> ## Documentation Index
> Fetch the complete documentation index at: https://domoinc-openapi-sync-dataflows.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Attributes

export const InlineImage = ({src, alt = '', height = '1.6em'}) => {
  return <img noZoom src={src} alt={alt} style={{
    display: 'inline',
    verticalAlign: 'start',
    height: height,
    margin: '0'
  }} />;
};

### Intro

You can use attributes to drive dynamic groups and dynamic personalized data permissions (PDP). This can significantly reduce the overhead of managing group and data access. Depending on your needs, attributes can be managed by your identity provider (IdP), your Domo admins, or your users.

These are examples of two of the most common problems that attributes can solve:

#### Department-Based Access

The Sales and Marketing departments should have access to customer performance dashboards. However, team members in these departments change frequently, and managing group membership manually is a challenge.

**Solution**

Use dynamic groups to automatically populate group membership based on the department attribute in a user profile.

#### Org Structure-Based Access

BI department team members should have access to instance monitoring dashboards. The department attribute is not properly maintained in our IdP, but only BI team members contribute to the BI team cost center. This assignment is tracked in the user's profile as a list of "Contributing Cost Centers".

**Solution**

Use dynamic groups to populate group membership based on whether this attribute contains the BI team cost center.

***

* [Required grant](#required_grant)
* [Access Attributes settings](#access_attributes_settings)
* [Attribute management](#attribute_management)

  * [Managed attributes](#managed_attributes)
  * [Create a custom attribute](#create_a_custom_attribute)
  * [Edit](#edit_attribute_values) [attribute values](#edit_attribute_values)
* [FAQ](#faq)

***

### Required Grant

To manage attributes, you must have the Manage All Company Settings grant enabled for your role. Admins have this grant enabled by default.

### Access Attributes Settings

Access the Attributes settings from the navigation header by selecting **More** > **Admin**. In the **Governance** menu, select **Attributes**. The **Attribute management** page displays.

<Frame>
  <img alt="Screenshot 2023-09-15 at 9.57.52 AM.png" src="https://mintcdn.com/domoinc-openapi-sync-dataflows/_Ljp6rbTQtrUUZqN/images/kb/image%20copy%2016.png?fit=max&auto=format&n=_Ljp6rbTQtrUUZqN&q=85&s=6ea7848a2e3dcae226d5714351684563" style={{width: 788.999, height: 355.994}} width="2308" height="1040" data-path="images/kb/image copy 16.png" />
</Frame>

### Attribute Management

The **Attribute management** page contains a list of all the attributes in your instance.

The list of attributes contains the following columns:

