Maester Packs
LowScript packFree

User Attributes

Checks that Microsoft Entra users have the attributes HR processes, dynamic groups and licensing depend on, that those values are formatted consistently, and that they use your approved values and office locations.

Version
0.5.0
Tests
26
Connectors
0
Published
5 Nov 2026

DevClate · devclate.user-attributes · 0 stars · Open source · MIT

PowerShell 
Install-MtPack DevClate/maester-pack-ua

Install only packs from sources you trust. This pack is made by DevClate, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/DevClate/maester-pack-ua.

maester-packs.lock.json entry 
{  "Id": "devclate.user-attributes",  "Source": "DevClate/maester-pack-ua",  "Version": "0.5.0",  "Commit": "b517a31d37e07d9c9cb11bf6bf582eaec603ac4d",  "Digest": "sha256:d8b91b6f76225c01279e09ba6b104e5f32e9fdcdbd4f344bfb8d6b2bddeeef92"}

← All tests

MP.CLT.UA.1013 User country values use an approved spelling.

Severity: LowGraph

Checks that the country attribute on member users uses one approved spelling per country.

The country (or region) attribute is free text, so one tenant can hold US, USA, U.S. and United States for the same place. Dynamic group rules, Conditional Access exclusions based on those groups, reports and HR integrations all compare the text exactly, so each spelling behaves like a different country. This is separate from usage location (checked by MP.CLT.UA.1001), which is a two-letter code chosen from a list.

Until you list the spellings your organisation uses (in CLT.UA.AllowedValues → country, shared with the other approved-value tests, or in this test's AllowedCountries), this test shows the values it finds and asks you to review them (Investigate) instead of failing.

Remediation action

  1. Review the values listed below and pick one spelling for each country, for example United States.

  2. Set those values for this test in maester-config.json:

    { "GlobalSettings": { "CLT.UA.AllowedValues": { "country": ["United States", "Canada"] } } }

  3. Change the users with another spelling, in the Microsoft Entra admin center (Edit properties > Contact info > Country or region) or with PowerShell: Update-MgUser -UserId <UPN> -Country 'United States'.

  4. For users synced from Active Directory or provisioned from an HR system, fix the value at the source (co in AD).

Related links

%TestResult%