Microsoft Entra ID Provisioning: SelectUniqueValue and the "Apply this mapping" limitation
In Microsoft Entra ID's provisioning service, the SelectUniqueValue() expression has a specific restriction: When an attribute mapping uses SelectUniqueValue(), the "Apply this mapping" setting must be configured as "Only during object creation." It cannot be configured as "Always." This restriction is related to how the provisioning engine generates unique attribute values and how those values are maintained throughout an object's lifecycle. 1. How SelectUniqueValue() works The SelectUniqueValue() function evaluates a list of candidate values in priority order and selects the first value that does not conflict with an existing value in the target directory. For example, consider generating a user's userPrincipalName: SelectUniqueValue( Join("", [FirstName], [LastName], "@company.com"), Join("", [FirstName], ".", [LastName], "@company.com"), Join("", [FirstName], [LastName], [EmployeeID], "@company.com") ) The provisioning engine evaluates candidates in sequence: JohnSmith _AT_ company.com John.Smith _AT_ company.com JohnSmith12345 _AT_ company.com It selects the first available candidate. The important distinction is that this is a uniqueness-selection operation, not simply a string transformation. 2. Why the "Always" setting is incompatible Consider the following scenario. Initial provisioning Two employees exist: Employee Generated UPN John Smith (Employee 100) JohnSmith _AT_ company.com John Smith (Employee 200) John.Smith _AT_ company.com The second employee receives the alternate UPN because the preferred value is already taken. Subsequent provisioning cycles Suppose Employee 100 leaves the organization and email address removed for privacy reasons eventually becomes available. If SelectUniqueValue() were evaluated continuously as an ordinary update mapping, Employee 200 could potentially receive a different result: Attribute Value Existing UPN John.Smith _AT_ company.com Newly preferred candidate JohnSmith _AT_ company.com That could result in an unwanted identity change, even though Employee 200's name and other source attributes have not changed. Restricting the mapping to object creation avoids this class of problem. There is also an important implementation distinction: selecting a unique value during creation is different from evaluating whether an existing object's current value should be retained during an update. The latter requires preserving identity stability, not merely finding an available candidate. The example illustrates the design rationale; it does not establish that Microsoft's engine would actually perform that reassignment if the restriction were removed. 3. What Microsoft officially documents Microsoft explicitly states that: SelectUniqueValue() is intended only for object creation. The mapping must use Only during object creation. The function must be top-level and cannot be nested inside another function. The target attribute cannot have a matching precedence configured. These are documented product restrictions, not merely recommended practices. Microsoft Learn+1 Microsoft does not explain the internal implementation reason for the creation-only restriction in that documentation. The identity-stability explanation above is a plausible rationale, rather than a confirmed statement from Microsoft engineering. Official reference: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/functions-for-customizing-application-data?utm_source=chatgpt.com#selectuniquevalue 4. Implications for Workday-to-Active Directory (or any external directory) provisioning This limitation becomes particularly relevant when provisioning sAMAccountName or userPrincipalName from Workday. Suppose an employee's last name changes: Event Desired UPN Initial hire Jane.Smith _AT_ company.com Marriage/name change Jane.Jones _AT_ company.com With SelectUniqueValue() configured for object creation, the provisioning service will not reevaluate the UPN mapping for the existing AD user. Consequently, you cannot use that same mapping to both: Generate a collision-free UPN when creating a user. Automatically update the UPN when Workday reports a name change. 5. Feature Request / Future Development: Removing the SelectUniqueValue() Restriction Microsoft could significantly improve the Entra ID provisioning service by extending SelectUniqueValue() to support the "Always" attribute mapping setting, allowing uniqueness validation during both object creation and subsequent updates. The current restriction creates a functional gap in identity lifecycle management, particularly for organizations integrating authoritative HR systems such as Workday with Active Directory. 5.1 Proposed enhancement Microsoft should introduce an update-aware implementation of SelectUniqueValue() that supports the following behaviors: Preserve existing values: If the target attribute already contains a valid value and the source attributes have not changed, retain that value rather than selecting a different candidate. Detect source attribute changes: When an authoritative source attribute changes, such as FirstName, LastName, or PreferredName, reevaluate the expression and determine whether an identity update is appropriate. Perform uniqueness validation: Evaluate candidate values against existing objects in the target directory, excluding the object currently being updated. Support collision-free updates: If the preferred candidate is already assigned to another object, evaluate subsequent candidates in the expression, just as the function does during initial provisioning. Maintain identity stability: Prevent unintended renaming simply because a previously unavailable candidate becomes available. 