Sync Email Signatures from Microsoft Entra ID (Azure AD): Attributes, Permissions and Hybrid AD (2026)

TL;DR: Microsoft Entra ID (formerly Azure AD) already holds most of what a signature needs: name, job title, department, phones, office and address. A signature tool reads those fields through Microsoft Graph with read-only application permissions that a Global Administrator consents to once. Pick who syncs by user, group or administrative unit, assign signatures by rules on those fields, and fix wrong data in Entra ID rather than in the signature. Scribe syncs from Entra ID once a day (plus manual refresh) and drops any block whose field is empty. It does not connect to on-premises Active Directory directly; hybrid tenants sync AD into Entra ID first.

Last reviewed: October 2026. Covers Microsoft Entra ID (cloud-only and hybrid with Entra Connect), Microsoft Graph user properties, and Scribe's Entra ID connector.

This guide is for the IT admin who owns the directory and has been asked to make every email signature show the right title, department and phone number without maintaining a spreadsheet. It explains which Entra ID attributes can feed a signature, what the connection needs from a security point of view, how to scope the sync, what happens when data is missing, and where hybrid Active Directory fits. For the end-to-end Microsoft 365 rollout (add-in, server-side routing, Outlook versions), read the Microsoft 365 signature playbook. If HR, not IT, owns titles and departments in your company, read HRIS as the source of truth next.

Which Entra ID attributes can feed an email signature?

Every Entra ID user is a Microsoft Graph user object. The properties that matter for signatures are standard ones that most tenants already populate during onboarding (user resource type, Microsoft Learn). Scribe's data-collection page lists the fields it stores from Entra ID: profile picture, first and last name, job position, mobile phone, work phone, fax, department, office, street address, city, state or province, zip or postal code, country or region, group and administrative-unit memberships, and domain hostnames (Scribe: Entra ID data collection).

The table maps those Scribe fields to the Graph property that normally holds the value. Scribe's documentation names the fields, not the Graph properties, so treat the middle column as the standard Microsoft property for that field rather than a quote from Scribe.

Field in the signature	Graph user property	Microsoft notes	Stored by Scribe
First name / Last name	givenName, surname	Returned by default	Yes
Job title	jobTitle	Max 128 characters	Yes ("Job position")
Department	department	Max 64 characters	Yes
Office	officeLocation	Free text	Yes
Work phone	businessPhones	Only one number can be set; read-only for users synced from on-premises	Yes
Mobile phone	mobilePhone	Read-only for users synced from on-premises	Yes
Fax	faxNumber		Yes
Street, city, state, postal code, country	streetAddress, city, state, postalCode, country	Address of the place of business	Yes
Photo	Profile photo	Set in Microsoft 365 or Entra ID	Yes ("Profile picture")
Company name, employee ID, employee type	companyName, employeeId, employeeType	Require $select in Graph	Not listed
Exchange custom attributes	onPremisesExtensionAttributes (1-15)	Up to 1,024 characters each	Not listed

Property limits and read-only rules are from the Graph user resource. Two details matter in practice. businessPhones is a collection but holds only one number, so a direct line and a switchboard number can't both live there. And department caps at 64 characters, which is one more reason to keep department names short and consistent: they are also what your assignment rules will match on.

What does the connection need from IT and security?

Scribe's Entra ID connector needs a Global Administrator to authorize it; a non-admin sign-in fails, and Scribe offers to email the invitation to your Global Admin instead (Connect Microsoft Entra ID). That matches Microsoft's own rule: application permissions on Microsoft Graph (app roles) can't be consented to by a Cloud Application Administrator or Application Administrator; that takes a Privileged Role Administrator or a Global Administrator (Grant tenant-wide admin consent, Microsoft Learn).

The permissions requested, from Scribe's scopes page:

Permission	Type	Why Scribe asks for it
User.Read.All	Application	Read every user's profile fields
Group.Read.All	Application	Read the groups you created
GroupMember.Read.All	Application	Read who belongs to which group
AdministrativeUnit.Read.All	Application	Create matching departments from administrative units
Domain.Read.All	Application	Import your domains
openid, profile, email, User.Read	Delegated	Let teammates sign in to Scribe with their Microsoft account
offline_access	Delegated	Keep the connection alive without re-authenticating

Every permission is a read permission. Scribe states it has read-only access, cannot edit anything in Microsoft 365 and cannot read your emails (Scribe docs). If the consent screen errors, the usual cause is a conditional access or app consent policy that blocks third-party consent; Scribe's troubleshooting section points there first (Scribe docs). Microsoft's user consent settings page explains where those policies live.

