Maester Packs
LowScript packFree

User Attributes

Checks that Microsoft Entra users have the attributes HR processes, dynamic groups and licensing depend on, that those values are formatted consistently, and that they use your approved values and office locations.

Version
0.5.0
Tests
26
Connectors
0
Published
5 Nov 2026

DevClate · devclate.user-attributes · 0 stars · Open source · MIT

PowerShell 
Install-MtPack DevClate/maester-pack-ua

Install only packs from sources you trust. This pack is made by DevClate, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/DevClate/maester-pack-ua.

maester-packs.lock.json entry 
{  "Id": "devclate.user-attributes",  "Source": "DevClate/maester-pack-ua",  "Version": "0.5.0",  "Commit": "b517a31d37e07d9c9cb11bf6bf582eaec603ac4d",  "Digest": "sha256:d8b91b6f76225c01279e09ba6b104e5f32e9fdcdbd4f344bfb8d6b2bddeeef92"}

← All tests

MP.CLT.UA.1006 All member users have an employee hire date.

Severity: MediumGraph

Checks that every enabled member user has an employee hire date.

Lifecycle Workflows run joiner tasks (such as creating a Temporary Access Pass, adding groups, or emailing the manager) a set number of days before or after employeeHireDate. A user without a hire date never triggers those workflows. The date also helps access reviews and audits tell new starters from long-standing accounts.

Reading this attribute needs the User-LifeCycleInfo.Read.All Graph permission. If the connection Maester uses does not have it, every user looks blank; this test then reports Investigate instead of failing every user.

Remediation action

  1. Make sure the app or account Maester connects with has User-LifeCycleInfo.Read.All.
  2. For HR-provisioned users, map the HR start date to employeeHireDate in the provisioning app's attribute mappings.
  3. For users synced from Active Directory, sync a start-date attribute to employeeHireDate (in Microsoft Entra Connect, through a directory extension and a sync rule).
  4. For cloud users, set it with PowerShell: Update-MgUser -UserId <UPN> -EmployeeHireDate '2026-11-02T00:00:00Z'.

Related links

%TestResult%