<table border="1" cellpadding="1" cellspacing="1" data-aura-rendered-by="33:202;a"><thead><tr><th colspan="1" rowspan="1"><p> Column </p></th><th colspan="1" rowspan="1"><p> Description </p></th></tr></thead><tbody><tr><td colspan="1" rowspan="1"><p> Name </p></td><td colspan="1" rowspan="1"><p> The name of the attribute. <a id="visibility" target="_blank" /></p></td></tr><tr><td colspan="1" rowspan="1"><p> Key </p></td><td colspan="1" rowspan="1"><p> The key is used to look up and map values. </p></td></tr><tr><td colspan="1" rowspan="1"><p> Visibility </p></td><td colspan="1" rowspan="1"><p> This column indicates the attribute's visibility. </p><p> Limited visibility indicates that the attribute's values are only visible to individuals with any of the following grants: </p><ul><li> (Admin-only) Manage All Users </li><li> (Admin-only) Manage All Groups </li><li> Edit Groups </li></ul><div class="mdx-embed"><Note><b> Note: </b> If a limited-visibility attribute <em> isn't </em> managed, non-grant holders can see that the attribute exists and can see their own attribute value, but not the values for other people. <br /><br /> If a limited-visibility attribute <em> is </em> managed, non-grant holders can't see that the attribute exists. <br /><br /> If visibility is not limited, both the attribute and its values are visible to everyone. </Note></div><p /><div class="mdx-embed"><Tip><b> Note: </b> Limited-visibility attributes should be considered a user experience feature—hiding attributes that aren't helpful to most users—rather than a security measure. <br /><br /> For example, attributes can populate group membership, identifying users with a given attribute value. <br /><br /> Limited-visibility attributes and their values may be visible in DomoStats or by other means. </Tip></div></td></tr><tr><td colspan="1" rowspan="1"><p> Managed </p></td><td colspan="1" rowspan="1"><p> This column indicates whether the attribute can only be managed by trusted sources. </p><p> Managed attributes are not editable by individual users. These attributes can drive dynamic group membership and dynamic PDP policies. </p></td></tr><tr><td colspan="1" rowspan="1"><p> Data type </p></td><td colspan="1" rowspan="1"><p> This column indicates how incoming metadata for the attribute is typed and validated. </p><p> For system attributes, Domo defines the data type. For user-defined attributes, data types are inferred from the values received/entered. Data types follow the Java definition for that type. Attributes can be multi-valued (list/array). </p></td></tr><tr><td colspan="1" rowspan="1"><p> PDP policies </p></td><td colspan="1" rowspan="1"><p> This column indicates the number of PDP policies that use this attribute. Select the number to view a list of the policies. </p></td></tr><tr><td colspan="1" rowspan="1"><p> Groups </p></td><td colspan="1" rowspan="1"><p> This column indicates the dynamic groups that use this attribute. </p></td></tr><tr><td colspan="1" rowspan="1"><p> System </p></td><td colspan="1" rowspan="1"><p> This column indicates whether this attribute is a default system attribute that cannot be removed. Certain properties of system attributes are editable. <a id="managed_attributes" target="_blank" /></p></td></tr><tr><td colspan="1" rowspan="1"><p> Actions </p></td><td colspan="1" rowspan="1"><p> If applicable, you can make changes to the attribute by selecting <InlineImage src="/images/kb/ka0Vq000000GoLp-00N5w00000Ri7BU-0EM5w000006vsvl.jpg" /><b> Edit </b> in this column or remove the attribute. System attributes cannot be removed. </p></td></tr></tbody></table>

# Managed Attributes

There are two kinds of managed attributes: system and custom. These are described below. You can use both types of attributes to populate dynamic groups based on values in a user's profile. or create dynamic PDP policies. Learn about [Personalized Data Permissions (PDP)](/s/article/360042934614) and see [Create and Manage User Groups](/s/article/360042934294) for more information.

#### System Attributes

System attributes are default and come pre-loaded in the platform. You cannot remove them, but some of their properties are editable, if there are no dynamic groups or PDP policies associated with them.

#### Custom Attributes

Custom attributes are created by users and can be configured to be managed, sourced from your IdP, only visible to admins, or to other specifications. You can edit and remove custom attributes, as long as there are no dynamic groups or PDP policies associated with them.

# Create a Custom Attribute

Follow these steps to create a custom attribute:

1. In the Domo navigation header, select **More** > **Admin**.

   The Admin Settings display.

2. In the **Governance** menu, select **Attributes**.

   The **Attributes** section displays.

3. Select **+** **New Attribute**.

   <Frame>
     <img alt="new attribute.jpg" src="https://mintcdn.com/domoinc-openapi-sync-dataflows/_Ljp6rbTQtrUUZqN/images/kb/image%20copy%2017.png?fit=max&auto=format&n=_Ljp6rbTQtrUUZqN&q=85&s=b929405d1adfc7f64bdb15f69a53627f" style={{width: 709.986, height: 321.996}} width="2714" height="1230" data-path="images/kb/image copy 17.png" />
   </Frame>

   The **Create new attribute** modal displays.