Before you connect, run a five-minute data audit. Whatever is wrong in Entra ID becomes what customers see in every email. With Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "User.Read.All"
$users = Get-MgUser -All -Filter "accountEnabled eq true and userType eq 'Member'" `
  -Property displayName,mail,jobTitle,department,officeLocation,mobilePhone,businessPhones
"Missing job title:  " + ($users | Where-Object { -not $_.JobTitle }).Count
"Missing department: " + ($users | Where-Object { -not $_.Department }).Count
"Missing work phone: " + ($users | Where-Object { -not $_.BusinessPhones }).Count
$users | Group-Object Department | Sort-Object Count -Descending |
  Select-Object Count, Name | Format-Table

The last command is the one people skip. It lists every distinct department value, which is where you find "Sales", "sales" and "Sales & BD" living side by side. Clean those before you write assignment rules that match on department.

How do you connect Entra ID and choose who syncs?

The flow in Scribe has five steps (Connect Microsoft Entra ID):

1. Go to Settings > Integrations and click Connect on the Microsoft Entra ID card, then Connect Entra ID.
2. Pick the Microsoft account for your tenant. It must hold the Global Admin role.
3. Review the Permissions requested screen and click Accept.
4. In Synchronize Teammates, choose people on the Teammates tab, whole administrative units on the Units tab, or groups on the Groups tab. The group list can be filtered by type: Microsoft 365 groups, mail-enabled security groups, security groups and distribution groups.
5. Decide on the two import options, Import email aliases (with a per-domain selection) and Import shared mailboxes. Both are on by default. Then click Synchronize.

You don't have to sync the whole directory. Scribe bills for people whose primary email has a signature assigned, not for everyone synced (pricing), but syncing service accounts, room mailboxes and test users still clutters reports and completion percentages. Scope the sync to real senders. Aliases and shared mailboxes are covered in the aliases and shared mailboxes guide.

Should users, groups or administrative units drive the sync?

Scribe can scope two things from the directory: who is imported (the sync selection) and who gets which signature (assignment). Both accept groups and administrative units, and they solve different problems.

Directory object	What Microsoft says	Licensing	Good for
Individual users	Direct selection	None	Pilots, small exceptions
Assigned security or Microsoft 365 group	Membership edited by hand or by an owner	None extra	Pilot groups, brands, subsidiaries
Dynamic membership group	Membership calculated from rules such as user.department -eq "Sales"	Entra ID P1 for each unique member (Microsoft Learn)	Department signatures that maintain themselves
Administrative unit	A container for users, groups or devices, built to scope admin roles	Creating one works on Entra ID Free; admins scoped to it need P1 (Microsoft Learn)	Regions or business units that already exist as AUs; Scribe turns them into departments

A pattern that scales with little upkeep:

1. Sync one broad selection, for example a group of all employees with a mailbox, with auto-sync turned on for it.
2. Assign signatures by Smart Field condition rather than by list, for example "If Microsoft 365 department is any of Sales, Sales & Marketing", and tick auto-assign this signature to all future teammates (Assign teammates to a signature).
3. Use groups or administrative units for assignment only where the grouping isn't in a user attribute, such as a brand, a legal entity or a pilot cohort.

Auto-sync is configurable per scope. By default Scribe imports new teammates added to Entra ID; you can toggle it for teammates not in a selected unit or group, per unit, and per group, from Settings > Integrations > Microsoft Entra ID (Scribe docs). Turn it off for scopes where you want a human to decide, such as contractors.

How often does Entra ID data sync, and what happens when people join, move or leave?

Scribe syncs connected directory sources once a day, based on your workspace time zone, and an admin can click Refresh on the Teammates or Smart Fields page to sync immediately (Teammates overview, Smart Fields). The flow is one-way: changes to synced fields are made in Entra ID and appear in Scribe after the next sync.

Event in Entra ID	What happens in Scribe	Source
New user in a synced scope with auto-sync on	Imported as a teammate on the next sync; gets any signature whose rule matches and that has auto-assign on	Connect Entra ID, Assign teammates
Title, department or phone changes	Smart Field value updates on the next sync; the signature follows	Smart Fields
Department changes and a rule-based assignment no longer matches	Expected to move to the signature whose rule now matches; test this in your pilot	Inferred from rule-based assignment; not described step by step in Scribe's docs
License deactivated	Signature removed from Scribe and the user removed from billing	Pricing FAQ

Two practical consequences. First, a title changed at 9 a.m. can take until the next daily sync to reach the signature; if a change has to be live now (a new executive, a corrected phone number), change it in Entra ID and click Refresh. Second, if you need to react to joiners and leavers elsewhere, for example to open an ITSM ticket, Scribe sends teammate.created and teammate.deleted webhooks for changes made by a directory sync as well as by people (Webhook events).