5.2 Proposed configuration options Rather than simply removing the restriction, Microsoft could introduce an additional configuration setting governing how uniqueness expressions behave during updates. Proposed mode Behavior Creation Only Current behavior; evaluate only during initial provisioning Always — Preserve Existing Retain the existing value unless it is empty or an explicit reevaluation condition is met Always — Reevaluate on Source Change Recalculate when relevant source attributes change Always — Force Reevaluate Recalculate on every provisioning cycle, even when source attributes remain unchanged The "Always — Reevaluate on Source Change" option would be particularly valuable for HR-driven identity provisioning. 5.3 Technical considerations for Microsoft To implement this functionality reliably, Microsoft would need to address several technical challenges. Self-exclusion during uniqueness checks When evaluating a candidate against Active Directory, the provisioning engine must exclude the current object's identity from the uniqueness search. Otherwise, the existing user could incorrectly be identified as a collision with themselves. Concurrency and race conditions Two provisioning operations could generate the same candidate simultaneously. Microsoft should ensure that uniqueness is revalidated immediately before committing an attribute change, with appropriate conflict handling. Distinguishing source changes from directory changes A newly available username should not automatically trigger a rename. The engine should distinguish between changes in authoritative source attributes and changes in the availability of candidate values. Safe updates to identity attributes Updates to userPrincipalName, sAMAccountName, and other identity-related attributes can affect authentication, email addressing, and downstream applications. The feature should provide optional controls for preserving existing values, auditing changes, and restricting automatic renaming. 5.4 Business justification This enhancement would deliver several benefits: Complete identity lifecycle automation: Support initial provisioning and subsequent identity changes using the same expression framework. Reduced administrative overhead: Eliminate the need for custom PowerShell scripts, scheduled tasks, or external automation solely to manage uniqueness during updates. Consistent naming policies: Apply the same collision-handling rules throughout an employee's lifecycle. Improved reliability: Reduce the risk of duplicate identities and inconsistent naming conventions. Better HR integration: Allow Workday and other authoritative HR systems to drive name changes without requiring separate provisioning mechanisms. 5.5 Recommended feature request to Microsoft Feature Request: Support SelectUniqueValue() with "Always" Attribute Mapping in Microsoft Entra ID Provisioning Product: Microsoft Entra ID — Inbound HR Provisioning / Workday to Active Directory Current Limitation: The SelectUniqueValue() expression is restricted to attribute mappings configured with "Apply this mapping" set to "Only during object creation." This prevents organizations from using the provisioning service's built-in uniqueness validation when updating existing Active Directory objects. Requested Enhancement: Extend SelectUniqueValue() to support the "Always" mapping option, enabling uniqueness validation during both object creation and updates. The enhanced functionality should: Exclude the current target object from uniqueness checks. Support reevaluation when relevant source attributes change. Preserve existing values when no relevant changes have occurred. Evaluate alternate candidates when a proposed value conflicts with another directory object. Provide configurable controls to prevent unintended identity changes. Business Impact: Organizations using Workday or other HR systems as authoritative identity sources cannot fully automate changes to identity attributes such as userPrincipalName and sAMAccountName while maintaining uniqueness through the native provisioning expression engine. This limitation requires additional automation outside Microsoft Entra ID, increasing operational complexity, maintenance requirements, and potential points of failure. Expected Outcome: Enable Microsoft Entra ID provisioning to provide consistent, collision-aware identity attribute management throughout the complete employee lifecycle, including initial hiring, name changes, rehiring, and other HR-driven identity updates. This enhancement would reduce dependence on external scripts and improve the completeness of Microsoft's native HR-driven identity provisioning capabilities. 5.6 Current Microsoft position Microsoft's documentation continues to explicitly restrict SelectUniqueValue() to object creation. I found no documented commitment or announced release date for update support. Microsoft Learn+1 The feature request above is therefore a proposed product enhancement, not an existing capability or announced roadmap item.Add custom attributes to users (or devices) to map hardware peripherals
