How to set user's onpremisesimmutableid field to null?

Question

I have tried the following commands to set OnPremisesImmutableId to null.

Update-MgUser -UserId $user.id -OnPremisesImmutableId $null
Update-MgUser -UserId $user.id -OnPremisesImmutableId "$null"
Update-MgUser -UserId $user.id -OnPremisesImmutableId ""

But I'm getting the error:Update-MgUser_UpdateExpanded: Invalid value specified for property 'onPremisesImmutableId' of resource 'User'

How do I set it to null? Does the SDK support setting an attribute to null? If not, what are the workarounds?

Answer 1

Hello @DavidWang-5785 !

Welcome to Microsoft QnA!

This property is used to associate an on-premises Active Directory user account to their Azure AD user object. This property must be specified when creating a new user account in the Graph if you are using a federated domain for the user's userPrincipalName (UPN) property. NOTE: The $ and _ characters cannot be used when specifying this property. Returned only on $select. Supports $filter (eq, ne, NOT, ge, le, in)..

As we can read from :

https://stackoverflow.com/questions/42805114/how-to-set-immutable-id-of-an-msoluser-to-null-value-using-powershell#:~:text=Set%20immutableid%20to%20null%3A%20Set-MsolUser%20-UserPrincipalName%20gw17edwardlt501edwar%40%3Cmanaged%20domain%3E,immutable%20id%3A%20set-msolUser%20-userprincipalname%20gw17edwardlt501edwar%40%3Cmanaged%20domain%3E%20-immutableID%20f33fc1d2-73bd-4957-995f-37c83d349ef3

we cannot clear immutable Id from a federated O365 account, instead we need to do the following:

Move the federated domain onto a managed domain:

Set-MsolUserPrincipalName -UserPrincipalName ******@KT2.kb.co.in  -NewUserPrincipalName edwardlt501edwar@<managed domain, usually something.onmicrosoft.com>

Set immutableid to null:

Set-MsolUser -UserPrincipalName gw17edwardlt501edwar@<managed domain> -ImmutableId "$null"

Then wait for some time and assign a new immutable id:

set-msolUser -userprincipalname gw17edwardlt501edwar@<managed domain> -immutableID f33fc1d2-73bd-4957-995f-37c83d349ef3

Move back to federated domain:

Set-MsolUserPrincipalName -NewUserPrincipalName ******@KT2.kb.co.in-UserPrincipalName edwardlt501edwar@<managed domain>

1. See the new immutable ID:

Get-MsolUser -UserPrincipalName ******@KT2.kb.co.in | select ImmutableId

I hope this helps!

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards

Answer 2

The SDK you are using does not support nulling values, but you can do so using MS Graph Powershell SDK Invoke-MgGraphRequest. There is work on that.

See https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/852

Connect-MgGraph -Scopes 'User.ReadWrite.All'

Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/Users/{UserId}" -Body @{OnPremisesImmutableId = "some-immutable-id"}

Answer 3

I see that there is a ticket open to make nulling an attribute work in Microsoft Graph Powershell: https://github.com/Azure/autorest.powershell/issues/961

Can you confirm that nulling an attribute is not yet supported by Microsoft Graph Powershell, and that the only work-around is to use the Invoke-MgGraphRequest command?

Answer 4

Hello @DavidWang-5785 !

Please try with :

Connect-MgGraph -Scopes User.ReadWrite.All

To update the User Principal Name:

Connect-MgGraph -Scopes User.ReadWrite.All Update-MgUser -UserId ******@KT2.kb.co.in -UserPrincipalName edwardlt501edwar@<managed domain, usually something.onmicrosoft.com>

To remove the ImmutableId:

Connect-MgGraph -Scopes User.ReadWrite.All Update-MgUser -UserId gw17edwardlt501edwar@<managed domain> -OnPremisesImmutableId $null

To set the ImmutableId:

Connect-MgGraph -Scopes User.ReadWrite.All Update-MgUser -UserId gw17edwardlt501edwar@<managed domain> -OnPremisesImmutableId f33fc1d2-73bd-4957-995f-37c83d349ef3

To update the User Principal Name back:

Connect-MgGraph -Scopes User.ReadWrite.All Update-MgUser -UserId edwardlt501edwar@<managed domain> -UserPrincipalName ******@KT2.kb.co.in

To get the ImmutableId:

Connect-MgGraph -Scopes User.Read.All

(Get-MgUser -UserId ******@KT2.kb.co.in).OnPremisesImmutableId

Let me know if it helped !

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards