Microsoft 365 Community Identity platform, 23 Sep 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Understand Azure AD extensions and their role in Application integration – September 2022

Description

This month’s in-depth topic: Understand the world of Azure AD extensions and their role in Application integration. Different organizations have different needs for user attributes and how they’re stored - on-premises and synched while others cannot be directly stored on-premise. Some attributes need to be stored as custom extensions, or MS Graph extensions, or sometimes stored as claims. Learn about types of extensions and how and when to use them in claims mapping policies or through our UX. Microsoft Presenters Jeevan Desarda and Allison Amaral. This call was hosted by Nandeesh Swami (Microsoft) | @Nandeesh_Swami on September 15, 2022. Questions addressed throughout the call.

Learn more
• See the full blog post for this call in the Microsoft 365 platform community blog - https://aka.ms/m365/blog
• Mark your calendar for next call on October 20th at 9:00am PT. Download the recurrent invite for this call | https://aka.ms/IDDevCommunityCalendar
• Microsoft 365 Unified Sample gallery - https://aka.ms/m365/samples
• Microsoft 365 Platform Community in YouTube - https://aka.ms/m365/videos
• Microsoft 365 Platform Community - http://aka.ms/m365/community

A

A

And Allison they work in our applications team and we have an exciting call. Today. I am very close to this topic. In fact, I was the one who went to them and said you know what we need this because I've been following this scenario for quite some time, and this is pretty famous our most of our developers as well as our Pros. Thank you very much for presenting here folks, just some quick, Crown rules. Let's be pleasant. This college recorded we're going to host this on.

A

Our YouTube channel, like I mentioned, follow us on Microsoft, 365, Dev and Azure 80.. We do a lot of exciting calls like these, and it happens every third Thursday of the month and the next one is scheduled on October 28th, again, a very exciting call. It's going to be a Dev call again and, of course, through the course of the call. We will share our surveys and you can go to our YouTube channel to see the previous videos that we have recorded.

A

You can just have to go to that link, AKA dot, Ms, slash, n365, PNP, slash videos now off to you, Allison and given.

B

We are going to talk today about the extension, security, extensions and different kinds of extensions. We have related to your applications and claims and configurations. So the entire topic is about. How do you extend your particular schema and then what are the different pros and cons and scenarios under which you can able to use them? So it's more providing you an oversight on different kinds of extensions and how to use them and when to use them yep. You can go ahead and listen.

C

Yeah great and then quick intro, I'm Allison I'm on the product team that handles essentially the claims configurations, experience and thus I work really closely, with extension work as well.

B

Yep and, and even they said, I'm a principal program manager in the cxp division, but working on the apps and Integrations and I'll lead the team where we actually integrate different types of applications with Azure ready.

C

So basically, this this slide I'll just sum up in a few points, feel free to just chat us at any time. I'm able to see the chat.

C

You can even come off mute if you basically feel free to ask your questions whenever you have them, no need to wait at any point, and so basically, what we'll be covering today we'll be going over some key vocabulary, because there's some complicated terms in this space and we just want to make sure everyone's kind of starting at the same level, then we'll get into the types of extensions all the different flavors of them.

C

Then we'll go into some example scenarios and then claims configuration because, as you can imagine, claims configuration is a big part of why people want extension attributes and then upcoming and new features. So talk about the key vocabulary: I'm just going to start at the top and work our way down so I'm sure. A lot of this will be a recap for use to some of them.

C

I'll go quicker than others, but once again, if you have questions just come off in the uter tag in the chat and that's great so attributes at its most basic is actually basically just information about a resource, uh there's all sorts of types of attributes and those kind of things, but at its most basic it's information about a resource there's default attributes which you may have heard as like. First party attributes as well. Essentially it's the the default set of attributes that are already Associated to a resource that are kind of built.

C

In you know, classic ones are like various names for user extension. Attributes are basically attributes that have been added by somebody in your tenant to a resource, usually from an external source, so like on-prem, ad or you're, adding it manually via Ms graph on this kind of and then extension type. So, basically, you'll hear me reference different types of extensions. It's basically just the different ways that extension attributes can get added to a Target resource claim is essentially an attribute passed about a user.

C

During a successful authentication, then claims policy is basically a policy that determines how those claims are passed around if they're, transformed or not during sign in and essentially how those claims are rendered to the application.

C

Those that's the vocabulary, then we have this slide, that's kind of like the money slide of this deck, which is basically like all of the different types of extensions. When you want to use them and can they use claims or not, and then a couple of notes here and there so feel free to jump in at any point, given I'm just going to start from the top and work my way down.

C

So basically, we have four kind of high level types of extensions. One is just extension attributes, one through fifteen. Essentially these are already pre-built into the user object and basically they're literally called, like extension, attribute one two, three four Etc in some ways you could consider these one of the simpler ways to add an attribute to a user, because you kind of already have the slot built in you just have to populate the values for that uh user resource. It's essentially also kind of built for on-prem and exchange um data being passed into those attributes.

