Common User Schema Migration Coming in September 2026 
a day ago

Starting in all Cloud Access Service (CAS) deployments in September 2026

 

At a Glance

The following table summarizes the Common User Schema migration, including what is changing, when the migration occurs, how the migration process works, and the actions administrators must take before their scheduled migration date.

What is changingAll RSA Cloud Access Service (CAS) deployments can migrate from using each identity (ID) source’s native user schema to a single Common User Schema used across Policies, Applications, and other CAS features.
When it happensStarting September 2026. Each deployment has a scheduled automatic migration date shown on the CAS Administration Console home page.
How it runs
  • Automatic: Runs on the scheduled date if nothing blocks it, similar to an Identity Router (IDR) update.
  • Manual: Administrators can trigger the migration before the scheduled date.
Action requiredReview the Common User Schema Migration Dashboard and resolve any blocking issues before your scheduled date. See Actions Required Before Migration.

 

 

Schema Migration Dashboard

Use the Common User Schema Migration Dashboard to view your scheduled migration date, review schema mappings, and identify any issues that must be resolved before the migration can proceed. 

Where to find it  Go to the Cloud Administration Console Home > Common User Schema Migration Dashboard
What it shows
  • The scheduled automatic migration date for your deployment.
  • Every CAS feature that uses user attributes in your deployment, the native ID source schema name (pre-migration), and the CAS common schema attribute name (post-migration).
  • If migration of a CAS feature is blocked, a list of required administrator actions to unblock that feature.

  

Actions Required Before Automatic Migration

Before the scheduled migration date, review the Common User Schema Migration Dashboard and address any issues that could prevent automatic migration.

Purpose    Ensure your deployment is ready and resolve any issues that could block automatic migration.
Procedure    

 

  1. In the Cloud Administration Console, navigate to Home > Common User Schema Migration Dashboard. 
  2. Verify that the overall status is Ready for Migration.
  3. For any item marked Action Needed for Migration, follow the listed steps to resolve it.
Need help?
If you cannot resolve an issue, contact RSA Technical Support.



Background: Why This Change

The following table explains why the Common User Schema was introduced and how it simplifies user attribute management across CAS features.

What is a user schema?
CAS pulls user data into Authentication & Access Policies, application configurations, User Self-Service flows, and other features. That data comes from an ID source, described by its user schema, which is the set of user attribute names defined for that ID source type. For example, the username attribute maps to sAMAccountName in Active Directory (AD) and uid in LDAP.
Why was it simpler before?
At launch, CAS used the ID source's native schema as the only way to bring in user data. Only LDAP Directory and Active Directory ID sources were supported, and customers typically used one ID source type per deployment, so it was easy to manage.
Why is this now a challenge?
In 2026, CAS supports six ID source types across four different user schemas. Using native schemas requires administrators to understand the schema of every identity source in their deployment. Only Policies fully support the use of multiple user schemas; configuring other features ranges from difficult to impossible.
The solution 

The 25 most commonly used user attributes in CAS are mapped to a Common User Schema within each identity source configuration. That common schema, not the native one, is then used across Policies, Applications, and other CAS features.

 

 

Common Schema Attribute List Mapped to Native User Schema

The following table shows how Common User Schema attributes map to native user schema attributes for each supported identity source. The following terms are used in the table:

  • NEW: Attribute newly added for this identity source type.
  • N/A: No equivalent attribute exists for this identity source.
  • No default: No native attribute is mapped by default; administrators may configure a mapping.
  • Not passed by AM: The attribute may exist in the Authentication Manager Internal Database but is not passed from Authentication Manager to CAS.

 

Common Schema Display Name

AD On-Prem

LDAP

SCIM Managed

Local (SCIM Provisioning never enabled)

Local (SCIM Provisioning enabled at any time)

Entra ID

AM Internal Database

Username

sAMAccountName

uid

userName

userName

userName

userName

userName

External Unique Identifier

distinguishedName

entryDN

N/A

N/A

N/A

N/A

N/A

Secondary External Unique Identifier

objectGUID

entryUUID

N/A

N/A

N/A

N/A

N/A

Email Address

mail

mail

emails.work.value

mail

emails.work.value

emails.work.value

emails.work.value

First Name

givenName

givenName

name.givenName

givenName

name.givenName

name.givenName

name.givenName

Last Name

sn

sn

name.familyName

sn

name.familyName

name.familyName

name.familyName

User Status

userAccountControl

ds-pwp-account-disabled

active

active

active

active

active

User Account Expiration

accountExpires

ds-pwp-account-expiration-time

N/A

N/A

N/A

N/A

N/A

Manager

manager

manager

extension.manager.value

manager
(appears on the User Management page as Manager’s Email)

extension.manager.value

extension.manager.value

extension.manager.value
(not passed by AM)

Alternate Username

userPrincipalName

(no default)

(no default)

ALTERNATE_USERNAME

(no default)

(no default)

displayName

SMS OTP Phone

mobile

mobile

phoneNumbers.
mobile.value

SMS_PHONE

phoneNumbers.
mobile.value

phoneNumbers.
mobile.value

phoneNumbers.
mobile.value

Voice OTP Phone

telephoneNumber

telephoneNumber

phoneNumbers.
mobile.value

VOICE_PHONE

phoneNumbers.
mobile.value

phoneNumbers.
mobile.value

phoneNumbers.
mobile.value

Groups

memberOf

member

N/A

virtualGroups

N/A

N/A

N/A

Business Category

businessCategory

businessCategory

(no default)

NEW

(no default)

(no default)

N/A

Company or Organization

company

company

enterprise.extension.organization

NEW

enterprise.extension.organization

enterprise.extension.organization

enterprise.extension.organization
(not passed by AM)

Country Code

c

c

addresses.work.country

NEW

addresses.work.country

addresses.work.country

addresses.work.country
(not passed by AM)

Department

department

N/A

enterprise.extension.department

NEW

enterprise.extension.department

enterprise.
extension.department

enterprise.
extension.department
(not passed by AM)

Description

description

description

(no default)

NEW

(no default)

(no default)

N/A

Display Name

displayName

displayName

displayName

NEW

displayName

displayName

displayName

Employee Number

employeeNumber

employeeNumber

enterprise.extension.
employeeNumber

NEW

enterprise.extension.employeeNumber

enterprise.
extension.employeeNumber

enterprise.
extension.employeeNumber
(not passed by AM)

Employee Type

employeeType

employeeType

 userType

NEW

userType

userType

userType
(not passed by AM)

Full Name

cn

cn

name.formatted

NEW

name.formatted

name.formatted

name.formatted

Home Email

otherMailbox

(no default)

emails.home.value

NEW

emails.home.value

emails.home.value

emails.home.value
(not passed by AM)

Mobile

mobile

mobile

phoneNumbers.
mobile.value

NEW

phoneNumbers.mobile.value

phoneNumbers.mobile.value

phoneNumbers.mobile.value

Work Phone

telephoneNumber

telephoneNumber

phoneNumbers.
work.value

NEW

phoneNumbers.work.value

phoneNumbers.work.value

 phoneNumbers.work.value
(not passed by AM)

 

Announcement

Related Articles

Trending Articles

Don't see what you're looking for?