CustomSecurityAttributes null when loaded via /met endpoint

Question

Hi,

We are trying to load the custom security attributes through the /me endpoint:
https://graph.microsoft.com/beta/me?$select=customSecurityAttributes

This is returning the following response:

{
"customSecurityAttributes": null
}

When we are querying on the specific user with his ID, the custom security attributes are correctly returned.

Answer 1

Hello Jonah Jordan,

Thanks for reaching out!

Custom security attributes can be assigned to the following objects by using the customSecurityAttributes property. Directory synced users from an on-premises Active Directory can also be assigned custom security attributes.

• user
• servicePrincipal

To assign, update, or remove custom security attribute assignments, the calling principal must be assigned the following Azure AD role. By default, Global Administrator and other administrator roles do not have permissions to read, define, or assign custom security attributes.

• Attribute Assignment Administrator

Also, the calling principal must be granted the following permissions.

• CustomSecAttributeAssignment.ReadWrite.All
• User.Read.All

Permissions to read, assign, update, or remove custom security attribute assignments for an application is granted by CustomSecAttributeAssignment.ReadWrite.All. Permissions to read the resource object, such as users, is granted separately using resource object permissions, such as User.Read.All.

To list or read custom security attribute assignments, the calling principal must be assigned one of the following Azure AD roles. By default, Global Administrator and other administrator roles do not have permissions to read, define, or assign custom security attributes.

• Attribute Assignment Reader
• Attribute Assignment Administrator

Also, the calling principal must be granted the following permissions.

• CustomSecAttributeAssignment.Read.All
• User.Read.All

Permissions to read custom security attribute assignments for an application is granted by CustomSecAttributeAssignment.Read.All. Permissions to read the resource object, such as users, is granted separately using resource object permissions, such as User.Read.All.

Note: The custom security attributes feature is currently in preview.

If there are no custom security attributes assigned to the user or if the calling principal does not have access, the following will be the response:

HTTP/1.1 200 OK
Content-type: application/json

{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#users(customSecurityAttributes)/$entity",
    "customSecurityAttributes": null
}

References:

• What are custom security attributes?
• Custom Security Attributes - Graph API
• Assign, update, list, or remove custom security attribute assignments using the Microsoft Graph API (preview)

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote. If you have any further questions about this answer, please click Comment.