Hello everyone, I am seeking some help, guidance or suggestions with the following situation. We are looking for a solution that could map peripherals (such as monitors) to a user or a device. Once we have that info, we will utilize an additional tool to extend our visibility over the assets & assignments. I reviewed a few documentations and videos about potential solutions, and I just want to know if that's possible or I should not invest time on it any longer. The scope is the following: 1. We've collected information about connected monitors using Intune Script detection. That's perfect. It already maps devices with monitor's serial numbers and other details. 2. Export in CSV is fine (although, the data is not a 100% accurate, we have an internal data base that we can compare). 3. Now, how can we properly map that data to the cloud objects? What the best approach is? Logically, the monitors should be added to the devices, but Intune Custom Attributes are not easily populated/managed (?). On the other hand, Entra AD is capable of managing such expressions and overall has better capabilities (or am I wrong?) when it comes to operating with cloud objects. I am really looking for a human response; more of a knowledge share. I'd appreciate if someone shares their experience with similar scenarios. :) I apologise in advance if my question is not in the right section. Docs: https://learn.microsoft.com/en-us/graph/extensibility-overview?tabs=http https://www.reddit.com/r/AZURE/comments/1e5z3kv/add_customextension_attribute_in_entra_id/ https://www.reddit.com/r/AZURE/comments/1dz4cru/comment/lcdf2ev/?context=3&share_id=UqZR0m9s-9SWiHOiVwwAM&utm_content=1&utm_medium=ios_app&utm_name=ioscss&utm_source=share&utm_term=1 https://www.youtube.com/watch?v=kBm-fjqg0PU https://www.youtube.com/watch?v=LHXfFoygiOA Thanks :)
Hacked Microsoft Account Recovery with Semi Access
I'm at a complete loss and it is infuriatingly ridiculous. I am entirely unable to get a hold of a human being at Microsoft and am being turned down by automated responses nonstop. So here's what's happening: My Microsoft account has been hijacked (obviously not this one) for its valuable Minecraft account and has now been sold. I am logged into my account via my PC, have full access of the main email address, but I have been locked out of my account using the alias email. Whenever I want to log in to my account, it wants to instead send a code to an email address I do not own and can't access. I have tried the Sign-In Helper, the Recovery Form, the hotline, the support email without any result, let alone a non-automated response. I sadly don't have the Recovery Code of my 15 year old-ish account. Since I still have full access of my email address I get updates of security info being changed and what not. Last month a stranger sent me screenshots of someone trying to sell my Minecraft account, for which I myself have received multiple buying offers, and voila yesterday I received notification of my alias mail address changing followed by Minecraft server apps being added to my Microsoft account. While I had already given up retrieving my account, whenever I get notifications my heart sinks a new while some hope sparks up again. Do you people have any idea of what I could do? I don't even rule out legal actions at this point. While I do of course have the email address of the hijacker and the buyer, I fear that contacting them results in me being locked out permanently. I'm just begging to catch the attention of anyone involved with Microsoft. This being walled out with automated responses is killing me.No acces to local Office365 apps with an account which differs from the current windows account
Hi, guys! I'm working with Windows 11 Pro using the Microsoft account ABC. Today I bought a Office 365 Family License - by using another Microsoft account XYZ. I downloaded the local apps successfully... ...but when I start the local app and tried to sign in using the XYZ account, I'm asked for the Windows Hello Pin for the XYZ account - but there is no PIN for that, because the account doesn't exist as a Windows account at this computer at all. Copilot says: "You can sign in to Windows 11 with one Microsoft account and use a different Microsoft 365/Office account for Office applications. Microsoft supports this setup." What did I wrong - what can I do? Kind regards! Sebastian
Sketchy behaviour from Microsoft on MFA - what gives?
Recently, Microsoft has overwritten our Authentication Method Registration campaign settings, from 'Disabled' to 'Microsoft Managed' for dozens of tenants. Thanks guys. That's not super sketchy at all. /s This was ostensibly done for the Retiring of Voice and SMS based MFA or, as the article puts it 'To help enterprises adopt AI at scale,'.... what? Not because they're garbage MFA methods? But so Microsoft can market-capture MFA? Regardless of that bizarre statement, this article is sub par - like most Microsoft 'help' docs, it appears to have been written by someone in Marketing, with no technical experience. My chief concern is that the term 'OTP' doesn't appear ANYWHERE in here. So, for us and our customers - who block Voice/SMS already - this is alarming. Microsoft's Passkey flow is confusing af to people - and since it includes SYNCED passkeys by default, it faces the same risks as OTP. We specifically HAVEN'T rolled out passkeys because everytime we do, people get confused and frustrated - because they'll have 3-4 different things pop-up, offering to take a sync'd passkey. Really concerned with my 'do not allow microsoft to manage' setting, being explicitly set to 'Microsoft managed', and whatever decisions they're NOT publicly addressing at this point. We've spent years teaching people to use Microsoft Authenticator and password vault-based OTP. Now, Microsoft is pushing everyone to keep using those same tools, but to go through the mess that is the passkey setup interface?I built a free, open-source M365 security assessment tool - looking for feedback
