Forum Discussion

Charles Ferreira's avatar
Charles Ferreira
Copper Contributor
Nov 28, 2018

ImmutableID to Extensionattribute

Hi smart people! We are considering using Azure AD ImmutableID as our global ImmutableID for other projects. Is it possible to use ADConnect to write the Azure ImmutableID back to an extensionattrib...
Azure Active Directory (AAD)
Identity Management
  • Rishabh Srivastava's avatar
    Rishabh Srivastava
    Nov 29, 2018

    Hello Charles, 

     

    There are two different queries in your request. 

    First - How to writeback Immutable ID to an Extension Attribute. 

    Second - ObjectID of cloud Accounts. 

     

    In Order to complete the first task,

    Create and Outbound rule for AD connector that must map source anchor to extension attribute, below mentioned is an example,

    Add-ADSyncAttributeFlowMapping  `

    -SynchronizationRule $syncRule[0] `

    -Source @('sourceAnchor') `

    -Destination 'msDS-cloudExtensionAttribute10' `

    -FlowType 'Direct' `

    -ValueMergeType 'Update' `

    -OutVariable syncRule

     

    Once the rule is created run a sync and you will find the extension attribute populated with source anchor.

     

    For the second query, ObjectID is an attribute that belongs to Object Class and is a mandate attribute that will be populated for all the objects. (Synced or Cloud)

    To check about the Object class you can run the below mentioned command on AzureAD powershell.

     

    Get-AzureADUser | Get-Member

     

    Let me know if you have any query.

     

    Regards,

    Rishabh

     

     

Charles Ferreira's avatar
Charles Ferreira
Copper Contributor
No problem. I did get a response from a program manager at Microsoft that I had met at Ignite. He indicated to read this article: https://en.wikipedia.org/wiki/Universally_unique_identifier
Apparently the possibility for collision is so low it's likely not an issue?.
It's not specifically that we are looking to compare but to have a good way to generate an immutable ID for claims, reporting, etc, as you indicated. It would be a standard here for the lifecycle of a user across many apps and are concerned if there is someday an acquisition or need to use the ObjectID from another Azure AD in the same capacity. We didn't want to stand up another app to generate them if there is already something.
ThinkSync's avatar
ThinkSync
Brass Contributor
Dec 14, 2018

Great stuff, good luck and please reach out to the community if there's anything we can help with :)

Resources