   <Frame>
     <img alt="Screenshot 2023-03-27 at 5.48.53 PM.png" src="https://mintcdn.com/domoinc-openapi-sync-dataflows/_Ljp6rbTQtrUUZqN/images/kb/image%20copy%2018.png?fit=max&auto=format&n=_Ljp6rbTQtrUUZqN&q=85&s=b6e2fedf1629634cb76cb2442e85d56c" style={{width: 466.996, height: 432.997}} width="1164" height="1080" data-path="images/kb/image copy 18.png" />
   </Frame>

4. In the modal, provide the following information.
   * **Name —** A descriptive name shown within Domo. This does not need to be unique, although we recommend unique names to avoid confusion.

   * **(Optional) Description —** Details to help users understand what this attribute represents.

   * **Data type —** There are several different data types available, as shown in this image. List-type attributes support multiple entries.

     <Frame>
       <img alt="Screenshot 2023-09-22 at 10.56.53 AM.png" src="https://mintcdn.com/domoinc-openapi-sync-dataflows/2k2HWlcjOFv0edU2/images/kb/ka0Vq0000000cOf-00N5w00000Ri7BU-0EM5w000006w0Ep.jpg?fit=max&auto=format&n=2k2HWlcjOFv0edU2&q=85&s=d1e30e59ff3af956d126da28c8e47fb7" style={{width: 276.996, height: 389.993}} width="732" height="1030" data-path="images/kb/ka0Vq0000000cOf-00N5w00000Ri7BU-0EM5w000006w0Ep.jpg" />
     </Frame>

   * **Key —** A unique, case-sensitive name for the attribute. If the attribute is sourced from your IdP, this must exactly match the name used in your IdP configuration. After it is set, this value cannot be changed.

   * **Visibility —** See information about [visibility](#visibility) above.

   * **Value Source —** Indicates allowable sources of values for this attribute:

     * **IdP —** If enabled, values are sourced from your IdP each time a user signs in

       to Domo. Note that this also requires your SSO configuration to allow attribute population via the Enable custom attribute ingestion option.

       See our [SSO implementation documents](https://domo-support.domo.com/s/topic/0TO5w000000ZanoGAC/implementing-sso) for more information.
     * **Grant: Edit Users —** If enabled, users with the Edit Users grant can edit values for this attribute. If the **IdP** source is also enabled and your IdP contains values for this attribute, those values overwrite any user-entered values the next time the user signs in.
     * **Managed —** If enabled, this attribute is managed and users cannot edit their own values. This allows the use of the attribute in security policies.

5. Select **Save**.

Now that you have created a custom attribute, see [Create and Manage User Groups](/s/article/360042934294) or [Personalized Data Permissions (PDP)](/s/article/360042934614) to learn how to use the custom attribute in groups or PDP policies.

# Edit Attribute Values

You can edit attribute values in the **People** section of the Governance settings. You can only edit unmanaged attributes with the **Grant: Edit Users** value source from this page.

<Note>
  **Note:** If the attribute is also sourced from your IdP, any manually changed values reset to the IdP-sourced value the next time the user signs in.
</Note>

### FAQ

<AccordionGroup>
  <Accordion title="Can I use custom attributes in dynamic groups and dynamic PDP?">
    Custom (non-system) attributes can be used in both dynamic groups and dynamic PDP policies as long as they're managed. See the details above for how to configure an attribute as [managed](#manage_attributes). Learn about [Personalized Data Permissions (PDP)](/s/article/360042934614).
  </Accordion>

  <Accordion title="Can I export my attribute configuration?">
    Not at this time.
  </Accordion>

  <Accordion title="I'm renaming an attribute key in my IdP. How do I change the key in Domo?">
    Attribute keys cannot be changed. Instead, create a new attribute.
  </Accordion>

  <Accordion title="Why can't I edit an attribute?">
    Attributes are only editable when they are not being used to drive group membership and PDP rules. See [Attribute Management](#attribute_management) above for more information.
  </Accordion>

  <Accordion title="How do I edit attribute values in bulk?">
    Bulk user import does not currently support editing custom attribute values, but we are exploring options to allow that.
  </Accordion>
</AccordionGroup>