Change Microsoft Entra External ID custom attribute using Microsoft Graph API

Question

We are using Microsoft Entra External ID. I have defined custom user attribute TestAttribute (string) which is collected during the sign up and is also added as a claim into the JWT token. View from Entra admin center -> Enterprise applications -> Single sign-on:

Everything works fine, the token has TestAttr value as expected (collected from sign up).

However, I want to change this value using Graph API. Previously when working with Azure B2C, this code worked fine:

var extensionInstance = new Dictionary<string, object> { { customAttribute, attributeValue } };
var updatedResult = await _graphServiceClient
	.Users[userId]
	.PatchAsync(new User
	{
		AdditionalData = extensionInstance
	});

where customAttribute was indeed extension_extAppId_testattribute. This doesn't work now - it isn't a part of JWT token anymore once I change it's value although I can see the value when using Microsoft Graph:

var user = await _graphServiceClient.Users[userId].GetAsync(config =>
{
	config.QueryParameters.Select = new[] { "extension_extAppId_testattribute" };
});

What bothers me, before changing it via API, this Get request didn't return anything, BUT the collected value was in the token. Logical assumption would be that working with the attributes is different for Entra External ID than for Azure B2C - but I have no idea how to get this to work.

So the question is, how can I change the value of a custom user attribute so that it is still part of the JWT token?

Thanks

Answer 1

Hi @Michal Durista ,

Thanks for reaching out.

Microsoft Entra External ID and Azure AD B2C are two separate platforms powered by ESTS and IEF respectively.

There are different endpoints of Microsoft Graph API allows you to manage resources in your Microsoft Entra ID for customers directory.

However, you can update the extension attribute of External Id of customer in similar way for Entra ID for customers as B2C and Microsoft Entra custom attributes as mentioned below:

I created this custom attribute in my External ID for customer's tenant extension_700295f86fbe4d649b152100a99c7370_TestAttribute and collected data during sign up for user.

using Microsoft.Graph.Models;
var requestBody = new User
{
AdditionalData = new Dictionary<string, object>
{
  {
    "extension_700295f86fbe4d649b152100a99c7370_TestAttribute" , "Test1"
  },
},
};
var result = await graphClient.Users["{user-id}"].PatchAsync(requestBody);

To get the extension attribute of user, you can still use existing user's v1 endpoint with select or directly beta endpoint.

Reference - https://learn.microsoft.com/en-us/graph/extensibility-overview?tabs=csharp#update-or-delete-directory-extensions

Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.

Answer 2

Thank you for your answer, but basically you just did what I did in the question, this still doesn't resolve my problem that the custom attribute stops being part of the JWT token as claim after updating it.

Note: have you tried to get the value of the custom attribute (just as you do in your answer) BUT before actually patching it? So that you have the value that was collected from the sign up?

Answer 3

Michal Durista

Apologies to misunderstood the ask. So, your ask it after updating the custom claim through Graph API, updated value of custom claim is not reflecting in the token. Is my understanding correct?

I repro the scenario again using below steps:

1. Sign up with new user to collect custom claim.
2. Update the custom claim with new value using Graph API.
3. Sign in with same user from step1 to check the updated value. As you can see my initial value collected during signup was "CustomAttribute" which has been updated to "CustomAttributeUpdated" in the token.

Make sure, it took some time to reflect the changes in the token. I waited 15 minutes to sign in again with same user.

Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.