I work as an IT consultant, and a good chunk of my time is spent assessing Microsoft 365 environments for small and mid-sized businesses. Every engagement started the same way: connect to five different PowerShell modules, run dozens of commands across Entra ID, Exchange Online, Defender, SharePoint, and Teams, manually compare each setting against CIS benchmarks, then spend hours assembling everything into a report the client could actually read. The tools that automate this either cost thousands per year, require standing up Azure infrastructure just to run, or only cover one service area. I wanted something simpler: one command that connects, assesses, and produces a client-ready deliverable. So I built it. What M365 Assess does https://github.com/Daren9m/M365-Assess is a PowerShell-based security assessment tool that runs against a Microsoft 365 tenant and produces a comprehensive set of reports. Here is what you get from a single run: 57 automated security checks aligned to the CIS Microsoft 365 Foundations Benchmark v6.0.1, covering Entra ID, Exchange Online, Defender for Office 365, SharePoint Online, and Teams 12 compliance frameworks mapped simultaneously -- every finding is cross-referenced against NIST 800-53, NIST CSF 2.0, ISO 27001:2022, SOC 2, HIPAA, PCI DSS v4.0.1, CMMC 2.0, CISA SCuBA, and DISA STIG (plus CIS profiles for E3 L1/L2 and E5 L1/L2) 20+ CSV exports covering users, mailboxes, MFA status, admin roles, conditional access policies, mail flow rules, device compliance, and more A self-contained HTML report with an executive summary, severity badges, sortable tables, and a compliance overview dashboard -- no external dependencies, fully base64-encoded, just open it in any browser or email it directly The entire assessment is read-only. It never modifies tenant settings. Only Get-* cmdlets are used. A few things I'm proud of Real-time progress in the console. As the assessment runs, you see each check complete with live status indicators and timing. No staring at a blank terminal wondering if it hung. The HTML report is a single file. Logos, backgrounds, fonts -- everything is embedded. You can email the report as an attachment and it renders perfectly. It supports dark mode (auto-detects system preference), and all tables are sortable by clicking column headers. Compliance framework mapping. This was the feature that took the most work. The compliance overview shows coverage percentages across all 12 frameworks, with drill-down to individual controls. Each finding links back to its CIS control ID and maps to every applicable framework control. Pass/Fail detail tables. Each security check shows the CIS control reference, what was checked, what the expected value is, what the actual value is, and a clear Pass/Fail/Warning status. Findings include remediation descriptions to help prioritize fixes. Quick start If you want to try it out, it takes about 5 minutes to get running: # Install prerequisites (if you don't have them already) Install-Module Microsoft.Graph, ExchangeOnlineManagement -Scope CurrentUser Clone and run git clone https://github.com/Daren9m/M365-Assess.git cd M365-Assess .\Invoke-M365Assessment.ps1 The interactive wizard walks you through selecting assessment sections, entering your tenant ID, and choosing an authentication method (interactive browser login, certificate-based, or pre-existing connections). Results land in a timestamped folder with all CSVs and the HTML report. Requires PowerShell 7.x and runs on Windows (macOS and Linux are experimental -- I would love help testing those platforms). Cloud support M365 Assess works with: Commercial (global) tenants GCC, GCC High, and DoD environments If you work in government cloud, the tool handles the different endpoint URIs automatically. What is next This is actively maintained and I have a roadmap of improvements: More automated checks -- 140 CIS v6.0.1 controls are tracked in the registry, with 57 automated today. Expanding coverage is the top priority. Remediation commands -- PowerShell snippets and portal steps for each finding, so you can fix issues directly from the report. XLSX compliance matrix -- A spreadsheet export for audit teams who need to work in Excel. Standalone report regeneration -- Re-run the report from existing CSV data without re-assessing the tenant. I would love your feedback I have been building this for my own consulting work, but I think it could be useful to the broader community. If you try it, I would genuinely appreciate hearing: What checks should I prioritize next? Which security controls matter most in your environment? What compliance frameworks are most requested by your clients or auditors? How does the report land with non-technical stakeholders? Is the executive summary useful, or does it need work? macOS/Linux users -- does it run? What breaks? I have tested it on macOS, but not extensively. Bug reports, feature requests, and contributions are all welcome on GitHub. Repository: https://github.com/Daren9m/M365-Assess License: MIT (free for commercial and personal use) Runtime: PowerShell 7.x Thanks for reading. Happy to answer any questions in the comments.