Deleting a teammate's emails inside Scribe is a different action: it removes their signature but leaves the user untouched in Entra ID (Teammates overview).

Can you use custom attributes, extension attributes or pronouns?

This is the most common request after the basics work: pronouns, a certification line, a license number, a second language, a pager number. Entra ID has two places for this kind of data:

• Exchange custom attributes, exposed in Graph as onPremisesExtensionAttributes (extensionAttribute1 to extensionAttribute15). Each holds up to 1,024 characters. For users synced from on-premises AD they are mastered on-premises and read-only in the cloud; for cloud-only users they can be set on create or update (Microsoft Learn).
• Directory extensions registered by an application, which add custom properties to the user object.

Scribe's Entra ID data-collection page does not list extension attributes or directory extensions among the fields it stores (Scribe docs). Until Scribe documents them, plan on one of these routes for custom data:

Route	How	Best when
Custom Smart Field stored in Scribe	Create a field (Text, Image or Link) with data source "Scribe", then fill it in bulk, by CSV, or by inviting teammates to fill their own (Smart Fields)	Data the directory will never hold, such as pronouns or a personal LinkedIn URL
Scribe API	PATCH /v1/teammates/{id} sets Smart Field values for a teammate (API reference)	You already have a script or flow that reads the extension attribute
A second data source	Connect an HRIS or Okta and map that field from there; Okta, for example, provides honorific prefix and suffix, employee number, cost center and division (Scribe: Okta data)	HR or the identity provider already owns the value

For pronouns, Scribe's "invite teammates to fill data" option is a good fit: the employee enters the value in a limited profile view and can't see the rest of the workspace (Smart Fields). If extension attributes are a requirement for your rollout, ask Scribe to confirm support before you commit.

What happens when an Entra ID field is empty?

This is where directory-driven tools differ most. An Exchange Online mail flow rule replaces tokens such as %%MobilePhone%% with directory values, but it has no per-field logic, so a label written next to an empty token still appears (Microsoft Learn).

In Scribe, if a teammate has no value for a Smart Field, the block connected to that field isn't rendered and the layout closes around it. Placeholder values appear only in the editor and previews, never in sent mail (Smart Fields). One template can therefore serve people with and without a mobile number.

That hides the gap; it doesn't fix it. Use the Information completion column on the Smart Fields page and the Information: Missing filter on the Teammates page to find who is incomplete. Mark a field Required only if it is actually used in a template, otherwise the completion percentage becomes meaningless (Smart Fields).

What about on-premises Active Directory and hybrid identity?

Scribe connects to Microsoft Entra ID. It does not document a connector for on-premises Active Directory, and none is listed in its integrations (Integrations overview). In practice that matters less than it sounds, because most organizations with on-premises AD and Microsoft 365 already run a hybrid identity sync:

• Microsoft Entra Connect Sync runs a synchronization cycle every 30 minutes by default (Microsoft Learn). The attributes it synchronizes include department, title and extensionAttribute1 to extensionAttribute15 (attributes synchronized, Microsoft Learn).
• Microsoft Entra Cloud Sync is the lighter-weight agent alternative (Microsoft Learn).

So the data path for a hybrid tenant is AD, then Entra ID (every 30 minutes by default), then Scribe (daily or on refresh). The rule that trips people up: for synced users, the source of authority is on-premises. Graph marks mobilePhone and businessPhones read-only for users synced from on-premises, and extension attributes are read-only in the cloud for them (Graph user resource). Fix those values in Active Directory Users and Computers or your AD tooling, not in the Entra admin center.

Two edge cases need a separate answer:

• Exchange Server on-premises mailboxes. Directory sync gives you the data, but Exchange Online mail flow and the Microsoft 365 add-in don't reach those mailboxes. For Windows users without a Microsoft 365 cloud license, Scribe documents a desktop app deployed through an RMM tool (Scribe: Outlook for Windows via RMM). Ask Scribe for a design review before committing.
• Users who exist only in on-premises AD (no Entra ID object). Scribe can't see them through the directory. Add them manually or by CSV (Teammates overview).

How do you fix wrong signature data at the source?

Synced fields are locked in Scribe; the profile shows a lock icon on any field that comes from Entra ID (Teammate profile). That is deliberate: the signature should never disagree with the directory. The fix loop is:

1. Find the bad value: preview the signature with real data, or filter teammates by missing information.
2. Correct it in Entra ID (cloud-only user) or in on-premises AD (synced user). From the Smart Fields page, Update data on Microsoft Entra ID links you to the admin console (Smart Fields).
3. Click Refresh in Scribe, or wait for the daily sync.

For bulk corrections on cloud-only users, Graph PowerShell is faster than the portal:

Connect-MgGraph -Scopes "User.ReadWrite.All"
Import-Csv .\title-fixes.csv | ForEach-Object {
  Update-MgUser -UserId $_.UserPrincipalName -JobTitle $_.JobTitle -Department $_.Department
}

See Update-MgUser and Update user on Microsoft Learn. Note that Microsoft treats some properties, including mobilePhone and businessPhones, as sensitive: only specific privileged administrator roles can update them, especially on other administrators' accounts.

When the directory is simply the wrong owner for a field (titles kept in Workday, direct lines kept in Aircall), don't keep fixing Entra ID by hand. Switch that Smart Field's data source to the system that owns it. The HRIS guide covers how to split ownership field by field.

Where does Scribe fit?

Scribe's Entra ID integration imports users, groups, administrative units, aliases and shared mailboxes with read-only Graph permissions, and every plan includes it (pricing). The same data drives the Microsoft 365 add-in and server-side routing. For audits, the hosted MCP server lets an admin ask an AI assistant questions such as "list teammates missing a job title" (Scribe AI agents), and the REST API exposes teammates, Smart Fields and per-email install state for scripts.

Frequently asked questions

Which Entra ID fields can appear in an email signature?

Any populated user property can, in principle. Scribe stores profile picture, first and last name, job position, mobile, work phone, fax, department, office, street address, city, state, postal code, country, group and administrative-unit memberships, and domains from Entra ID. In Microsoft Graph these correspond to properties such as givenName, surname, jobTitle, department, officeLocation, businessPhones, mobilePhone and the address fields.

What permissions does an Entra ID signature integration need?

Scribe requests read-only Microsoft Graph application permissions (User.Read.All, Group.Read.All, GroupMember.Read.All, AdministrativeUnit.Read.All, Domain.Read.All) plus delegated sign-in scopes. Because these are application permissions, a Global Administrator or Privileged Role Administrator must grant consent; Scribe's connector requires a Global Admin.

How often do Entra ID changes reach the signature?

Scribe syncs connected directories once a day based on your workspace time zone, and an admin can click Refresh to sync immediately. In a hybrid tenant, add Entra Connect's own cycle in front of that: by default it runs every 30 minutes.

Does Scribe sync from on-premises Active Directory?

Not directly. Scribe connects to Microsoft Entra ID only. Hybrid organizations sync on-premises AD into Entra ID with Entra Connect Sync or Cloud Sync, and Scribe reads the synced values from Entra ID. For synced users, fix data in on-premises AD, because Microsoft makes some properties read-only in the cloud for them.

Can I use extensionAttribute1-15 in a signature?

Scribe's Entra ID data-collection page doesn't list extension attributes or directory extensions, so confirm with Scribe before relying on them. Workable alternatives today are a custom Smart Field stored in Scribe (filled manually, by CSV, by the employee, or through the API) or a field mapped from a connected HRIS or Okta.

What happens if a user has no mobile number in Entra ID?

Scribe doesn't render the block tied to an empty Smart Field and closes the layout around it, so the signature shows no empty label or gap. Native Exchange mail flow rule tokens can't do this: a label next to an empty token still appears.

Should I assign signatures by group or by department attribute?

Use attribute rules where the grouping is in user data, for example a Smart Field condition such as Department is Sales with auto-assign for future teammates. Use groups or administrative units for groupings that aren't attributes, such as brands, legal entities or pilot cohorts. Dynamic membership groups in Entra ID require an Entra ID P1 license per member.

Does removing someone in Scribe delete them from Entra ID?

No. Scribe's access is read-only. Deleting a teammate's emails in Scribe removes their signature but leaves the user in Entra ID. In the other direction, Scribe's pricing FAQ says that deactivating a user's license in Entra ID removes their signature and their seat from billing.

Related Handbook guides

• Microsoft 365 and Exchange Online company-wide signatures
• HRIS as the source of truth for signature data
• Replies, internal emails, aliases and shared mailboxes
• Rollout and rebrand playbook
• Client-side vs server-side email signatures