diff --git a/CHANGELOG.md b/CHANGELOG.md
index 73c2603e7..25081fb87 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@
 * Enhancement: Most list commands have been updated with tabular output
 * Enhancement: `ziti edge show` is now available with subcommands `config-definition` and `config-type-schema`
 * Enhancement: `ziti edge update config-type` is now available
+* Enhancement: `ziti edge create|update identity` now supports `--external-id`
 * Bug fix: Fixes an issue where the router config would use hostname instead of the DNS name
 
 ## External JWT Signer Issuer & Audience Validation
diff --git a/go.mod b/go.mod
index 7c699a6c8..f878590e6 100644
--- a/go.mod
+++ b/go.mod
@@ -37,7 +37,7 @@ require (
 	github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19
 	github.com/michaelquigley/pfxlog v0.6.9
 	github.com/openziti/channel v0.18.28
-	github.com/openziti/edge v0.21.195
+	github.com/openziti/edge v0.21.196
 	github.com/openziti/fabric v0.17.105
 	github.com/openziti/foundation v0.17.22
 	github.com/openziti/sdk-golang v0.16.52
diff --git a/go.sum b/go.sum
index 4a0aa333f..c840d9bbc 100644
--- a/go.sum
+++ b/go.sum
@@ -819,8 +819,8 @@ github.com/openziti/channel v0.18.28 h1:LTsp+ywYp9uIr0OIPzeUBYoAIKA70CU0QsJqXa+Y
 github.com/openziti/channel v0.18.28/go.mod h1:YDGdH2I8tJ76WQgHTprgHX6dV9MBlrc1nOYpMY8h8+A=
 github.com/openziti/dilithium v0.3.3 h1:PLgQ6PMNLSTzCFbX/h98cmudgz/cU6TmjdSv5NAPD8k=
 github.com/openziti/dilithium v0.3.3/go.mod h1:vsCjI2AU/hon9e+dLhUFbCNGesJDj2ASgkySOcpmvjo=
-github.com/openziti/edge v0.21.195 h1:HDAd/WYW8oz/lTbOdY+Do2tObQYSO/1hcH3xAGo/vTw=
-github.com/openziti/edge v0.21.195/go.mod h1:+lFaGB00kayZir8egSqJRJMB4Cp6174twkM3lx4X7ZA=
+github.com/openziti/edge v0.21.196 h1:xTYkL2eiWB2QTtNJclKgIU7lu4M3Syz9XdM/bMj784s=
+github.com/openziti/edge v0.21.196/go.mod h1:+lFaGB00kayZir8egSqJRJMB4Cp6174twkM3lx4X7ZA=
 github.com/openziti/fabric v0.17.105 h1:8gjvAHBDZuLLtaqkSux4rEvKPrifZSwj2Y7ILsgKYG0=
 github.com/openziti/fabric v0.17.105/go.mod h1:aWW8KTuitUrwpRo2d2IAXVip2L1+kgIbGjdT2sdTPtI=
 github.com/openziti/foundation v0.17.22 h1:zFfgNHdLocEcoBqtognpJnYsVQaTm28EwqMNjBw8avk=
diff --git a/ziti/cmd/ziti/cmd/edge/create_identity.go b/ziti/cmd/ziti/cmd/edge/create_identity.go
index f0787538e..360eea384 100644
--- a/ziti/cmd/ziti/cmd/edge/create_identity.go
+++ b/ziti/cmd/ziti/cmd/edge/create_identity.go
@@ -44,6 +44,7 @@ type createIdentityOptions struct {
 	servicePrecedences       map[string]string
 	tags                     map[string]string
 	appData                  map[string]string
+	externalId               string
 }
 
 // newCreateIdentityCmd creates the 'edge controller create identity' command
@@ -88,6 +89,7 @@ func newCreateIdentityOfTypeCmd(idType string, options *createIdentityOptions) *
 	cmd.Flags().SetInterspersed(true)
 	cmd.Flags().BoolVarP(&options.isAdmin, "admin", "A", false, "Give the new identity admin privileges")
 	cmd.Flags().StringVar(&options.username, "updb", "", "username to give the identity, will create a UPDB enrollment")
+	cmd.Flags().StringVar(&options.externalId, "external-id", "", "an external id to give to the identity")
 	cmd.Flags().StringSliceVarP(&options.roleAttributes, "role-attributes", "a", nil, "Role attributes of the new identity")
 	cmd.Flags().StringVarP(&options.jwtOutputFile, "jwt-output-file", "o", "", "File to which to output the JWT used for enrolling the identity")
 	cmd.Flags().StringVarP(&options.defaultHostingPrecedence, "default-hosting-precedence", "p", "", "Default precedence to use when hosting services using this identity [default,required,failed]")
@@ -118,6 +120,10 @@ func runCreateIdentity(idType string, o *createIdentityOptions) error {
 	api.SetJSONValue(entityData, o.tags, "tags")
 	api.SetJSONValue(entityData, o.appData, "appData")
 
+	if o.externalId != "" {
+		api.SetJSONValue(entityData, o.externalId, "externalId")
+	}
+
 	if o.defaultHostingPrecedence != "" {
 		prec, err := normalizeAndValidatePrecedence(o.defaultHostingPrecedence)
 		if err != nil {
diff --git a/ziti/cmd/ziti/cmd/edge/update_identity.go b/ziti/cmd/ziti/cmd/edge/update_identity.go
index 5e3924c36..5e20f7080 100644
--- a/ziti/cmd/ziti/cmd/edge/update_identity.go
+++ b/ziti/cmd/ziti/cmd/edge/update_identity.go
@@ -42,6 +42,7 @@ type updateIdentityOptions struct {
 	servicePrecedences       map[string]string
 	tags                     map[string]string
 	appData                  map[string]string
+	externalId               string
 }
 
 func newUpdateIdentityCmd(out io.Writer, errOut io.Writer) *cobra.Command {
@@ -69,6 +70,7 @@ func newUpdateIdentityCmd(out io.Writer, errOut io.Writer) *cobra.Command {
 	// allow interspersing positional args and flags
 	cmd.Flags().SetInterspersed(true)
 	cmd.Flags().StringVarP(&options.name, "name", "n", "", "Set the name of the identity")
+	cmd.Flags().StringVar(&options.externalId, "external-id", "", "an external id to give to the identity")
 	cmd.Flags().StringSliceVarP(&options.roleAttributes, "role-attributes", "a", nil,
 		"Set role attributes of the identity. Use --role-attributes '' to set an empty list")
 	cmd.Flags().StringVarP(&options.defaultHostingPrecedence, "default-hosting-precedence", "p", "", "Default precedence to use when hosting services using this identity [default,required,failed]")
@@ -95,6 +97,11 @@ func runUpdateIdentity(o *updateIdentityOptions) error {
 		change = true
 	}
 
+	if o.Cmd.Flags().Changed("external-id") {
+		api.SetJSONValue(entityData, o.externalId, "externalId")
+		change = true
+	}
+
 	if o.Cmd.Flags().Changed("role-attributes") {
 		api.SetJSONValue(entityData, o.roleAttributes, "roleAttributes")
 		change = true