Microsoft Authenticator backup not recognized by the same recovery account
My old Android phone has completely failed, so I can no longer access Microsoft Authenticator on that device. I had previously enabled Cloud Backup in Microsoft Authenticator, and I am certain that I am signing in with the same Microsoft personal account that was originally used as the recovery account. On my new Android phone, I reinstalled Microsoft Authenticator and selected “Restore from backup / Begin recovery” before adding any accounts. I then signed in with the same Microsoft personal account. However, Authenticator says that the backup is not stored under this account and asks me to try another personal Microsoft account. I am certain that this is the correct recovery account. Both the old phone and the new phone are Android devices, so this is not a cross-platform restore issue. I would like to know: Could this be a problem with the association between the cloud backup and the recovery account? Is there any way for the Microsoft Authenticator team to verify whether a backup still exists? Is there any supported way to recover the original backup instead of manually resetting and re-enrolling every third-party 2FA account? My old device is completely inaccessible, so I cannot open Authenticator there or create a new backup. Any guidance from the Microsoft Authenticator or Identity team would be appreciated.Help me recover my account.
Hi, My other Microsoft account was recently compromised but it was compromised before as well. When it was compromised before, the hacker added a recovery email for verification and to remove that I added my another email and the request was sent and it was supposed to change in October and I was not able to change the password or use other features of Microsoft because at some point it keep redirecting me to the page that I have sent a request but during that time period, my account was compromised again and I keep receiving emails of unusual sign-in activity by the hacker and I wanted to change the password but I couldn't because of that request so I was being patient. Now I received an email that someone accessed my Microsoft account and now I have to verify my identity to log in and to log in it ask me to type the email that the hacker set up because it's not changed and since I don't know what that is it takes me to the account recovery page where I put all the information that I know, I write in my postal code, my old and current passwords, date of birth etc. I have never used skype, Hotmail or outlook and Xbox so I just uncheck those boxes and then it asks me if I have ever bought any product but since I didn't so I uncheck that as well but then I just receive the email that the information I provided is nonsufficient even thou I provided all the information that is correct. Unfortunately Sign-in helper didn't work. Kindly help me resolve the issue. Looking forward to your positive response. Yours sincerely.
Minha conta Microsoft foi comprometida e o e-mail original deixou de ser reconhecido
Olá, preciso de ajuda para recuperar minha conta Microsoft. Minha conta originalmente usava o endereço email address removed for privacy reasons. Recentemente perdi o acesso e, quando tento entrar ou usar o formulário de recuperação com esse endereço, aparece a mensagem de que “a conta Microsoft inserida não existe”. Acredito que o endereço de e-mail e as informações de segurança da conta tenham sido alterados sem minha autorização. O endereço email address removed for privacy reasons ainda aparece no meu Microsoft Authenticator. Ainda tenho o Authenticator associado à conta antiga, mas o código de verificação não é aceito. Durante uma tentativa de recuperação apareceu o endereço email address removed for privacy reasons, que não reconheço. A conta também ainda aparece associada ao meu perfil de administrador do Windows e ainda consigo acessar minha conta do Minecraft pelo site. Já tentei o Assistente de Entrada e o formulário de recuperação, mas o endereço original não é mais reconhecido. Gostaria de saber qual é o procedimento correto para recuperar a conta ou entrar em contato com o suporte responsável por contas Microsoft comprometidas. Obrigado pela ajuda!
Microsoft Account connected apps management
Why is there no visible “Connected apps” management page in Microsoft Account? I noticed that third-party applications connected to a personal Microsoft account can be managed at: https://account.live.com/consent/Manage However, I cannot find any obvious navigation path to this page from the main Microsoft Account portal: https://account.microsoft.com/ The main account portal provides sections such as Security, Privacy, Devices, Subscriptions, and Your info, but there does not appear to be a visible “Connected apps”, “Apps and services”, or “App permissions” entry. I only discovered the consent management page after receiving a Microsoft security notification that a new application had been granted access to my Microsoft account. The “Manage your apps” button in that email links to the older account.live.com consent page. This creates two usability and security concerns: Users may not know where to review or revoke third-party OAuth permissions unless they still have the original security notification email. Microsoft Account management currently uses both microsoft.com and live.com domains, which can be confusing for users trying to verify whether an account-management page is an official Microsoft page. Would it be possible to add a visible “Connected apps”, “Apps and services”, or “App permissions” entry under Security or Privacy in account.microsoft.com? This would not require redesigning the existing consent system. Even a simple link from account.microsoft.com to the existing account.live.com/consent/Manage page would make third-party permission management much easier to discover. Is there currently an official navigation path to this page that I may have missed?
