Why is it not possible to update extension attributes of former hybrid users via Graph API?

Question

We want to update extension attributes (extensionAttribute1 … extensionAttribute15) via Graph API but on a specific set of users we get the following error message:

In our tenant are two different types of users:

• Native cloud users
• Former hybrid users that were fully migrated to cloud users (approved by Microsoft support)

The latter look like this in Entra ID and their extension attributes can not be updated via Graph API:

According to Graph API documentation: "If a cloud-only user was previously synced from on-premises Active Directory, these properties can't be managed via the Microsoft Graph API. Instead, they can be managed through the Exchange Admin Center or the Exchange Online V2 module in PowerShell."
https://learn.microsoft.com/en-us/graph/api/resources/onpremisesextensionattributes?view=graph-rest-1.0

So there is a workaround but you have to use another module (Exchange Online V2) and manually check each user before updating if they are native cloud users or former hybrid users.

Why does this limitation exist for fully migrated cloud users? Should these users not act like native cloud users? Is it possible to remove this limitation so we can handle all cloud users (native and migrated) identically?

Thank you very much in advance for an answer.

Kind regards

Answer 1

"Because Microsoft hasn't put the work into enabling this scenario" is the best answer I can give you. The are several hybrid/source of authority scenarios they need to address, but progress on that front is being made very slowly (it is a complex task).

In addition, said attributes have traditionally been part of the Exchange schema, thus are not "native" to Entra/Graph API. So for the time being, you need to use ExO PowerShell to manage them.