C

Yeah it does it's a little bit more. As with all things that tend to be simpler, they tend to have more kind of restrictions on how you can use them. It is user and device only and yeah it's kind of just string format. It's not very strongly typed. You can't necessarily make it a complex object. uh You you can't really make it a specific number type. It's just a string. Essentially. The other thing too is you can uh like.

C

You must have like on-premises sync enabled like you, can't have Cloud only users for this kind of thing to do. On-Prem, sync. Essentially, if you have a cloud only user, an on-prem sync situation doesn't actually make sense because they're not on Prem, but it is worth mentioning that anything. You want to add to extension, attributes Steven one through 15.

B

No I think this is good and uh again this as a listen called out. This can be only enabled through either you are doing an is already connect, sync or you're doing an exchange sync from on-premise. Then that way you can able to populate them, but yeah, we'll we'll see further more information going down on this yep.

C

And so that's you know built into the the user and device object. You can essentially leverage those for any application once you've kind of configured like essentially they're available for any application kind of off the bat. If you're going in through the claims, configuration experience and you click on like choose your attributes, these will already be listed amongst the default attributes um directory extensions. So basically, these are a way of extending Azure active directory Resources with more attributes really the most common one is probably groups or users.

C

You tend to use this when you need more strongly typed attributes or more structured attributes than just like the strings that you can find. In extension, attributes 1 through 15., you can actually Define, essentially the schema and what kind of attributes or what kind of resources these attributes can be used for. So you set up like oh, this is my extension attribute named extension attribute 3., it can be used for users and it can contain these fields inside it. This type of extension is also used kind of to power. Aad connect sync.

C

So if you're familiar with that, you may be somewhat familiar with directory schema. The other thing is kind of like how does this work is functionally directory extensions? You create an extension, schema definition on top of an app object. So basically you can think of this app object as a way to store your extension structures. Then you have your target resource, so, let's say user.

C

You then manually update or you know, with an API, but you have to handle the update setting that extension value for that Target resource, and then you can reference that extension attribute inside of kind of any application available. So let's say I want to add my field to I, create an application. Object meant to store all of those extension attributes.

C

I, stick my field to and its definition on on that application and then I essentially go into all of my users and set the correct value for my field too, and you can do that on groups too, but that value in my field too, and then after that, essentially, if you go into the claims configuration experience, you would then be able well in the API you'd, be able to leverage that extension attribute so kind of to rehash what the differences are between the first row and the second row. First row is kind of built.

C

In already you can only leverage it in simple ways, but it's kind of right off the bat directory extensions are more structured. You have full control over these the extension structure and you can control it on more objects as well. Anything you want to add here, given I'm, going to pause at each row. Yeah.

B

So, uh no so I think you may or may not be very familiar with traffic extension, so we'll go in details about how do you create the directory extensions and when to use them? We are also going to talk a little bit more detail on the pros and cons because it's like when you are taking an approach over here. You have to completely understand how they behave and what you are going to get out of it and what you're going to lose out of it.

B

So it's like I think that's something which we would like to highlight over this presentation, but yeah I think great call outs. In that way, um the I think the difference she clearly called outs between the on-premise, like the extension chart to it 1 through 15 versus directory extensions yeah. You can watch.

C

Well, actually, we'll be walking through like kind of key or Baseline scenarios for each one of these, so you can kind of see them in action, so to speak, and that's what she was talking about. That's where we'll talk about like first, you do this, then you do this, so you can actually kind of see how this works.

C

The third type is schema extensions, which is essentially, it's essentially used to extend Ms graph resources and include user and group, but it's actually a little bit different than directory extensions and that essentially in Ms graph, there is a schema extension like first class resource, and that, like you, can do like slash, schema extensions to see all your schema extensions.

C

You interact with the schema extensions to create a new schema extension, um so essentially it's kind of like its own resource here, rather than Associated to an application object, and so basically you can use this in a situation where you want to access a bunch of information about a user got about any time throughout this graph, rather than just through sign in claim.

C

One thing that's kind of interesting about this: one is it's not available for claim use which you know, depending on your situation, may or may not be useful, but essentially a standalone resource through Ms graph and then yeah. Basically, you can use it as claims, but it's just as structured, if not more structured than directory extensions and kind of more flexible in the objects that it can handle.

C

Essentially of all of these types, schema extensions can be used on the most types of resources and then the other Ms graph oriented item here is open extensions, which is basically you via Ms graph. You directly add a value to a resource like let's say user, so you directly add it to that. Once again, we kind of have the trade-off of like simple versus powerful and that, like, basically, these are the most Loosely structured types of attributes here, just strings also it it.

C

Basically like you, it's just a simple string that you can add to an application. It's untyped and you can only have like a few really per resource, and so it's kind of meant for like if you have a one-off extension that you want to add to a user and then keep that going forward. Okay and then a great question I see in the chat, so security attributes.

C

Are you talking about Custom Security attributes like you can configure about like an Enterprise application. Those are actually kind of interesting. So essentially that Custom Security attribute is so it's on an Enterprise object or an application object. But it's not a claim that you can pass I I, don't think right like basically, essentially it's a value. That kind of is almost like a tag on the object itself. It allows you to do some filtering on those things.

