Cloud Identity Engine Attributes
Table of Contents
Expand all | Collapse all
-
- Cloud Identity Engine Attributes
- Collect Custom Attributes with the Cloud Identity Engine
- View Directory Data
- Cloud Identity Engine User Context
- Create a Cloud Dynamic User Group
- Configure Third-Party Device-ID
- Configure an IP Tag Cloud Connection
- Configure Dynamic Privilege Access in the Cloud Identity Engine
- Configure Security Risk for the Cloud Identity Engine
-
-
- Configure Azure as an IdP in the Cloud Identity Engine
- Configure Okta as an IdP in the Cloud Identity Engine
- Configure PingOne as an IdP in the Cloud Identity Engine
- Configure PingFederate as an IdP in the Cloud Identity Engine
- Configure Google as an IdP in the Cloud Identity Engine
- Configure a SAML 2.0-Compliant IdP in the Cloud Identity Engine
- Configure a Client Certificate
- Configure an OIDC Authentication Type
- Set Up an Authentication Profile
- Configure Cloud Identity Engine Authentication on the Firewall or Panorama
- Configure the Cloud Identity Engine as a Mapping Source on the Firewall or Panorama
- Configure Dynamic Privilege Access in the Cloud Identity Engine
-
- Get Help
Cloud Identity Engine Attributes
An attribute is a unique identifier, such as a Distinguished
Name, that correlates to a specific object in the directory, which
can be a user, a computer, or another network entity. If your directory
uses custom attributes that do not use the following formats, specify
the custom formats in the Cloud Identity Engine app (see Collect Custom Attributes with the Cloud Identity Engine).
- On-Premises Active Directory
- Azure Active Directory
- SCIM Directory
- Okta Directory
- Google Directory
- On-Premises OpenLDAP
Verify that your attributes are valid before attempting to sync
the attributes. If one or more attributes are not valid, the initial sync is not
successful.
On-Premises Active Directory
You can collect the following types of default attributes
and their associated Active Directory fields:
- User Attributes
- Organizational Unit (OU) Attributes
- Group Attributes
- Container Attributes
- Computer Attributes
User Attributes
| Directory Sync Attribute | Directory Field |
|---|---|
| Admin Count | adminCount |
| Common-Name | cn |
| CompanyName | companyName |
| Country | co |
| Department | department |
| Distinguished Name | dn |
| Groups | memberOf |
| Last Login | lastLogon |
| LastLogonTime | lastLogonTimestamp |
| Location | l |
| MSDSAllowedDelegatedTo | msDS-AllowedToDelegateTo |
| MSDSAllowedToActOnBehalfOfOtherIdentity | msDS-AllowedToActOnBehalfOfOtherIdentity |
| MSDSSupportedEncryptionTypes | msDS-SupportedEncryptionTypes |
| Mail If you do not configure a
value for the Mail attribute, the
Cloud Identity Engine uses the value of the User
Principal Name. | |
| Manager | manager |
| NETBIOS Name | nETBIOSName |
| Name | displayName |
| Object Class | objectClass |
| Primary Group ID | primaryGroupID |
| SAM Account Name | sAMAccountName |
| SID | objectSid |
| SID History | sIDHistory |
| Service Principal Name | servicePrincipalName |
| Title | title |
| Unique Identifier | objectGUID |
| User Principal Name | userPrincipalName |
| UserAccountControl | userAccountControl |
| WhenChanged | whenChanged |
| WhenCreated | whenCreated |
Organizational Unit (OU) Attributes
| Directory Sync Attribute | Directory Field |
|---|---|
| Canonical Name | canonicalName |
| Common-Name | cn |
| Distinguished Name | dn |
| Name | displayName |
| Object Class | objectClass |
| Unique Identifier | objectGUID |
| When Changed | whenChanged |
| WhenCreated | whenCreated |
Group Attributes
| Directory Sync Attribute | Directory Field |
|---|---|
| Admin Count | adminCount |
| Common-Name | cn |
| Distinguished Name | dn |
| Group Type | groupType |
| Groups | memberOf |
| Mail If you do not configure a value for
