I'm curious if anyone here has experience with implementing Microsoft Graph schema extensions to tag Entra ID groups with structured metadata. I'm not referring to custom security attributes, since those still don't support groups. I mean the actual Graph schema extensions, which provide a way to directly assign custom attributes to group objects in Entra without cluttering group names.
In my setup, I've configured it to help simplify naming conventions. Instead of cramming all the details into group names, like resource name, IAM role, environment, and team, I generate straightforward names like xyz-Azure-func-001 and use schema extensions to attach relevant metadata directly to the group.
For each group, I include attributes such as:
- resourceName: "myapp-prod-func"
- role: "Contributor"
- environment: "Production"
- serviceType: "FunctionApp"
- index: 001
- createdBy: "runbook"
- lifecycleStatus: "Active"
This data is written directly onto the group object using the Graph API, and the entire process is automated with Azure Automation runbooks that manage tasks from generating the next group index to assigning IAM roles. This method has vastly improved group governance and automation by decoupling group names from any role or resource changes, allowing for easier updates without needing to rename groups. Plus, it feeds data into Azure Tables or SQL for visualization in Power BI, making it easier to track group metrics.
Is anyone else adopting schema extensions for better group management and organization?
2 Answers
That's really interesting! 🙌 I'm intrigued by the way you're implementing it. It sounds like a very efficient method to streamline management!
We've utilized directory extensions quite a bit as well, but not in the same capacity you're describing for role tracking. Microsoft keeps track of Azure role assignments automatically and you can see what resources those roles apply to.
We had to code up a script to query for every subscription since we have over 1800 subscriptions in our tenant. You might find that approach useful if you're not already using it.

Related Questions
How To: Running Codex CLI on Windows with Azure OpenAI
Set Wordpress Featured Image Using Javascript
How To Fix PHP Random Being The Same
Why no WebP Support with Wordpress
Replace Wordpress Cron With Linux Cron
Customize Yoast Canonical URL Programmatically