C

Classic kind of use case for that is essentially like I want to assign this a priority, a security priority level, so people can see kind of like the impact of security events on this application, so high medium low, and so it's kind of like meta information about that service principle or app object itself, rather than the user resource or the group resource being signed into an application.

B

And the one other thing is: that's also widely used in the conditional access policies because, as Alison called out, you can use them as tags and group different service principles or applications together, as part of that particular one tag, and then you can able to apply different conditional access policies on it.

B

um Yes, Don I do see your point on the game, so we have heard this particular requirement on the Custom. Security attribute should be used as a claims, but we are evaluating that approaches like can. Is it really viable? Is it she'll be really into it in that way or the other way but feedback taken on it? It's like yes, this is what something other customers even have told us, but thanks for your feedback here.

C

Definitely definitely heard yeah we are. We are definitely looking into that. Okay, so that's kind of the overall view. We wanted to introduce these terms to you. So as we talk about it in the context of scenarios, uh you'll have a little bit of understanding. It's okay, if this doesn't make perfect sense yet because we'll be going through the scenarios themselves, and so you can kind of see how these things work in practice.

C

With that I believe I'm going to hand over to Jiva now.

B

Yep sounds good, so the first, so we are going to talk about different scenarios on uh which particular scenarios, and they do what into that particular scenario. So the first particular scenario, which we call it as one a because there might be two different options in this scenario. But let's look at the scenario first, so the scenario is you have your particular on-premise CD, which you have customized in a specific way and you would like to bring those custom schema attributes to Azure active directory.

B

Now, in this particular case, you would like to use extension attributes 1 through 15., and we are going to see how you do it. uh Basically, if the user is on premise, that means your uses, a story in your on-premise active directory and you have configured already connecting. Then you can able to call figures. These extension attributes 1 through 15 and map them out to say it's like okay, which particular ad tools goes where and then from there. It can actually sync all those attributes and their values into those extension attributes.

B

As this extension attributes runs on a like, the sync engine runs on a regular basis. It automatically sync those particular values on a regular basis, and you can use these particular in in your claim. Application claims to say I would like to use, say extension attribute one here or 15 here, like that, if the user is not on premise and if the user is cloud only user, in that case, you cannot use them. That means you cannot able to populate those extension attribute values for that particular user, because it's a cloud only user.

B

So again, I would like to remind the first thing in the slide before we talked about it is extension. Attributes 1 through 15 cannot be populated by any other source. That means Ms graph will allow you to read it, but it will not allow you to write it. The right ability is only been given to Azure ID connect, sync and the exchanging for on-premise, because those are exchange, specific attributes.

B

So when you are doing this, be very mindful when you are doing a populating extension attributes 1 through 15 generally I have seen lot of customers use it when you would like to use them across multiple applications as a claim, so that you can able to populate that and send that particular value. That's like at our scenario in this particular case, and this is how you should do it. Matthew I can see your hand Rays so good.

D

Thanks yeah is: is it uh true that extension attributes from active directory extension attributes 1 through 15, are called something different in Azure active directory? Do they have a different name.

B

No, they do not have a different name. It's called extension attribute, one extension attribute two, but that means you cannot rename them. They are like the fixed names and the. What are the values you populate? You have to have a understanding and the mapping of it on your site, but they appear, as extension, Network 1 through 15 in your graph. Also, you can see it also on the user object. You can see it through Powershell or through API or through claims. You can see it.

D

I I, don't know why, where I read it to I saw that somebody referred to an extension attribute that was in Azure active directory, referred to as a good extension attribute one. A good extension attribute to, for example,.

B

Well, we are going to talk about that so hold your thought over there and you will get your answer excellent. Thank you. Yes, let's move to the next scenario. I listened yeah.

C

Really quick, one thing that you may find is: if you're looking up the resource type, specifically for a user extension or, like extension, attribute 1 through 15., you will also be able to find it searching on on-premises extension attributes and I'll put that in the chat as well, but in terms of how we refer to it. It's always extension attributes, one through fifty. All right next slide go ahead.

B

So now the scenario is again the same: bringing on premise: LED custom schema to Azure active directory, now the option, what you have or a 1B option, particularly so the first option we discuss using extension attribute 1 through 15., and now we are going to talk about. How do you create custom extensions on your particular directory?

B

So what you can do- or here is in Azure, ready connect. Sync, you can able to map your custom attributes from on-premise ad and say it's like I would like to make them as an extension or directory extensions. When we say directory extensions. That means it actually creates that particular attribute as something say. Oh extension, underscore that great value underscore say auth phone number right or what Michael is talking about in the chat. So, yes, that's pretty much possible using this method or even the first method, one a which we talked about.

B

So you can able to take any of the approach and the second approach. What we are talking about is giving you an ability to see that particular attribute name, because it will have like an extension and then the app ID and then the actual the name of this particular extension. So, basically, what happens behind the scene is azure ready connect is a first party application or a Microsoft specific app application which gets created in your tenant and the the particular good value.

B

What you see is the app ID of that particular first party application, so it will have like, in the extensions get created on your particular Azure, ready, connect, sync application in Azure active directory and through Azure ID connect, sync engine. These values gets populated and mapped to those particular attributes.

