Who can create and assign Entra custom security attributes?
Short answer
Only User2 can create custom security attributes because User2 has the Attribute Definition Administrator role; User1's Global Administrator role does not include that permission by default. The attributes can be assigned to MI1 and Service1 only, not Group1.
Question
You have a Microsoft Entra tenant that contains the users shown in the following table.
The tenant contains the identities shown in the following table.
Which users can create custom security attributes, and to which identities can the attributes be assigned? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Key Takeaways
The question tests the separation between broad Global Administrator rights and the specific Attribute Definition Administrator role, plus the fact that custom security attributes target users and service principals, including managed identities, but not groups.
This SC-300 hotspot tests Microsoft Entra custom security attributes. It establishes that the Attribute Definition Administrator role, not Global Administrator by default, can create them, and that only service principals such as MI1 and Service1, not Group1, are valid assignment targets.
Common mistake: Selecting User1 because Global Administrator sounds all-powerful, or adding Group1 because groups are common Entra assignment targets; custom attribute creation requires Attribute Definition Administrator and groups are not supported targets.
Expert Analysis
Role permission is narrower than the Global Administrator label The key distinction is between broad tenant administration and the specific right to define custom security attributes. In Microsoft Entra, creating an attribute definition requires the Attribute Definition Administrator role. Global Administrator is very broad, but it does not include this action by default. A Global Administrator must first assign the Attribute Definition Administrator role to itself or another account before it can create definitions. In this scenario, User2 is the account that holds Attribute Definition Administrator, so only User2 can create the custom security attributes. Discussion comments capture the trap well: one learner notes that a global admin can create an attribute only after assigning the required role to themselves, but “by default, a global admin CAN NOT create a custom security attribute.”
Assignment targets are object-type limited The second decision is not about the user’s role but about which Entra object types support custom security attributes. Attributes can be assigned to users and service principals. Managed identities are service principals in Entra, so MI1 qualifies; Service1 also qualifies as a service principal. A security group such as Group1 does not. Comments in the thread reflect this: learners state that custom security attributes “can only be applied to users and service principals” and identify MI1 and Service1 as the valid targets. Including Group1 is a common wrong selection because groups are frequent targets for role assignments, but group objects are not supported for custom security attributes here.
What would flip the answer If User1 were also assigned Attribute Definition Administrator, both users would be able to create definitions. If the target were a user object rather than Group1, that user would be valid. If the question asked who can assign attribute values rather than create definitions, the relevant role would be Attribute Assignment Administrator. Operationally, assuming Global Administrator covers custom attributes leads to failed setup, and attempting to assign attributes to a group fails because groups are unsupported.
Official Reference
- https://learn.microsoft.com/en-us/entra/fundamentals/custom-security-attributes-overview
- https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-security-attributes-manage
These links open the official vendor documentation in a new tab.
Exam Strategy
For Entra role questions, do not equate the broadest admin role with every action. Look for the workload-specific role that owns the task, then check object-type support separately. Here, creation maps to Attribute Definition Administrator and assignment maps to user or service-principal objects; managed identities count as service principals. If a Global Administrator is shown, ask whether the required role was explicitly assigned.
Frequently Asked Questions
Can a Global Administrator create custom security attributes by default?
Can custom security attributes be assigned to Group1 or a managed identity?
Which role assigns custom security attribute values?
Discussion 11 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 11
-
csi_2025 👍 4This is wrong. A GA does not have the permission to do so. While a GA has widespread permissions across the tenant he does not have permissions for all tasks including creating custom security attributes.
-
anonymousarpanch 👍 4correct. at present customer security attributes can only be assigned to users and service principals. refer https://learn.microsoft.com/en-us/entra/fundamentals/custom-security-attributes-overview
-
7aef484 👍 3A global admin can create a custom security attribute AFTER they assign the required roles to themselves. By default, a global admin CAN NOT create a custom security attribute.
-
AcTiVeGrEnAdE 👍 2This is one thing Global Administrator cannot do. Actually learned this in my GCCH tenant when I had a request come in. Custom security attributes can only be applied to users and service principals
-
levan1988 👍 2Can create custom security attributes: User1 and User2 only Custom security attributes can be assigned to: MI1 and Service1 only
Show 6 more comments
-
AcTiVeGrEnAdE 👍 2Global Admin cannot create custom security attributes
-
krzkrzkra 👍 2User2 only Service1 and MI1 only
-
krutesh 👍 1Answer: User1 and User2 can create custom security attributes. custom security attributes can be assigned to Service1 Only. While Attribute Definition Administrator role is specifically designed for managing custom security attributes, Global Administrators have highest level of permissions and can perform this task as well. Custom security attributes can be added to following Microsoft Entra objects: Microsoft Entra users Microsoft Entra enterprise applications (service principals)
-
user1234543210 👍 1User 2 only, if you use the compare roles in M365admin center for GA and Attribute Def Admin, scroll to the very bottom and you will see that this is the specific task GA cannot do. MI1 and Service1 Only. from what I recall I thought MI are services principals so I said both of them
-
d1e85d9 👍 1Can create custom security attributes: - Global administrator - Attribute Definition administrator Custom secuerity attributes can assigned to: - Security group (group1) - Service principal (Service1)
-
Rackup 👍 1User1 and User2 only for creating custom security attributes Group1, MI1, and Service1 for where attributes can be assigned
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →