Maester Packs
LowScript packFree

User Attributes

Checks that Microsoft Entra users have the attributes HR processes, dynamic groups and licensing depend on, that those values are formatted consistently, and that they use your approved values and office locations.

Version
0.5.0
Tests
26
Connectors
0
Published
5 Nov 2026

DevClate · devclate.user-attributes · 0 stars · Open source · MIT

PowerShell 
Install-MtPack DevClate/maester-pack-ua

Install only packs from sources you trust. This pack is made by DevClate, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/DevClate/maester-pack-ua.

maester-packs.lock.json entry 
{  "Id": "devclate.user-attributes",  "Source": "DevClate/maester-pack-ua",  "Version": "0.5.0",  "Commit": "b517a31d37e07d9c9cb11bf6bf582eaec603ac4d",  "Digest": "sha256:d8b91b6f76225c01279e09ba6b104e5f32e9fdcdbd4f344bfb8d6b2bddeeef92"}

← All tests

MP.CLT.UA.1005 All member users have an employee ID.

Severity: MediumGraph

Checks that every enabled member user has an employee ID.

The employee ID is how HR-driven provisioning (Workday, SuccessFactors or API-driven inbound provisioning) matches an HR record to an account. Without it, a rehire can get a second account, a leaver's account may never be disabled, and audits cannot tie an account to a person. Accounts that are not people, such as service accounts, usually have no employee ID: exempt them with ExcludedUsers or ExcludedGroups.

Remediation action

  1. Find each user listed below in your HR system and copy their employee number.
  2. In the Microsoft Entra admin center, go to Entra ID > Users, open the user, select Edit properties > Job information, enter the Employee ID, and save.
  3. For many users, set it with PowerShell: Update-MgUser -UserId <UPN> -EmployeeId '100234'.
  4. For users synced from Active Directory, set employeeID in AD. For HR-provisioned users, fix the attribute mapping so it is always written.

Related links

%TestResult%