Skip to main content
Veteran
October 13, 2025
Solved

employeenumber extension attribute for directory match

  • October 13, 2025
  • 6 replies
  • 200 views

We have an attribute “employeenumber” from on-premAD which is syncd to Entra. Was trying to use this for my directory attribute match for the privileged access but on the drop-down selection in BeyondInsight, it only shows “employeenumber” as the attribute name but the actual Entra attribute name is supposed to be “extensionattribute_<appreg_clientID>employeenumber”. 

Is there a way to map this to an on-premAD “employeenumber” attribute but use Entra for my requester group? I am just not sure if it PS will recognize it since it s trying to map the requester (from Entra SAML SSO) against the  on-prem AD attribute.

    Best answer by Howard

    Currently the employeenumber for Entra ID is not supported. 

    https://beyondtrustcorp.service-now.com/csm?id=kb_article&sysparm_article=KB0021516

    6 replies

    HowardAnswer
    BeyondTrust Employee
    October 13, 2025

    Currently the employeenumber for Entra ID is not supported. 

    https://beyondtrustcorp.service-now.com/csm?id=kb_article&sysparm_article=KB0021516

    JasperAuthor
    Veteran
    October 13, 2025

    thanks ​@Howard , I didn’t realize we cannot use that. I would assume that the on-prem AD attribute employeeID, which is currently not used can be re-purposed for this instead.

    BeyondTrust Employee
    October 14, 2025
    Trailblazer
    October 27, 2025

    Hi Howard, just to make sure I understood. Employee ID attribute can be used to map AD account and Entra ID, right?

    Higor Louback
    Trailblazer
    October 28, 2025

    Just for your information. I was not able to use Employee ID, I needed to use:

    Dedicated Account

    • Account Name
    • with prefix
    Higor Louback
    BeyondTrust Employee
    November 6, 2025

    Just back from my vacation.

    You can’t use the employee ID for EntraID account and has to use the account name with prefix? Employee ID is currently not supported for EntraID.