the Mail attribute, the Cloud
Identity Engine uses the value of the User
Principal Name. | |
| Member | member |
| Name | name |
| Object Class | objectClass |
| SAM Account Name | sAMAccountName |
| SID | objectSid |
| Unique Identifier | objectGUID |
| WhenChanged | whenChanged |
| WhenCreated | whenCreated |
Container Attributes
| Directory Sync Attribute | Directory Field |
|---|---|
| Canonical Name | canonicalName |
| Common-Name | cn |
| Distinguished Name | dn |
| Domain | domain |
| Name | displayName |
| Object Class | objectClass |
| Unique Identifier | objectGUID |
| WhenChanged | whenChanged |
| WhenCreated | whenCreated |
Computer Attributes
| Directory Sync Attribute | Directory Field |
|---|---|
| Admin Count | adminCount |
| Common-Name | cn |
| Distinguished Name | dn |
| Groups | memberOf |
| HostID | _hostId |
| Host Name | dNSHostName |
| Last Login | lastLogon |
| LastLogonTime | lastLogonTimestamp |
| MSDSAllowedDelegatedTo | msDS-AllowedToDelegateTo |
| MSDSAllowedToActOnBehalfOfOtherIdentity | msDS-AllowedToActOnBehalfOfOtherIdentity |
| MSDSSupportedEncryptionTypes | msDS-SupportedEncryptionTypes |
| NETBIOS Name | nETBIOSName |
| Name | displayName |
| OS | operatingSystem |
| OSServicePack | operatingSystemServicePack |
| OSVersion | operatingSystemVersion |
| Object Class | objectClass |
| Primary Group ID | primaryGroupID |
| SAM Account Name | sAMAccountName |
| SID | objectSid |
| SID History | sIDHistory |
| Serial Number | serialNumber |
| Service Principal Name | servicePrincipalName |
| Unique Identifier | objectGUID |
| User Principal Name | userPrincipalName |
| UserAccountControl | userAccountControl |
| WhenChanged | whenChanged |
| WhenCreated | whenCreated |
Azure Active Directory
You can collect the following types of default attributes
and their associated Active Directory fields:
User Attributes
| Directory Sync Attribute | Directory Field |
|---|---|
| BusinessPhones | businessPhones |
| CompanyName | companyName |
| Country | country |
| Department | department |
| EmployeeId | employeeId |
| FaxNumber | faxNumber |
| Given Name | givenName |
| Groups | memberOf |
| IsResourceAccount | isResourceAccount |
| LastPasswordChangeDateTime | lastPasswordChangeDateTime |
| Location | officeLocation |
| Mail If you do not configure a
value for the Mail attribute, the
Cloud Identity Engine uses the value of the User
Principal Name. | |
| Manager | manager |
| MobilePhone | mobilePhone |
| Name | displayName |
| OnPremisesDistinguishedName | onPremisesDistinguishedName |
| OnPremisesDomainName | onPremisesDomainName |
| OnPremisesExtensionAttributes | onPremisesExtensionAttributes |
| OnPremisesImmutableId | onPremisesImmutableId |
| OnPremisesLastSyncDataTime | onPremisesLastSyncDateTime |
| OnPremisesProvisioningErrors | onPremisesProvisioningErrors |
| OnPremisesSamAccountName | onPremisesSamAccountName |
| OnPremisesSyncEnabled | onPremisesSyncEnabled |
| OtherMails | otherMails |
| PasswordPolicies | passwordPolicies |
| PasswordProfile | passwordProfile |
| PostalCode | postalCode |
| PreferredLanguage | preferredLanguage |
| SignInSessionsValidFromDateTime | signInSessionsValidFromDateTime |
| State | state |
| StreetAddress | streetAddress |
| Sur Name | surname |
| Title | jobTitle |
| Unique Identifier | objectGUID |
| UsageLocation | usageLocation |
| User Principal Name | userPrincipalName |
| UserAccountControl | accountEnabled |
| UserType | userType |
| createdDateTime | createdDateTime |
| onPremisesSecurityIdentifier | onPremisesSecurityIdentifier |
| onPremisesUserPrincipalName | onPremisesUserPrincipalName |
Role Assignments Attributes
The Cloud Identity Engine only collects these attributes
if you select the Collect Roles and Administrators (Administrative
roles) option when you set up your Azure directory.
