According to Microsoft Entra documentation, custom security attributes can be assigned to the following identities:

 According to Microsoft Entra documentation, custom security attributes can be assigned to the following identities:

• Users: Custom security attributes can be assigned to user objects to store additional metadata, such as department-specific information or project affiliations.
• Service principals (enterprise applications): Custom security attributes can be assigned to service principals, which represent enterprise applications in Microsoft Entra ID, to manage app-specific metadata.