Entra ID users

FortiDLP can integrate with Entra ID to sync users and generate directory labels based on their attributes.

FortiDLP provides one-way directory synchronization. No information from FortiDLP is imported into your Entra ID user directory. Syncs are performed on-demand from the FortiDLP Console's Admin settings.

Prior to connecting to an Entra ID server, you must organize your directory so that it contains the appropriate user groups. FortiDLP supports basic query capabilities using Entra ID's $filter parameter for identifying users. Refer to the Entra ID documentation here for the relevant syntax.

Before you configure an Entra ID integration, ensure you understand the following concepts:

• field mappings
• directory label mappings.

Field mappings

Field mappings define how Entra ID attributes map to user fields that display in the FortiDLP Console or are used by FortiDLP for identification.

The following table describes the supported mappings, which do not require configuration.

Field mappings

Entra ID attribute	FortiDLP field	Description
displayName	Name	The user's first and last name.
mail	Email	The user's email address.
photo	Image	The user's profile picture.
jobTitle	Title	The user's job title.
department	Department	The user's department.
manager.displayName	Manager	The user's line manager's first and last name.
mobilePhone	Mobile phone	The user's mobile phone number.
businessPhones	Office phone	The user's office phone number.
streetAddress	Home address	The user's home address.
officeLocation	Office address	The user's office address.
id	Unique ID	The user's identifier.

Directory label mappings

Prior to reading this section, it is recommended that you read Labels.

Directory label mappings define how Entra ID attributes map to labels, which FortiDLP uses to associate users with policy groups and Agent configuration groups.

For example, a directory label mapping could be used to assign a label to users that identifies their department within your organization. This would ease configuration, allowing you to select specific departments when enabling policies and Agent functionality.

FortiDLP can generate and assign directory labels for the following Entra ID attributes:

• city
• country
• department
• employeeHireDate
• employeeType
• jobTitle
• officeLocation
• memberOf

Resulting directory labels will display in the FortiDLP Console in the format Attribute | Value, such as Department | Sales.

For security purposes, directory label values can be replaced with pseudonyms in the FortiDLP Console for operators with the pseudonymization perspective (for more information about this feature, see Operator roles). Further, directory labels for the memberOf attribute can be "flagged" upon generation, highlighting associated users in the FortiDLP Console.