Entra user attributes

Which Microsoft Entra ID user attributes the Zation FinOps Platform reads, how each one must be formatted, and what the Platform can show once they are maintained. Use this page to decide what to clean up in your tenant before or during onboarding.

Why attribute quality decides what you see

The Platform builds its cost-allocation views directly from your user attributes. Every attribute below becomes an axis you can group licence cost by — department, cost center, division, office, legal entity.

Two behaviours are worth knowing before you start:

• An axis appears as soon as a single user carries a value. If 30 of 900 users have a cost center, the Platform shows a cost-center view in which the remaining spend sits in an Unknown bucket. Partial maintenance looks worse than none.
• Nothing is inferred. The Platform never guesses a department from a job title or a cost center from a group membership, and it withholds a recommendation rather than deriving one from absent data.

One attribute at 100% beats four at 25%

Completeness matters more than the number of attributes you maintain. Finish one before starting the next.

All attributes on this page are read through Directory.Read.All and User.Read.All, which you already grant during onboarding — see Permissions. Maintaining them is a change in your tenant only; the Platform holds no write access.

Required attributes

These three carry the base analysis. With all three complete, most of the allocation value is available.

Attribute	Where in Entra	Format	Example	What the Platform uses it for
usageLocation	Users → Properties → Settings → Usage location	ISO 3166-1 alpha-2 country code, two characters	CH	Country breakdown and regional licence logic. Takes precedence over the free-text country field.
department	Users → Properties → Job information → Department	One value, no combinations	Finance	The default axis of every cost view. Always displayed, maintained or not.
employeeOrgData.costCenter	Job information → Cost center	One code scheme, applied consistently	CC-4711	Chargeback per cost center instead of a per-head split.

An alternative to the cost center field

If your cost centers already live in an on-premises AD extension attribute, use that instead — see Extension attributes. Pick one location and fill it completely rather than maintaining both partially.

Recommended attributes

Maintain these only where your organisation structure gives them a clear meaning. An attribute filled with ambiguous values produces an axis without a statement.

Attribute	Where in Entra	Worth maintaining when	What the Platform uses it for
employeeOrgData.division	Job information → Division	You group departments into business units	A rollup one level above department
companyName	Job information → Company name	Several legal entities share one tenant	Cost separation per entity
officeLocation	Job information → Office location	You report at a finer grain than country	Site-level cost view
employeeType	Job information → Employee type	You distinguish permanent staff, temporary staff, and contractors	Role-appropriate licence profiles, such as frontline versus knowledge worker
employeeId	Job information → Employee ID	Your HR system holds a stable personnel code	A stable anchor for profile comparison across name changes
jobTitle	Job information → Job title	Titles follow a consistent naming scheme	Comparison of similar roles in user profiling

Extension attributes

Many organisations have kept a cost center, company code, or business area in extensionAttribute1 through extensionAttribute15 in on-premises Active Directory for years. The Platform reads all 15 slots, so you do not need to restructure anything.

In the Platform you select the slot your tenant uses from a dropdown and give it a readable label — ext5 becomes Cost center and appears under that name in every cost view. Spelling variants of the same value can be grouped afterwards, without a re-sync.

What to watch for:

• One purpose per slot. A slot holding a cost center for some users and a site for others cannot be used as an axis.
• Document which slot means what. An undocumented slot stops being maintained after the next staff change.

Cloud-only users have no portal field for these

The 15 slots are populated by Microsoft Entra Connect from your on-premises directory. Users that exist only in the cloud have no field for them in the Entra admin center — populate those through Microsoft Graph or PowerShell, or the slots stay empty for exactly those users.

Formatting rules

The Platform takes your values as they are. That is deliberate — it invents no mapping — and it means spelling variants become separate cost buckets.

Rule	Not this	This	Otherwise
Casing is significant	Finance, finance, FINANCE	Finance throughout	Three separate buckets for one department
One value per field	Finance/HR	The applicable value per user	A Finance/HR bucket that appears in no other total
No additions inside the value	CC-100 (Sales)	CC-100	The same code appears in several variants
One code scheme	4711 and CC-4711 mixed	CC-4711 throughout	One cost center reported as two
ISO 3166-1 country codes	Switzerland	CH	Microsoft rejects the value and the field stays empty
A closed vocabulary for employee type	external, External, Freelancer	Employee, Contractor, Temporary	No reliable split of licence profiles

Empty fields are not an error, but they are visible: users without a value land in the Unknown bucket. Your tenant issues no warning — the effect shows up in the cost view.

Suggested order

1. Set usageLocation for every user. Lowest effort, highest effect, and Microsoft validates the format for you.
2. Fill department for every user. Agree the list of permitted department names first, then apply it.
3. Maintain the cost center in one place — either the Entra Cost center field or one extension attribute slot.
4. Add employeeType. This is what lets role-appropriate recommendations apply, such as cheaper profiles for staff without a fixed workstation.
5. Feed the attributes from your HR system through Microsoft Entra Connect. Manual maintenance in the portal drifts within months.

See also

• Permissions — the read scopes that make these attributes available to the Platform
• Onboarding — where attribute review fits into the onboarding sequence