Querying extensionAttributes in Microsoft Graph API - microsoft-graph-api

Question

I have some extensionAttributes (1-4) synced from on-prem to Azure AD using Azure AD Connect, and I want to query these using the Microsoft Graph API, but the data returned is null
As below, the Azure AD Connect tool syncs extensionAttribute1 as extension_guid_extensionAttribute1 etc..
In this example I've changed the GUID randomly
Get-AzureADUser -ObjectId test.user#mydomain.com | Select -ExpandProperty ExtensionProperty
Key Value
--- -----
odata.metadata https://graph.windows.net/ec28dcc...
odata.type Microsoft.DirectoryServices.User
createdDateTime
employeeId
onPremisesDistinguishedName CN=Test User,OU=Users - Active,DC=internal,DC=...
thumbnailPhoto#odata.mediaContentType image/Jpeg
userIdentities []
extension_034abf7ea2ee45317869abe74870bf20_extensionAttribute4 7119
extension_034abf7ea2ee45317869abe74870bf20_extensionAttribute3 0834717194
extension_034abf7ea2ee45317869abe74870bf20_extensionAttribute1 \\fileserver\scan\folder\Test.User
What I can find in the documentation is these attributes should be called onPremisesExtensionAttributes when queried via the API, but they're all null:
{
"#odata.context": "https://graph.microsoft.com/v1.0/$metadata#users(displayName,onPremisesExtensionAttributes)/$entity",
"displayName": "Test User",
"onPremisesExtensionAttributes": {
"extensionAttribute1": null,
"extensionAttribute2": null,
"extensionAttribute3": null,
"extensionAttribute4": null,
"extensionAttribute5": null,
"extensionAttribute6": null,
"extensionAttribute7": null,
"extensionAttribute8": null,
"extensionAttribute9": null,
"extensionAttribute10": null,
"extensionAttribute11": null,
"extensionAttribute12": null,
"extensionAttribute13": null,
"extensionAttribute14": null,
"extensionAttribute15": null
}
}
Likewise, if I query the attribute name directly:
{
"#odata.context": "https://graph.microsoft.com/v1.0/$metadata#users(displayName,extension_034abf7ea2ee45317869abe74870bf20_extensionAttribute1)/$entity",
"displayName": "Test User"
}
I hope to be able to get the values of these extension attributes via the Microsoft Graph API, but they're blank. I know the data is in there because I can see it via the PowerShell get-AzureADUser cmdlet so I must be missing something.
This is all through the Graph Explorer, I haven't written any code yet to try and query this outside of the Graph Explorer.
Any help would be greatly appreciated

Answer 1

In order to see all the attributes for users other than yourself, you must be granted the User.Read.All permission.
In Graph Explorer, click on "modify permissions" underneath the signin button to add permissions (you may need an admin to grant them for you).
Permissions reference: https://learn.microsoft.com/en-us/graph/permissions-reference

Answer 2

I just ran into the same issue when using the MSGraph Powershell SDK
(Get-MgUser -UserId "[UserObjectID]").OnPremisesExtensionAttributes did return empty values
Only when connecting to the beta endpoint it returned values.
Select-MgProfile -Name "beta"
Connect-MgGraph -CertificateThumbprint "[CertThumbPrint]" -ClientId "[ClientIDAppRegistration]" -TenantId "[TenentID]"

Answer 3

Turns out this was only an issue in the graph explorer. Using the API is fine. Spent ages stressing over this, should have just tested it in a real environment!

Answer 4

Thank you Mister Iks! You are right!
(Get-MgUser -UserId "[UserObjectID]").OnPremisesExtensionAttributes did return empty values
After run: Select-MgProfile -Name "beta"
(Get-MgUser -UserId "[UserObjectID]").OnPremisesExtensionAttributes did return the values.