User Attributes give you another powerful, user-centric way to manage devices that can cut down on admin time and simplify workflows. Once an end user signs into their identity provider account, data returned from the provider becomes available in Addigy as device facts — things like Employee Department, Employee Type, or Mobile Phone are useful for automating Addigy in response to changes in your organization.
Prerequisites
- Addigy Identity is configured as outlined in the Okta setup guide.
- You have admin-level permissions in your Okta instance.
How to Enable User Attributes for Okta
Create an API Token in Okta
- Log in to Okta's Admin Console.
- Go to Security > API in the sidebar.
- Select the Tokens tab.
- Click Create Token and name it.
- Copy the Token Value.
Enable Collect User Attribute Data
- In the policy's Addigy Identity configuration, enable Collect User Attribute Data.
- Paste the Token Value into Addigy's API Token field.
- Scroll to the bottom of the page and click Save Changes.
Supported Attributes
The table below lists each supported attribute's name, mapping value, and meaning.
| Addigy Attribute Name | Attribute Mapping Value | Attribute Meaning |
|---|---|---|
| Identity Email | mail |
Email address for the user; for example: ["j@companyname.com"]. This property cannot contain accent characters. |
| Identity Employee Department | department |
The name of the department in which the user works. |
| Identity Employee Type | employeeType |
Captures enterprise worker type — for example, Employee, Contractor, Consultant, or Vendor. |
| Identity Mobile Phone | mobilePhone |
The primary cellular telephone number for the user. |
| Identity Provider Name | okta, google, azure | The name of the Identity Provider. |
| Identity User Display Name | displayName |
The name displayed in the directory for the user — usually the combination of the user's first and middle initial and last names. Required when a user is created, and cannot be cleared during updates. |
| Identity Username | userPrincipalName |
An Internet-style login name for the user, based on the Internet standard RFC 822. By convention, this should map to the user's email name, in the format alias@domain, where the domain is present in the tenant's collection of verified domains. Required when a user is created. |
| Identity Office Location | usageLocation |
A two-letter country code (ISO standard 3166) — for example, US, JP, or GB. |
| Identity Password Set Date | lastPasswordChangeDateTime |
The time the user last changed their password, or when their password was created, whichever occurred most recently. |
Frequently Asked Questions
How often does this data refresh?
User Attributes refresh every time the end user successfully signs in.
What should I do with these attributes?
Use User Attributes to automatically filter devices with flex policies.
Does this feature cost extra?
No, there's no additional cost for this feature.
Where do I see these populated fields?
One device: GoLive > Overview. Search for "Identity."
Multiple devices: Go to the Devices page, click Columns, search for "Identity," then select the attributes you want to see.
If I don't have this feature enabled, does Addigy still collect user data?
No. User information is only collected if the Collect User Attributes setting is enabled.
Why do some of my device facts show N/A?
This usually means the end user still needs to sign in successfully, the corresponding field is blank in the Identity Provider's directory, or the feature isn't enabled or configured correctly.