Entra Policy Suite settings · Settings > User tagging
User tagging
| Key | UserTagging.Enabled |
|---|---|
| Where | Settings > User tagging |
| Type | On / off |
| Default | Off |
| Feature | User tagging · Community |
| Confirmation | Entra Policy Suite asks you to confirm before it is switched on. |
What it does
Switches the user tagging feature on: the job that evaluates the user rules and gives every user their tags (persona, classification, authentication ...) in extension attributes.
When enabled
The scheduler starts the job at its schedule. What it does depends on 'User tagging mode': Preview computes the changes and writes none, Apply writes them (cloud users through Microsoft Graph, AD-synced users through the hybrid worker). Run now from the Jobs page works too.
When disabled
Off (the default): no scheduled run, and Run now requests for user tagging are refused. Tags already written stay as they are.
Risk and how to reverse it
With the mode on Apply, the tags drive Conditional Access policies and groups, so a wrong rule changes who gets which policy. The mass-change guard holds a run that changes far more than the last one. Reversible: switch it off; tags written stay until a later run or a restore changes them.
Requires
Admin. The engine identity's Graph rights to write user extension attributes (given by the install), and a hybrid worker for AD-synced users.
Recommended
On, with the mode on Preview first. Move to Apply after a preview on everyone and an Apply on a test scope.
Related settings
- User tagging mode (scheduled runs) UserTagging.Mode
- Also tag a user at once when it changes UserTagging.RunOnDirectoryChange
- Never tag these users UserTagging.ExcludeObjects
Documented for Entra Policy Suite 2.0.107. Written by the Entra Policy Suite team; Invardia publishes it. · All settings · Security review pack