Maester Packs
LowScript packFree

User Attributes

Checks that Microsoft Entra users have the attributes HR processes, dynamic groups and licensing depend on, that those values are formatted consistently, and that they use your approved values and office locations.

Version
0.5.0
Tests
26
Connectors
0
Published
5 Nov 2026

DevClate · devclate.user-attributes · 0 stars · Open source · MIT

PowerShell 
Install-MtPack DevClate/maester-pack-ua

Install only packs from sources you trust. This pack is made by DevClate, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/DevClate/maester-pack-ua.

maester-packs.lock.json entry 
{  "Id": "devclate.user-attributes",  "Source": "DevClate/maester-pack-ua",  "Version": "0.5.0",  "Commit": "b517a31d37e07d9c9cb11bf6bf582eaec603ac4d",  "Digest": "sha256:d8b91b6f76225c01279e09ba6b104e5f32e9fdcdbd4f344bfb8d6b2bddeeef92"}

← All tests

MP.CLT.UA.1010 Every employee ID belongs to only one user.

Severity: MediumGraph

Checks that no two member users share an employee ID. IDs are compared ignoring surrounding spaces and letter case (and, if IgnoreLeadingZeros is set, leading zeros). Disabled accounts are included by default.

HR-driven provisioning and many identity tools use the employee ID as the key that ties an account to a person. When two accounts share an ID, provisioning can update or disable the wrong account, a rehire can inherit a leaver's group memberships, and access reviews and audits cannot tell who an account belongs to. Duplicates usually come from rehires, typos, or a test account copied from a real one.

Remediation action

  1. For each shared ID listed below, check the HR record to see which account the ID belongs to.
  2. Correct the other accounts' employee ID (or clear it, for accounts that are not a person). For a rehire, decide with HR whether to reactivate the old account or keep the new one, then remove the ID from the account you are not keeping.
  3. Change the value at its source: the AD employeeID attribute for synced users, the HR record for HR-provisioned users, or Edit properties > Job information in the Microsoft Entra admin center for cloud users.
  4. If your HR system pads IDs with zeros inconsistently, set IgnoreLeadingZeros to true for this test so 00123 and 123 are treated as the same ID.

Related links

%TestResult%