B

So the extension and that's where the con, the claim you can again use them into the claim and then the extension names look, like extension, underscore app, ID underscore receiver extension name and you can use them into your user experience or API or Powershell, and you can able to map these particular claims. There are few particular limitations and things around this, but overall these are 100 different extensions, which are available with maximum of 255 characters limit.

B

So you can able to store different values into those particular extensions through Azure, ready, connect, sync and that's how you use them so again to cover. If you have an on-premise customized uh schema on-premacity, you can able to use ether extension attribute 1 through 10, 15 or you've been able to use this particular directory extensions in that way through Azure ID connect, sync, okay, just to let you know the another difference between those two is Ms graph. Does allow read and write operations onto those particular extensions.

B

You can able to write those values, but we do not recommend otherwise it will create a conflict because sync engine is actually writing to those particular values. So we suggest not to play with that. Let only the single source of truth will be the Azure already connecting, which is actually getting that mapping and populating that value. For you, that's how it'll look, um oh so Mike I. Think you're saying: can you show an example? What you're describing the okay so I can actually give you a particular example in the chat window.

B

So in this particular extension you can able to see that I'm using the extension where it says extension underscore some particular value and I'm actually populating office number for it, and this is how you can able to do it. If you would like to see the actual Azure ready connect, sync experience, then we can give you the article where it completely describes and what steps you have to take and how do you do this mapping? So definitely we can able to do this.

B

Okay, so another question from Michael is: the odd phone is already there in Azure ready, and how do you do it again? As I said the? If default attributes are the first class attributes? Are there in Azure active directory, then in that case you can just do direct mapping through a Geo ready connecting because it will give you like. Oh, these are all Microsoft. uh The see user objects has different properties by default. Given to you, you can able to do direct mapping.

B

This particular thing comes only in question when there is something not default, is there so for an example, employee ID was not there for quite long time in Azure, active referee, then then, after that, we added it. But before those days is like this is the very common mechanism which our customers use where they say. Okay I would like to populate that as a directory extension, so I can able to map it out. So it's for those particular properties yeah which are not there in Azure, ready or on premise active direct.

B

You have customized it or you want to sync it, but there is no placeholder in. Are you ready for that? And then you create those. So that's how the use cases I think that answers Michael your question, I, listen to you, want to add anything here.

B

Oh yes, so the auth phone is. There then does this in sync in this sync, you should able to see it all. The properties related to this object in Azure active directory. Some of these things like in say, email address again, can be it's like populated directly through Office 365 or if you have an on-premise exchanging you can able to populate through that. But, yes, the answer is overall.

B

I do not know exact about the output, but all the properties related to the object which are part of our default properties are available for sync, and you can able to sync them through that cool. Let's move forward with that. Okay now, the second scenario. So what this is also one of the scenario which we have seen most in some customers and then there is a requirement for it. So a lot of us are using collaborative mechanism into our organization. That means more than your employees.

B

There are other set of particular users who are participating into your directory. That's mainly say: I have vendors, I have partners and, and those particular people are also actually getting added into my particular tenant, and that General mechanism for them is to have a B2B guest user. So that means these users are Cloud, only users directly getting created on Azure active directory and they do not have any presence or non-premise, but that's a very common scenario which we have seen so in that particular case, what happens is basically the the way to solve that.

B

Is you create an application to store directory extensions, so basically, in your Azure active directory, you stand up a new application and say this is my application, where I'm going to create directory extension, the difference between the first scenario and the second scenario, the first scenario is actually using the Azure ready connect, sync as their first party app versus the. The second particular scenario is talking about the you create your particular own application to hold those directory extensions. Once you have that, then you add your directory extensions to that application.

B

Again, you can create 100 directory extensions on that app and then the app ID of that particular app becomes. That particular the example which I have shown say extension underscore that particular app ID. And then what are the extensions you are creating? So you create those particular extensions as your master and then from there you can populate on different user objects or group objects as needed.

B

So the Third third stage, but we go, is once you have your applications once you create directory extensions, then you move it to a use, targeted users or groups, as you say, say, for an example: I have 2000 articular guest users, which are participating into my 10 and then I can able to Target those particular extensions only to those set of users and then I can use either Ms graph or Powershell to actually populate these different values.

B

The scenario is very common because you would like to popular twins I've seen uncommon example like oh I'm, using these three applications, which I would like to give access to my guest users, but this applications are using employee ID for identifier. Now it's like. Oh, these guest users are not my employees, so how do I give employee or they do not have an employee ID over there, but you can give something like Arts, which say: 10, 000 or whatever it is in your world.

B

You can Define that and then I've seen, customers doing is like okay. I can create those attributes. I can map those particular things. I can actually give them the or assign them different values and run it on a regular basis, so that I populate them or update them, and then I can actually use them into claims as an application claim, so that the application can still send that information.

B

One of the thing which we would call it out is, although you can use this as claims or as attributes, but they are not available to configure through ux. That means you have to configure them only using API or you can use them Powershell through which you can able to do this, but at least till now we do not have the way to configure them in the ux, but this is another common scenario where you have guest users or Cloud.

B

Only users and you would like to populate different values, and then you would like to use them into different set of clips. Alison I'm not very actively checking the chat, but if you have anything to call out feel free to do.

C

So I think I've been addressing it all, so I think we're good.

B

Okay, perfect I. Think the next scenario over here is about the. If you are developing in your own application, and you would like to store some additional resources around particular your application. So the solution for this particular type of thing is using schema definitions in Ms, graph and I think this may not be very familiar for it Pros. But this is a very good approach for developers, but we still feel like we would like to talk about it. They are not directly stored on applications like what directory extensions those, but they are Standalone resources.

B

That means, if you go to Ms graph or V 1.0 and point and say extensions, you will able to scheme my extensions. You will able to create a new schema extensions as you need, and once you create those schema extensions. You can actually add these your extensions to a or extension attributes to a resource what you need. So that means first, you need to create them onto Ms graph and then, after they have been created, you can able to add.

B

This is a different extension attributes to different resources like users and once those particular extension attributes have been. The schema definitions has been added to those user objects or group objects as needed. You can able to populate those values.

B

This is very common approach when your application is actually using Azure, ID authentication and also making Ms graph call, because these particular types of schema extensions. What you are using cannot be actually used as a claim they must have been called using Ms graph, and then you can able to use the select statement to get the value back.

B

That means my application is already making Ms graph call to say going to Office, 365 mail or calendar, or something like that and I'm trying to do more, and this is how I would like to decorate my application, but different particular properties, and then Ms graph is holding those extensions and allowing me to create, update and manage those extensions on different objects as needed. So again, this is more robust, particular attribute scenario to use Ms graph resources, and that way you can able to achieve them.

B

Okay, so I do not see any other question over here, so this is uh one other way to do it again. This is like a scenario 3A where you are a developer and you are developing an application and would like to use additional resource attributes in your application now I'll hand it over to Alison to cover the next scenario on this.

C

So, in a lot of ways, these two scenarios are similar. The kind of like thought processes is that you're developing your own application and that you're trying to extend some resources. This is kind. This is maps to that.

C

Fourth row in that table that we shared in the beginning, which is essentially open extensions and which even was showing maps to schema extensions which both like work strongly with, like a bunch of different Ms graph resources, even beyond the AED resources, and so once again, you're developing an app that you're working on, and you want to have more resources on top of those things and to kind of reiterate again that you don't need these as claims like you're What's, Happening Here is you're, probably already reaching out to the resource that you want to with an MS graph call, and you just want to be able to get more attributes out of that call.

C

And so what jeevan was talking about is essentially a more structured approach. um The schema extensions where you go in and you define the schema extension format and name, and all of that this is kind of more loosey-goosey. It's more Loosely typed. Essentially, you can really only do strings, I, think, and so essentially what happens on this. One, though, is you actually directly create the extension on the resource itself, so you actually go to users, slash blah blah.

C

You know whatever your user ID is and then you can directly add an extension attribute to that call. So essentially you do users, slash ID, slash or basically and then with a patch operation, and then you add in however many extension attributes you'd like and you directly pop it in there.

C

Then it can only be strings and you're not referencing, an external schema extension, so it is kind of easier but, like I, said less strongly, typed and less structured and a lot less information that you can put in in that way, because it's kind of simpler and smooth supposed to be lightweight, we don't let you put in you know: 100 attributes, I actually think it's like kind of limited to the I, think it's two per user per app or yeah, two per app creator per um resource.

C

So it's a lot more restraining in that regard and you can only have like two kilobytes of information in there anyways so you've stuck it inside of your user resource or whatever resource you're, trying to add the extension attribute to and then actually really. The only next step is whenever you want to retrieve that information from that resource, you make your call to that resource. So let's say you know, get users and then all you have to do is specify with a select statement. The name of the extension attribute that you'd like to look up.

C

This is basically the reason you have to do. The select is because it's just like not in the default or returned set of attributes for any resource. You just have to make sure to specify that in your statement, but basically it's a this is kind of the simplest one you just have you add it to your resource and you get it when you receive your resource back, go ahead, Michael, so I.

D

I was a little confused when you were describing this earlier. I think you clarified this. This essentially is a schema extension, but it doesn't necessarily you're not doing it at a directory level. Is that correct.

C

um So it's it's a little bit different than that and I'm going to try and and feel free to. Just like ask a question in the middle of an explanation. So, basically so open extension essentially you're just shoving that right into the object itself, so let's say user you're, just essentially patching user to contain, let's say two more fields that are both strings. It.

D

Won't be reflected in the directory at all.

C

Actually, I think it would be right even like basically, let's say you're doing it on YouTube, like those attributes would be available there. uh You do have to do like specifically an MS graph call to get it, and you specifically have to do the select statement on it. So it's a little bit more limited. It also wouldn't show up in the same way in like claims configurations experiences, because it's um so lightweight that essentially it doesn't have structure the same way that, like a schema extension or any of those kind of things, do basically yeah.

C

So basically it's.

D

It's crap only, you wouldn't see it if you're like, for example, if you're using Powershell to examine the object. You wouldn't see these. These particular schema extensions showing up.

