"Unable to update the specified properties for objects that have originated within an external service."

Question

Hello,

Our users are located in Azure AD. Some of the older accounts were synchronized from our old on-prem AD. The sync has since been deactivated and the users have been converted to Cloud-only users.

The past days we've been trying to update the onPremisesExtensionAttributes through the Graph-API. It works very well for users that we created in Azure AD. But recently we found that it doesn't work with the old sync-ed users.

All users are displayed as Cloud-only users. onPremisesSyncEnabled, and onPremisesLastSyncDateTime were cleared and are null except onPremisesImmutableId has a value.

I understand we can update through ExchangeOnlinePowerShell v2 other than GraphAPI but we use Google Suite.

Is there anyway to update the attribute using PowerShell commands?

Any help is appreciated. Thanks in advance.

Answer 1

Hello Chinmayi Bose,

I understand you're trying to update onPremisesExtensionAttributes for users who were previously synced from on-prem AD. Even though sync is off, the update fails because onPremisesImmutableId is still set. This makes the user appear as hybrid, so certain fields stay read-only.

To remove it properly, Microsoft recommends the ADSyncTools PowerShell module. You can use the following commands to install and explore the available options, refer this Microsoft Article:

[Net.ServicePointManager]::SecurityProtocol =[Net.SecurityProtocolType]::Tls12
Install-Module ADSyncTools
Import-Module ADSyncTools
Get-Command *onpremises* -Module ADSyncTools

Connect to Microsoft Graph with the required permissions and view users who still have on-prem attributes, including those who were synced:

Connect-MgGraph -Scopes "User.ReadWrite.All"
Get-ADSyncToolsOnPremisesAttribute -IncludeSyncedUsers

To clear only the onPremisesImmutableId for a specific user:

Clear-ADSyncToolsOnPremisesAttribute -Identity "******@domain.com" -onPremisesImmutableId

To clear all on-prem attributes for the user:

Clear-ADSyncToolsOnPremisesAttribute -Identity "******@domain.com" -All

As an alternative, if the user is no longer syncing, you can use a direct Graph API call:

Connect-MgGraph -Scopes "User.ReadWrite.All"
Invoke-MgGraphRequest -Method PATCH `
  -Uri "https://graph.microsoft.com/v1.0/users/******@domain.com" `
  -Body @{ onPremisesImmutableId = $null }

To find users who still have the onPremisesImmutableId, you can run:

Get-MgUser -All -Select "Id,UserPrincipalName,onPremisesImmutableId" |
Where-Object { $_.onPremisesImmutableId -ne $null } |
Select-Object UserPrincipalName, onPremisesImmutableId

Regarding the error with the AzureAD module, it happens because that module is not supported in PowerShell 7. It was designed for Windows PowerShell 5.1. You can refer to this MS article for more details.

Since you're already using the Microsoft Graph module, you're on the right path and there's no need to switch.

Let me know if you have any further questions. Happy to assist.

Hope this helps!

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful, which may help members with similar questions.

If you have any other questions or are still experiencing issues, feel free to ask in the "comments" section, and I'd be happy to help.