| Directory Sync Attribute | Directory Field |
|---|---|
| Description | description |
| Is Builtin | isBuiltIn |
| Is Enabled | isEnabled |
| Name | displayName |
| Role Permissions | rolePermissions |
| Template Id | templateId |
| Unique Identifier | objectGUID |
Group Attributes
| Directory Sync Attribute | Directory Field |
|---|---|
| Classification | classification |
| DeletedDateTime | deletedDateTime |
| Description | description |
| Group Type | groupTypes |
| Groups | memberOf |
| Mail If you do not configure a
value for the Mail attribute, the
Cloud Identity Engine uses the value of the User
Principal Name. | |
| Mail Nick Name | mailNickname |
| MailEnabled | mailEnabled |
| Member | member |
| Name | displayName |
| OnPremisesDomainName | onPremisesDomainName |
| OnPremisesLastSyncDateTime | onPremisesLastSyncDateTime |
| OnPremisesProvisioningErrors | onPremisesProvisioningErrors |
| OnPremisesSecurityIdentifier | onPremisesSecurityIdentifier |
| OnPremisesSyncEnabled | onPremisesSyncEnabled |
| RenewedDateTime | renewedDateTime |
| SAM Account Name | onPremisesSamAccountName |
| SID | securityIdentifier |
| SecurityEnabled | securityEnabled |
| Unique Identifier | objectGUID |
| Visibility | visibility |
| createdDateTime | createdDateTime |
Computer Attributes
| Directory Sync Attribute | Directory Field |
|---|---|
| ComplianceExpirationDateTime | complianceExpirationDateTime |
| Device ID | deviceId |
| Groups | memberOf |
| IsCompliant | isCompliant |
| IsManaged | isManaged |
| LastLogonTime | approximateLastSignInDateTime |
| Manufacturer | manufacturer |
| MdmAppId | mdmAppId |
| Model | model |
| Name | displayName |
| OS | operatingSystem |
| OSVersion | operatingSystemVersion |
| ProfileType | profileType |
| Serial Number | deviceId |
| SystemLabels | systemLabels |
| TrustType | trustType |
| Unique Identifier | objectGUID |
| UserAccountControl | accountEnabled |
| createdDateTime | createdDateTime |
Application Attributes
| Directory Sync Attribute | Directory Field |
|---|---|
| App Id | appId |
| App Roles | appRoles |
| Application TemplateId | applicationTemplateId |
| Description | description |
| DisabledByMicrosoftStatus | disabledByMicrosoftStatus |
| Identifier Uris | identifierUris |
| Name | displayName |
| Unique Identifier | objectGUID |
| createdDateTime | createdDateTime |
| web | web |
SCIM Directory
You can collect the following types of default attributes
and their associated SCIM Connector fields:
User Attributes
The following section lists the default attributes for
users that the directory provisions to Directory Sync using SCIM.
| Directory Sync Attribute | SCIM Field |
|---|---|
| Common-Name | name_formatted |
| CompanyName | addresses_work_formatted |
| Country | addresses_work_country |
| Department | enterprise_department |
| EmployeeId | enterprise_employeeNumber |
| FaxNumber | phoneNumbers_fax_value |
| Given Name | name_firstName |
| Groups | groups |
| Location | addresses_work_locality |
| Mail If you do not configure a
value for the Mail attribute, the
Cloud Identity Engine uses the value of the User
Principal Name. | emails_work_value |
| MobilePhone | phoneNumbers_mobile_value |
| Name | displayName |
| PostalCode | addresses_work_postalCode |
| PreferredLanguage | preferredLanguage |
| PreferredName | nickName |
| StreetAddress | addresses_work_streetAddress |
| Sur Name | name_familyName |
| Title | title |
| Unique Identifier | objectGUID |
| User Principal Name | userName |
| UserType | userType The SCIM gallery app does not support the
userType attribute. |
| createdDateTime | meta_created |
Group Attributes
The following section lists the default attributes for
groups that the directory provisions to Directory Sync using SCIM.
