Error Updating User Records in Entra via Graph API Due to Immutable ID Set by On-Premises Domain Controller

Question

We have a error while updating user records in entra through graph api where in the users already added were synced through onprem domain controller. These users have immutable id which are preventing the api calls from updating the records. Below is the error reported and screenshot of the immutable ID

--- AzureActiveDirectoryCannotUpdateObjectsOriginatedInExternalService

Answer 1

Hi @Vaibhav Patil

Thank you for reaching Microsoft Q&A Forum!

I understand that you are trying to update the synced user properties via graph API.
If the users are synced from an on-prem AD the error sounds expected by design. users synchronized from on-premises Active Directory (AD), these attributes are controlled by AD and cannot be modified through Graph API.
If you need to update these attributes for synchronized users, you'll have to do so directly in your on-premises AD environment. Once updated, these changes will be synchronized to AAD.
Please refer the below threads which is similar to your issue.
https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/1854
https://learn.microsoft.com/en-us/answers/questions/456452/cant-edit-extension-attributes-with-graph-api
https://learn.microsoft.com/en-us/answers/questions/1643481/when-trying-to-manage-extension-attribute-via-grap

Hope this helps. Do let us know if you any further queries by responding in the comments section.

Thanks,

Akhilesh.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.