Select attributes to sync from your identity provider | Entitle

Overview

Entitle can sync selected user attributes from your identity provider (IdP), such as department, job title, or employee type. Synced attributes appear on each user's profile and can be used as conditions in approval workflows.

You choose which attributes Entitle syncs. Attributes you do not select are never sent to Entitle, allowing you to control exactly what user data enters the platform.

Prerequisites

• You must have the Super Admin, Tenant Admin, or Admin role. The Read-Only Admin role cannot change attribute selection.
• You must have an Entra ID or Okta directory, or you must be connecting one now.
• Your directory connection grants the permissions for the attribute types you want to sync. See Required permissions.

Select attributes when you connect a directory

Attribute selection is an optional step in directory setup. If you skip it, Entitle syncs no attributes, and you can add them later.

Entra ID

1. Go to Org settings > Integrations and start the Entra ID directory setup.
2. Complete the directory configuration step, then click Next.
3. Select the checkbox for each attribute you want Entitle to sync.
4. To rename an attribute, click its Display name cell and enter a new name.
5. Click Setup IdP groups to continue to group selection, or click Skip to continue without syncing any attributes.
6. Complete the remaining setup steps.

Okta

1. Go to Org settings > Integrations and start the Okta directory setup.
2. Complete the directory configuration step, then click Next.
3. Select the checkbox for each attribute you want Entitle to sync.
4. To rename an attribute, click its Display name cell and enter a new name.
5. Click Setup IdP groups to continue to group selection, or click Skip to continue without syncing any attributes.
6. Complete the setup.

About display names

The display name is what Entitle shows for the attribute on user profiles and in the approval workflow condition builder. It defaults to the attribute's name in your IdP, and you can change it to something clearer. For example, you can rename fname to First name. If you clear the display name, Entitle uses the original name.

Find an attribute

Directories can expose hundreds of attributes. To narrow the list:

• Search by either the original attribute name or the display name.
• Sort the table using the Sort drop-down.

The counter at the top left shows how many attributes you have selected out of the total available, for example Selected 3/560.

Change attributes after setup

You can add, remove, and rename attributes at any time without reconnecting the directory.

1. Go to Org settings > Integrations, select your directory, then click Settings.
2. Click Edit attributes. The screen opens with your current selections and display names.
3. Add, remove, or rename attributes.
4. Click Save.

Entitle re-syncs the directory and shows a syncing indicator until it finishes.

Attributes that are in use

An attribute that is in use cannot be removed. In use means the attribute is referenced as a condition in at least one approval workflow. The In use column shows how many reference each attribute.

In-use attributes appear selected but locked. To remove one, first remove it from every approval workflow that references it, then return to this screen.

If more than 20 attributes are in use, you cannot edit the selection at all until you reduce that number.

What happens after you save

Where synced attributes appear

On a user's profile

Go to Users, then select a user. Synced attributes display in the profile header, after the fixed fields for Email and Entitle role, ordered A-Z.

Each attribute shows its display name as the label and the synced value beneath it. Hover over any attribute to see its original name in your IdP. This is useful for tracing an alias back to its source, especially for custom or extension attributes.

If a user has no value for an attribute, that attribute is omitted for that user rather than shown empty.

When more attributes are synced than fit across the header, the remainder collapse behind a chip showing the hidden count, such as 20+. Click the chip or the expand arrow to open a list of the hidden attributes.

Attribute values are read-only. They come from your IdP and cannot be edited in Entitle.

Who can see attribute values:

In approval workflows

Synced attributes are available as rule conditions in approval workflows, which lets you route requests or approve them automatically based on the requesting user's attribute values. See Use IdP attributes as conditions.

Required permissions

Custom security attributes need extra setup. The Global Administrator role alone does not grant access to them, so the admin who grants consent must also hold the Attribute Definition Reader or Attribute Definition Administrator role. Discovery of custom security attributes is also turned off by default.

If a permission is missing, Entitle skips that attribute type instead of failing. Those attributes do not appear in the list.

Limitations

• You can select a maximum of 20 attributes per directory. Each directory has its own selection.
• Attribute sync is available for Entra ID and Okta only.
• Entitle does not support Entra ID schema extensions in this release.
• Existing directories are unaffected until you configure attribute selection for them.
• Some Entra ID attributes cannot be synced, because Entra ID does not return them when Entitle queries all users at once: aboutMe, birthday, hireDate, interests, mySite, pastProjects, preferredName, responsibilities, schools, skills, and mailboxSettings. These do not appear in the attribute list, and no permission change makes them available.