Unable to retrieve custom attribute via graph API

Question

Unable to retrieve custom attribute via graph API

sam nick 281

Hello,

I am trying to retrieve the custom attributes for a user via graph, but cant seem to find them in the result set. Please can you advise what am i missing and how to get those values. Do i need a different query or "join" to another parameter to get the value. I am a global admin and have the attribute assignment admin.

User's image

Answer 1

Manu Philip 16,571 MVP

You can try the following query to show the custom attributes for the user

https://graph.microsoft.com/v1.0/users/manu@exchangeonline.in?$select=onPremisesExtensionAttributes

$select=displayName,onPremisesExtensionAttributes will show only the display name along with all the custom attributes

--please don't forget to upvote and Accept as answer if the reply is helpful--

sam nick 281 Reputation points

2023-08-25T17:44:41.0566667+00:00
@Manu Philip tried your suggestion, but no luck . As you can see in the original screenshot, the user has 2 custom attributes.

Answer 2

Vasil Michev 79,546 MVP

You have to specifically request the custom attributes themselves, or the set as a whole. For example, this query will include all custom security attributes:

https://graph.microsoft.com/beta/users?$select=id,displayName,customSecurityAttributes

Do make sure that the CustomSecAttributeDefinition.Read.All scope has been consented to, and if you are running this via the Graph explorer tool (or any other method that leverages delegate permissions), that the corresponding user has sufficient permissions to access the CSA set(s) in question.

Additional details and more examples can be found in the official documentation: https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/users-custom-security-attributes?tabs=ms-powershell

sam nick 281 Reputation points

2023-08-25T17:47:32.1+00:00

@Vasil Michev , i tried your solution too but no luck .
Shweta Mathur 19,946 Reputation points Microsoft Employee

2023-08-28T07:30:33.67+00:00

sam nick,

Thanks for reaching out.

I tried to get the custom security attributes using Graph endpoint suggested by
Vasil Michev and able to get the response successfully.

Could you please confirm you are using the correct user id to which custom security attributes are assigned.

Could you also try to update the attribute using patch request to check whether patch request is working for you?

https://learn.microsoft.com/en-us/graph/custom-security-attributes-examples?tabs=http

Thanks,

Shweta
sam nick 281 Reputation points

2023-08-28T19:42:28.5+00:00

@Shwetha I am not sure why is it not working for me. Can you advise what could be wrong. Below are my assigned roles.

The id i am using in the graph explorer is the correct id of the user who has the custom attributes. But it still gives me a NULL. any recommendations on where else i can look.
Vasil Michev 79,546 Reputation points MVP

2023-08-29T11:09:46.8233333+00:00

Did you add the CustomSecAttributeDefinition.Read.All permission to Graph explorer? It will not work without it, as I mentioned in my original reply. Just the user role is not sufficient when you're running in the delegate permissions model.
sam nick 281 Reputation points

2023-08-29T13:58:12.1533333+00:00

@Vasil Michev Yes the permissions have been granted.
Vasil Michev 79,546 Reputation points MVP

2023-08-29T14:50:50.9833333+00:00

Not exactly sure what you are showing here, looks like a custom app. Moreover, those are Application permissions, whereas in your scenario you need Delegate ones, and you need to add them to the Graph explorer service principal, not a custom app.

Open the Graph explorer tool, click your profile photo in the top right corner, select Consent to permissions. Find CustomSecAttributeDefinition.Read.All in the list therein and hit the Consent button, then follow any additional prompts as needed.
sam nick 281 Reputation points

2023-08-30T15:42:44.8966667+00:00
@Vasil Michev truly appreciate the support. I have the consent setup on the graph explorer too.

But the custom attributes still dont show up.
Vasil Michev 79,546 Reputation points MVP

2023-08-30T16:02:54.3866667+00:00

Erm, no idea then. Try with a different user and maybe a new attribute set?
Shweta Mathur 19,946 Reputation points Microsoft Employee

2023-09-05T05:52:34.45+00:00

sam nick •

In case the above does not work for you, please send us an email on azcommunity [at] microsoft [dot] com referencing this issue with a subject line "ATTN:shweta" and we will help you with alternative support options on this.

Unable to retrieve custom attribute via graph API

2 answers

Activity