Skip to main content
We've launched our new Knowledge Base! Read the announcement →

Microsoft Entra ID: attributes “UPN” and “mail” differ from each other

Updated

When using our Phishing Simulation and E-learning via SAML, the address that your Microsoft Entra ID provides to us via SAML should be the exact same as the one in our user list. To check this, follow the steps below: 

Step 1: Make sure that the SoSafe user list contains the correct attribute.

Go to the SoSafe user list and check that it contains an email address with which the users can receive emails.

If this is not the case, please fix this: 

  1. If you are using the manual user list, do so with a new Excel import. 

  2. If you are provisioning via Microsoft Entra ID, please provision the corresponding attribute and contact your support consultant at SoSafe if necessary so that the correct value is selected. Microsoft Entra ID > Enterprise Application > Provisioning > Edit attribute mappings > Mappings 

Microsoft Entra ID Enterprise Application Provisioning page, with Edit attribute mappings marked in red under Manage provisioning. The left navigation shows Provisioning selected, alongside Single sign-on and Self-service.

Attribute Mapping:

Microsoft Entra ID Provisioning page with the Mappings section expanded, showing Provision Microsoft Entra ID Users marked in red. Provision Microsoft Entra ID Groups is also listed, both enabled.

Step 2: Make sure that the same attribute is conveyed in the SAML application.

Go to the Microsoft Entra ID Enterprise Application you have created for SoSafe, and then go to 
“Single sign-on" > Box 2 “Attributes & Claims” > Edit

Replace the value for the claim name “Name ID” with the attribute provisioned in the SoSafe user list:

Microsoft Entra ID SAML-based Sign-on page with Edit marked in red next to Attributes and Claims, which lists Unique User Identifier mapped to user.userprincipalname alongside givenname, surname, and emailaddress.
Microsoft Entra ID Attributes and Claims edit page with the Unique User Identifier Name ID row marked in red. Additional claims below map to user.mail, user.givenname, user.userprincipalname, and user.surname.

Test SSO access - done!