comments/1dz4cru/comment/lcdf2ev/?context=3&share_id=UqZR0m9s-9SWiHOiVwwAM&utm_content=1&utm_medium=ios_app&utm_name=ioscss&utm_source=share&utm_term=1 https://www.youtube.com/watch?v=kBm-fjqg0PU https://www.youtube.com/watch?v=LHXfFoygiOA Thanks :)Microsoft Plans to Allow Users to Create Agent Blueprints
The Entra admin center will soon get a new user role permission to control whether users can create agent blueprints. The control will be enabled by default. I think this is a terrible idea. Outside the hallowed walls of Microsoft, does the need really exist to allow average users to create agent blueprints? I don’t think so. Agents are like apps. They need to be controlled and managed by people who know what they are doing. https://office365itpros.com/2026/10/15/agent-blueprint-option/I built a free, open-source M365 security assessment tool - looking for feedback
I work as an IT consultant, and a good chunk of my time is spent assessing Microsoft 365 environments for small and mid-sized businesses. Every engagement started the same way: connect to five different PowerShell modules, run dozens of commands across Entra ID, Exchange Online, Defender, SharePoint, and Teams, manually compare each setting against CIS benchmarks, then spend hours assembling everything into a report the client could actually read. The tools that automate this either cost thousands per year, require standing up Azure infrastructure just to run, or only cover one service area. I wanted something simpler: one command that connects, assesses, and produces a client-ready deliverable. So I built it. What M365 Assess does https://github.com/Daren9m/M365-Assess is a PowerShell-based security assessment tool that runs against a Microsoft 365 tenant and produces a comprehensive set of reports. Here is what you get from a single run: 57 automated security checks aligned to the CIS Microsoft 365 Foundations Benchmark v6.0.1, covering Entra ID, Exchange Online, Defender for Office 365, SharePoint Online, and Teams 12 compliance frameworks mapped simultaneously -- every finding is cross-referenced against NIST 800-53, NIST CSF 2.0, ISO 27001:2022, SOC 2, HIPAA, PCI DSS v4.0.1, CMMC 2.0, CISA SCuBA, and DISA STIG (plus CIS profiles for E3 L1/L2 and E5 L1/L2) 20+ CSV exports covering users, mailboxes, MFA status, admin roles, conditional access policies, mail flow rules, device compliance, and more A self-contained HTML report with an executive summary, severity badges, sortable tables, and a compliance overview dashboard -- no external dependencies, fully base64-encoded, just open it in any browser or email it directly The entire assessment is read-only. It never modifies tenant settings. Only Get-* cmdlets are used. A few things I'm proud of Real-time progress in the console. As the assessment runs, you see each check complete with live status indicators and timing. No staring at a blank terminal wondering if it hung. The HTML report is a single file. Logos, backgrounds, fonts -- everything is embedded. You can email the report as an attachment and it renders perfectly. It supports dark mode (auto-detects system preference), and all tables are sortable by clicking column headers. Compliance framework mapping. This was the feature that took the most work. The compliance overview shows coverage percentages across all 12 frameworks, with drill-down to individual controls. Each finding links back to its CIS control ID and maps to every applicable framework control. Pass/Fail detail tables. Each security check shows the CIS control reference, what was checked, what the expected value is, what the actual value is, and a clear Pass/Fail/Warning status. Findings include remediation descriptions to help prioritize fixes. Quick start If you want to try it out, it takes about 5 minutes to get running: # Install prerequisites (if you don't have them already) Install-Module Microsoft.Graph, ExchangeOnlineManagement -Scope CurrentUser Clone and run git clone https://github.com/Daren9m/M365-Assess.git cd M365-Assess .\Invoke-M365Assessment.ps1 The interactive wizard walks you through selecting assessment sections, entering your tenant ID, and choosing an authentication method (interactive browser login, certificate-based, or pre-existing connections). Results land in a timestamped folder with all CSVs and the HTML report. Requires PowerShell 7.x and runs on Windows (macOS and Linux are experimental -- I would love help testing those platforms). Cloud support M365 Assess works with: Commercial (global) tenants GCC, GCC High, and DoD environments If you work in government cloud, the tool handles the different endpoint URIs automatically. What is next This is actively maintained and I have a roadmap of improvements: More automated checks -- 140 CIS v6.0.1 controls are tracked in the registry, with 57 automated today. Expanding coverage is the top priority. Remediation commands -- PowerShell snippets and portal steps for each finding, so you can fix issues directly from the report. XLSX compliance matrix -- A spreadsheet export for audit teams who need to work in Excel. Standalone report regeneration -- Re-run the report from existing CSV data without re-assessing the tenant. I would love your feedback I have been building this for my own consulting work, but I think it could be useful to the broader community. If you try it, I would genuinely appreciate hearing: What checks should I prioritize next? Which security controls matter most in your environment? What compliance frameworks are most requested by your clients or auditors? How does the report land with non-technical stakeholders? Is the executive summary useful, or does it need work? macOS/Linux users -- does it run? What breaks? I have tested it on macOS, but not extensively. Bug reports, feature requests, and contributions are all welcome on GitHub. Repository: https://github.com/Daren9m/M365-Assess License: MIT (free for commercial and personal use) Runtime: PowerShell 7.x Thanks for reading. Happy to answer any questions in the comments.Microsoft to Stop Providing Telephony-Based Authentication Methods for MFA in February 2027
In an important announcement for all tenants, Microsoft revealed that Entra ID will no longer provide SMS one-time codes or voice calls for MFA challenges after February 1, 2027. Tenants can continue to use telephony-based authentication methods after that date, but only by purchasing a service from a telecom provider. This is arguably the biggest change in Entra ID authentication since mandatory MFA for administrative interfaces – and we have a PowerShell script to help identify the affected accounts. https://office365itpros.com/2026/07/14/entra-sms-one-time-code/Why Entra Administrators Cannot Disable Their Own Accounts
When attempting to disable a user account in an interactive Graph session, I was told that the command failed because the accountEnabled property was invalid. The error is obviously incorrect because it’s very possible to update the property to disable or enable an account. However, different rules apply when the account is holds a privileged role, like Global Administrator. Entra imposes some reasonable blocks, even if the error messages are not good. https://office365itpros.com/2026/09/14/strange-accountenabled-error/Entra ID Continuous Access Evaluation and Microsoft 365
Continuous Access Evaluation (CAE) is supported by core Microsoft 365 workloads like Exchange Online, SharePoint Online, and Teams, and the reach of CAE is gradually spreading throughout the Microsoft cloud ecosystem. However, security researchers report inconsistent coverage across first-party apps and clients that take a little gloss off the promise of instant access revocation when critical events like user password changes happen. https://office365itpros.com/2026/09/08/continuous-access-evaluation-cae/
