Any reason why we unable to update the onPremisesExtensionAttributes of some account profiles through Graph API

Question

We have been watching AzureAD throwing an error below when we try to update the onPremisesExtensionAttributes through Microsoft Graph API's or updare-mguser methods through powershell. This is not happening for all accounts onPremisesExtensionAttributes. We would like to know what are the limitations with Graph API's to update onPremisesExtensionAttributes of user's account profile in AzureAD. Please help me out what should we need to follow prerequisites to allow update on these type of profiles through Graph API's. Is there way to find those account profiles (onPremisesExtensionAttributes) which can't update by Graph API?

{"headers":null,"message":{"error":{"code":"Request_BadRequest","message":"Unable to update the specified properties for objects that have originated within an external service.","innerError":{"date":"2023-10-18T14:25:13","request-id":"4be66b56-16f8-43e1-883f-2f25dce78d76","client-request-id":"4be66b56-16f8-43e1-883f-2f25dce78d76"}}},"statusCode":400,"description":null,"status":"Failed"}}

Answer 1

Hello @Suresh Babu Patike

If they were originally the on-prem users, the onPremisesExtensionAttributes attribute authority is Exchange in which case MS Graph wont be able to fetch them.

This seems to be expected behavior. Please check if this scenario is the same for you. https://learn.microsoft.com/en-us/answers/questions/456452/cant-edit-extension-attributes-with-graph-api

Regards

Shaofan

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.