B

Yandi, is you see open extensions and scheme schema extensions, so particularly they are not available as claims. So generally, they are not available like for common scenarios where you create them and you use multiple times in different applications, whereas it's more about like I, have in my own application, which I'm developing in Azure, ID and I am making graph calls and I'm trying to store my attributes, then it has been used.

B

That's how it is it, but if you'd like to see it, you can actually make a Powershell or a graph call to see them, because open attributes directly goes on the objects versus the schema. Extensions goes through the extension, so you can just query extensions on your particular tenant and you can able to see which extensions have been created by developers, so you can able to see them. There are different ways through which you can see them.

D

Okay, my apologies I'm just trying to understand the reason why I would take this approach over creating an extension attribute. That is a traditional schema extension for the directory.

C

Yeah essentially this is you can the way I. Think of it personally is for most cases. You probably still want to stick with the directory extension or schema extension due to the strongly typed thing, because you can hold more of them, because it's accessible in more ways. The one way, the one reason you might want to do open is really. If you just have like one small additional field, you want to shove into a resource and that you're, not you, don't need unclaims, like essentially you're planning on accessing that resource, regardless.

C

So, if you're, developing your own app and uh I think a more like a more clear example would be like. Let's say you have I think this is the one in the dock that I provided above where, basically, you have like information about the view settings. So you know like dark mode or those kind of things that should kind of stick with a like the user's app instant, like user across all their app instances and really doing a couple of strings one.

C

That's like the word dark to represent dark mode and then another one that's supposed to like represent their like target language, which is just like the word French or uh insert word there, and so you just shove those into the user object and then you're only reading them every once in a while, and you don't really need it to be. Like a claim, that's the example used in the the doc, but, like I, said I think most people will probably want to use directory or schema extensions.

C

This is kind of more lightweight develop, like small developer kind of focused in my is.

D

There a concern about this, creating confusion, and maybe a little bit of Chaos in in that it it could create.

D

um It could create something that only a certain you know set of developers are aware of, whereas maybe somebody that's more responsible for the directory as a whole, may not be aware that this has been done or.

B

That that would even exists.

D

Why why would I use this and- and more importantly, would I want I'm really discourage the use of this, so that that just my two cents.

B

Thanks, yes, but your concern is valence yeah.

C

I think that's another kind of strong case for schema extensions or directory extensions, because those are essentially queryable in some way that you can keep track of all of the extensions that exist in your tenant or on a specific resource, and so yeah I think the the robustness of those two helps kind of prevent that you know, like suddenly, there's an unexpected extension kind of a thing.

C

Any other questions on this one, all right so I think we've kind of actually discussed this already, so I might go through the slides on the quicker side, but it's basically like comparing schema extension versus open extension, the 3A and 3B scenarios, because they are kind of more similar.

C

They are both the scenario where you don't use them as claims you essentially directly access the resources that have the extension attributes on them now so schema extension is good for when you need structured data when you need larger amounts of data or more attributes, you can also manage this data extension, so like Michael was saying like basically or brought up the concern of like. Is there a way to keep track of these extension attributes and then also like keep their state? Yes is the answer for schema extension and what I mean by state is.

C

You can actually like, create a schema extension and make it available or not available to be assigned to resources kind of like an in-development version of it, which is all explained in that doc that I linked as well, so basically just a lot more robust in that way, as with all kind of trade-offs with robustness becomes more slightly more difficulty.

C

Usually so, there's just more steps in enabling this you have to directly create the schema extension resource itself and then associate it to the resource you'd like those extension attributes on, rather than just shoving it directly into the resource itself. So, therefore, you have more pieces to me. Essentially, all of the pros for schema extension are the cons for open extension, they're kind of like two sides of the same coin.

C

So open extension is good for storing less structured data and, if you need less of it, so a couple of strings directly Associated to a specific user, and it's much quicker like you, don't have to go through that first step of uh adding a schema extension resource.

C

A couple of cons for open extension is that it's not filterable. You can get it back as a select statement, but you can't filter on that there's kind of less available and it's like because of its free-form nature. It might be less appealing to those who need a more structured, app.

D

Can I interrupt and ask for clarity or something you just said that you referenced in the Pro for open extensions if you need something for a specific user and I want to clarify you're, not talking about a single user, that you're adding attributes to right, you're talking about the the object type of user or are you are you talking about? You can Target these to a specific user so that one user object might have some attributes that another user object would not have.

B

um No, it's a single user object. We are talking about we're not talking about multiple user objects, it's a single user object, but you can able to apply these particular open extensions per creator of the app on the resource. So it's like there. There is a limitation on that, but yes, it can be created on the same object.

C

D

C

Can do just a clarifying like in terms.

D

C

The actual API calls Michael, because I think this might help is basically you have like user slash user ID, and then you do a patch operation to that. That user and.

D

Then wow, okay,.

C

D

That is a very clear distinction. Yes, so I I I am getting more granular with my capabilities with respect to open extension,.

C

D

C

About like, as fine-grained as you can get in terms of like.

D

C

It is for a user, it is a super lightweight. You know it's like one extension at a time. Yeah exactly makes.