Group names for the displayName attribute must
be unique. For more information, refer to Troubleshoot Cloud Identity Engine Issues.
| Directory Sync Attribute | SCIM Field |
|---|---|
| Description | displayName |
| Group Type | groupTypes |
| Member | members |
| Name | displayName |
| Unique Identifier | objectGUID |
| createdDateTime | meta_created |
Okta Directory
You can collect the following types of default attributes
and their associated Okta Directory fields:
User Attributes
| Directory Sync Attribute | Okta Directory Fields |
|---|---|
| City | city |
| CompanyName | companyName |
| Country | countryCode |
| Department | department |
| Distinguished Name | dn |
| EmployeeId | employeeNumber |
| Given Name | firstName |
| Groups | memberOf |
| Last Login | lastLogin |
| LastPasswordChangeDateTime | passwordChanged |
| Mail If you do not configure a
value for the Mail attribute, the
Cloud Identity Engine uses the value of the User
Principal Name. | |
| Manager | managerDN |
| MobilePhone | mobilePhone |
| Name | displayName |
| PostalCode | zipCode |
| PreferredLanguage | preferredlanguage |
| PreferredName | nickName |
| Primary Group ID | primaryGroupID |
| SID | objectSid |
| State | state |
| StreetAddress | streetAddress |
| Sur Name | lastName |
| Title | title |
| Unique Identifier | objectGUID |
| User Principal Name | userName |
| UserAccountControl | status |
| UserType | userType |
| createdDateTime | created |
Group Attributes
| Directory Sync Attribute | Okta Directory Fields |
|---|---|
| Description | description |
| Group Type | groupTypes |
| Groups | memberOf |
| Member | member |
| Name | name |
| SAM Account Name | samAccountName |
| SID | objectSid |
| Unique Identifier | objectGUID |
| createdDateTime | created |
Application Attributes
| Directory Sync Attribute | Okta Directory Field |
|---|---|
| App Id | appId |
| Client Uri | client_uri |
| Description | description |
| Name | displayName |
| Unique Identifier | objectGUID |
Google Directory
To identify users and apply security policy, the Cloud
Identity Engine collects the following attributes from Google Directory:
User Attributes
| Directory Sync Attribute | Google Directory Field |
|---|---|
| BusinessPhones | phones |
| Country | country |
| Given Name | givenName |
| Groups | memberOf |
| LastLogonTime | lastLoginTime |
| Location | locations.area |
| Mail If you do not configure a
value for the Mail attribute, the
Cloud Identity Engine uses the value of the User
Principal Name. | primaryEmail |
| Name | fullName |
| OtherMails | emails |
| PreferredLanguage | languages |
| SID | id |
| State | state |
| StreetAddress | streetAddress |
| Sur Name | familyName |
| Title | title |
| Unique Identifier | objectGUID |
| User Principal Name | userName |
| UserAccountControl | suspended |
| UserType | isAdmin |
| createdDateTime | creationTime |
Organizational Unit (OU) Attributes
| Directory Sync Attribute | Google Directory Field |
|---|---|
| Description | description |
| Name | name |
| Unique Identifier | objectGUID |
Group Attributes
| Directory Sync Attribute | Google Directory Field |
|---|---|
| Group Type | kind |
| Groups | memberOf |
| Mail If you do not configure a
value for the Mail attribute, the
Cloud Identity Engine uses the value of the User
Principal Name. | |
| Member | member |
| Name | name |
| SID | id |
| Unique Identifier | objectGUID |
Computer Attributes
| Directory Sync Attribute | Google Directory Field |
