IAM MS Entra Data Element Dictionary

MS attribute names reflect whether they are single or multivalued. Plural names are the multivalued ones.

Attribute	Description	Notes

Attribute	Description	Notes
oid	The unique identifier assigned by the MS Entra ID tenant	Applications will acquire this during authentication in order to retrieve a user’s profile.
userPrincipalName⁽¹⁾	See eduPersonPrincipalName
accountEnabled⁽¹⁾	Boolean that determines account access to MS services.	True if account is active, False if reserved or deprovisioned.
mailNickname⁽¹⁾	See uid
displayName⁽¹⁾	Full name displayed in the directory
mail⁽²⁾	See uhEmail
givenName⁽⁴⁾	See givenName
surname⁽⁴⁾	See sn
department	<reserved>	Has data left behind from when Entra was originally implemented.
employeeId	See uhUuid
extension_<app_id>_primaryRole	Primary role where Faculty and Staff roles trump student, etc.	The value `deprovisioned` indicates a soft-deleted⁽⁶⁾user.
extension_<app_id>_scopedAffiliations⁽¹⁰⁾	See uhOrgAffiliation, formatted as `role@campus`.	Duplicate values are not included; this may not be a complete list of active affiliations.
extension_<app_id>_employeeHomeOrg	Employee home organization.	May be empty if PeopleSoft HR has not assigned a value.
extension_<app_id>_studentHomeOrg⁽⁵⁾	Student home organization.	May be empty if Banner has not assigned a value.
extension_<app_id>_uhReleasedGroupings⁽⁷⁾	See uhReleasedGrouping	Consider using the UH Groupings, Entra Security Group sync destination instead.

Footnotes:

⁽¹⁾ Required attributes for creating an Entra ID user.
⁽²⁾The original assertion ^“Exchange Online determines this value. Graph can only read the value.” is incorrect.⁽^ref⁾
⁽⁴⁾ consistent behavior across Microsoft 365, GAL, and third-party apps that assume normalized first/last names, it’s usually safer to populate it along with surname. If you only set displayName, most core services still work, but some UI elements and personalization may look odd or inconsistent.
⁽⁵⁾ This is in production.
⁽⁶⁾ A soft-delete indicates that user access has been disabled, but no account information removed.
⁽⁷⁾ This a planned feature to augment the existing uhReleasedGrouping sync destination. Conceptually, Entra functions as a addition LDAP directory. In LDAP the attribute name is uhReleasedGrouping, in Entra it is plural per Entra attribute naming standards: uhReleasedGroupings.
⁽¹⁰⁾ This attribute’s initial function is to support MS software licensing at the campus level. Transforming uhOrgAffiliation values to role@campus facilitates using the attribute in dynamic security group definitions.