D

Total sense and that that in itself is a very strong reason for why you would use it, because I only need it applied to one or two users or one or two objects whatever they may be, as opposed to extending the schema for the whole object. Type.

C

D

C

Brings up a thing that I want to just say verbally that he put in the chat, which is basically open. Extensions also are useful for like putting a Json blob in a specific Resource as well, so I just want to call.

B

C

It's not just strings, but it is a much simpler set to table cool any other questions on this slide. It is kind of one of the the more confusing distinctions between the two, so hopefully that helps the article I linked also at the very bottom, has essentially I call it like the the super table. That just explains like based off of your requirements, which type of extension do you probably need?

C

It's super helpful all right, so we wanted to pause in case anybody had scenarios that they didn't feel fit any of these, and we can help kind of like figure it out together. If no one I think most people have been pretty good about asking questions the whole way we wanted to pause, uh go for it. Matthew.

D

Thanks Madison um so I'm getting the feeling that it's very customizable to get some attributes that you might need either in claims or just to be able to select for various reasons. Are there any things that you shouldn't be doing, that are sort of you know? No go areas, pitfalls, attributes that you shouldn't be creating or something to benefit.

B

One only thing which I it comes in my mind about it is: if there are women, see if you have a sink, where you can directly do a mapping of the default attributes to your particular on-prem ICD, uh try to use Azure directory extensions or schema extensions only particularly when you need them. That means is like don't go on creating like oh I, haven't one application where my one application need this part and I'm going to use like in breakthrough extensions through Azure ready, connect.

B

Sync, uh it doesn't make a sense in that case, because it should be reusable. In that case, if they've been used by five different applications, then it makes sense to create that one. But if you're just trying to create one-on-one as the required per application basis, then then this is not going to work very well in that in the future. The reason is, there are only 100 extensions you can able to create through the connect sync and then you should use it wisely. So that's where our advice is and I've seen some customers tasking.

B

It's like. Oh I have one, but I would like to create one here, and this will you can, but do you really want to do it I think that's the question which I'll say it's like: okay, you have to evaluate it's up to you. Sometimes you feel like no. This is my business critical. This is going across my arc.

B

Then it makes then it is fine, but otherwise is there a real use case for it, so you should evaluate that, but otherwise I do not see any other particular tones over here which will suggest to do it in that way.

D

Okay, thanks, that's very similar guidance. We used to give to purely on-premises active directory and, using extension, attributes use them sparingly because they are across the board kind of thing. um Another question that I have is: what are what, if you're thinking using something like MIM to Azure active directory and not necessarily as active directory connect.

B

I think these are two different ways through which you can able to sync. Your article uh Azure active director in popular different values may miss particularly and good particular solution where you want to do it from multiple sources like I, have an sap on premise for HR I have Oracle HR or something like an on-premise system from where I'm trying to fetch these values and then I want to put that into Azure active bracket. Then we might be a better solution because you can do mix and match.

B

If you have a clear like in my on-premise, ID is my truth, and my on-premise 80 goes to has already then connect. Sync is much more simpler, but if you would like to use multiple sources Transformations, then the name is the better solution.

D

Yeah I'm thinking of scenarios with multiple ad forests, disconnected forests or connected. You know various scenarios where there's multiple or ad sources, I suppose sources. They don't have to be active directly.

B

Then you should think about Cloud connecting because ad connection has a Cloud sync version too, which actually does solve that problem in in that way, because we have seen like a merger acquisition scenarios where I have like one particular Forest here another for SM, where is like, oh and I, would like to sing that to single Azure, ready, uh it's all possible through that, but I suggest you should evaluate the Azure ready, connect, Cloud sync for it before going to the meme is like a big thing, because we know it's like a deployment.

B

You have to do it. You have to maintain meme, it's like an it's all together, it's a bigger exercise, so I always recommend going to the cloud connection before and evaluate that before you deploy that.

D

Well in his uh I think what he stated was that he wasn't specifically talking or exclusively talking about, uh like uh various oncomes he's talking about various sources, so it may not be restricted to just active directory instances, so you might have a source that is some type of on-prem HR System or some technical from relationship management system or something along those lines, and so I'm not sure if the other solutions that you're talking about that are not them would satisfy that scenario.

B

Yes, if you have other than on Prima City, that's what I said like meme is very usefully when you have on-premise other systems where you are sourcing, the information from and that's what I referred to, sap and Oracle systems, because those are very commonly we have seen in customers. So yes in those particular cases, you can then think about them.

B

Okay, so I think we should move quickly, move forward and listen. I think we have still couple of things to go through.

C

Because I think they're kind of more straightforward uh juven, it probably helps if you do a quick look over the other questions. I tried to answer as many as I could in the chat, but okay, so claims configuration. Basically claims are a essentially configuring claims that lets you determine like which attributes get passed uh to an application during sign in time and figure out how how they are so like.

C

You can do like the format you can do the name, some conditions on those claims like whether or not they get sent you can also transform them, which basically is a couple of operations that allow you to change. The content of those claims in kind of specific ways like to uppercase uh trim white space like those kind of things, and you can configure claims in the ux for saml apps, the API or Powershell.