|---|---|
| Groups | memberOf |
| HostName | dNSHostName |
| Last Login | lastLogon |
| LastLogonTime | lastLogonTimestamp |
| NETBIOS Name | nETBIOSName |
| OS | operatingSystem |
| OSServicePack | operatingSystemServicePack |
| OSVersion | operatingSystemVersion |
| Primary Group ID | primaryGroupID |
| SID | deviceId |
| SID History | sIDHistory |
| Serial Number | serialNumber |
| Service Principal Name | servicePrincipalName |
| Unique Identifier | objectGUID |
| User Principal Name | userPrincipalName |
| UserAccountControl | status |
On-Premises OpenLDAP
You can collect the following types of default attributes
and their associated Active Directory fields:
- User Attributes
- Organizational Unit (OU) Attributes
- Group Attributes
- Container Attributes
- Computer Attributes
User Attributes
| Directory Sync Attribute | OpenLDAP Directory Field |
|---|---|
| Common-Name | cn |
| Country | co |
| Department | department |
| Distinguished Name | dn |
| Groups | memberOf |
| Last Login | lastLogon |
| LastLogonTime | lastLogonTimestamp |
| Location | l |
| Mail If you do not configure a
value for the Mail attribute, the
Cloud Identity Engine uses the value of the User
Principal Name. | |
| Manager | manager |
| Name | displayName |
| Object Class | objectClass |
| SAM Account Name | sAMAccountName |
| SID | objectSid |
| Title | title |
| Unique Identifier | entryUUID |
| User Principal Name | userPrincipalName |
| WhenChanged | modifyTimestamp |
| WhenCreated | createTimestamp |
Organizational Unit (OU) Attributes
| Directory Sync Attribute | OpenLDAP Directory Field |
|---|---|
| Canonical Name | canonicalName |
| Common-Name | cn |
| Distinguished Name | dn |
| Name | displayName |
| Object Class | objectClass |
| Unique Identifier | entryUUID |
| WhenChanged | modifyTimestamp |
| WhenCreated | createTimestamp |
Group Attributes
| Directory Sync Attribute | OpenLDAP Directory Field |
|---|---|
| Common-Name | cn |
| Distinguished Name | dn |
| Group Type | groupType |
| Groups | memberOf |
| Mail If you do not configure a
value for the Mail attribute, the
Cloud Identity Engine uses the value of the User
Principal Name. | |
| Member | uniqueMember |
| Name | name |
| Object Class | objectClass |
| Unique Identifier | entryUUID |
| WhenChanged | modifyTimestamp |
| WhenCreated | createTimestamp |
Container Attributes
| Directory Sync Attribute | OpenLDAP Directory Field |
|---|---|
| Canonical Name | canonicalName |
| Common-Name | cn |
| Distinguished Name | dn |
| Domain | domain |
| Name | displayName |
| Object Class | objectClass |
| Unique Identifier | entryUUID |
| WhenChanged | modifyTimestamp |
| WhenCreated | createTimestamp |
Computer Attributes
| Directory Sync Attribute | OpenLDAP Field |
|---|---|
| Common-Name | cn |
| Distinguished Name | dn |
| Groups | memberOf |
| HostName | dNSHostName |
| Last Login | lastLogon |
| LastLogonTime | lastLogonTimestamp |
| NETBIOS Name | nETBIOSName |
| Name | displayName |
| OS | operatingSystem |
| OSServicePack | operatingSystemServicePack |
| OSVersion | operatingSystemVersion |
| Object Class | objectClass |
| Primary Group ID | primaryGroupID |
| SAM Account Name | sAMAccountName |
| SID | objectSid |
| Serial Number | serialNumber |
| Unique Identifier | entryUUID |
| User Principal Name | userPrincipalName |
| User Account Control | userAccountControl |
| WhenChanged | modifyTimestamp |
| WhenCreated | createTimestamp |