C

An unfortunate thing that we do need to talk about is essentially you can't manage claims, both programmatically and via the ux for the same app. It's a current Gap in our system that we are looking at, but I just want to highlight that it is something that ends up causing people some friction so I just want to mention that.

C

So, basically, if you have an application in your configuring claims on the ux, if you then go in and alter it on the API or Powershell, it will essentially make it. So that way you you've toggled, essentially into programmatical, to call that out. I will discuss the ux first and then we'll get into the API and stuff. So basically the claims configuration experience in the ux you can find inside of Enterprise applications and then single sign-on. It's recommend for most sample cases, because a cut does kind of like clean up the claims structure.

C

The claims policies can kind of be bigger, calls and very structured pieces of Json that can be kind of hard for some people. So if you're doing a xaml app, you know ux might be the move for you. It is configured on a per app basis and it can support these types of extensions standard attributes or default attributes. Extension attributes 1 through 15 and aad, connect sync extension attributes, so those will all be automatically listed and usable within the user experience ones that aren't built into the ux yet are Ms graph extensions.

C

So the open extensions and the schema extensions and then essentially non-aad connect sync directory extension. So I think that would have been scenario. Two the that ajeevan went over where, basically, you build your own directory extension and you have an app that stores all those directory extensions and you associate for you assigned that extension attribute onto users.

C

Those currently aren't available, but we are actually working on that and then in the API recommended for like highly repeatable claims configurations when you need to leverage directory extensions, it's configured on a per app basis and you can actually share them across apps as well, although that actually becomes less practical in practice, because oftentimes claims are kind of configured for app extension times that work for these is basically so standard attributes or default attributes. Extension attributes 1 through 15. all directory extension types. So this includes aad connect, sync and your own custom ones.

C

It does not. Actually, it should support Ms Graphics inches and opens right, even I think this might be yes,.

B

They support them as graph supports.

C

All of them so ignore the can't support I'll edit, the deck in case it gets sent out uh sorry about that, but basically it can spur all the types of extensions, sorry for the typo guys and then now we're kind of hitting the last slide, which is essentially upcoming, features, there's actually a bunch of stuff coming out in the claims space and the extension attribute space, so uh jeevan feel free to chime in on any of these, but I'm gonna in the interest of time, gonna kind of bang through them and I'm happy to stick around afterwards to chat about any questions that people have.

C

So these are all public, previews and gas that are noteworthy for this chat. So you know you can now do substring match on group names. You can now transform group names with regex, replace you can there's a couple more additional user attributes that can become claims now. Basically, you can now use and transform multi-value claims, but we now allow persistent Name ID.

C

In more cases, we now allow you to do multi-instance of SP initiated apps the attribute name format you can configure for any claim, not just the special ones that were before, and then now we have a substring function, which is basically just an additional transformation. Then other things that are kind of in the works. But we can't say anything about timelines are essentially, we are working on the API parity issue where the ux and API can have different things going on.

C

We are also working on allowing all types of extensions inside of the ux so rather than having that like weird, like some types are allowed to be configured in the ux in some type types aren't resolving that gap having an oadc claims, ux experience and not just saml, but also for oidc apps and then sending the group name for SAS apps, rather than just the ID.

C

So basically, people have been getting the ID and then having to look up the group name and now we can just choose to send it a bunch of fun stuff coming through a bunch of fun, stuff, actually kind of already coming like here. With public preview and GA so yeah sorry.

A

I, just love you to.

C

Answer any questions in the chat.

A

Without this Edison wirelessly claims, ux experience, multi-ins SP initiated apps, allow it wow yeah.

B

That is, that is Alpha actually announcement. We are doing on the group claim, so you- because we have heard this a lot, so you can see group name, substring, reg, X, regex, replace. That is also a cloud group display name into the token all of those we are doing and all these customization we are trying to bring it to the uidc. What apps? Also so that you can do more JWT customization as needed, along with Samuel applications.

A

Yeah I think that's it's really great to hear because I know we discussed about it quite some time ago and you know and good to see that all that is coming into future now and it's getting released. That's awesome, folks, any other questions for Allison and jeevan. This was an exciting call, I, really loved the conversation, the kind of flow that went through the call loved it. If there are any questions for uh listen and jivan or us feel free to put them in the chat or come up the mutant ask them.

A

We are also available. You can email us as well. This call is recorded and this is going to be put into our YouTube channel and I did send out a survey Link in the chat, please I mean I would request you to go ahead and put fill in the survey. This would really help us plan. Our upcoming calls and I put in the calendar invite for our upcoming calls. We have the next call coming up I.

A

Think on October 20., it's going to be a again a developer call I'm still not kind of like you know, we're still zeroing on on the on the on. What is it going to be, but I believe it's going to be a JavaScript, so yeah go ahead and download the calendar. Invite all right, hey thanks a lot you and Allison. This was excellent, I loved it I mean uh we'll. Have this uh video share and I will send it across to you, as well as the participants thanks a lot for your time. Thank.

C

You take care everyone.

B

Yep Take Care. Thank you thanks. Everybody.