Update-MgUser Unable to Clear onPremisesImmutableId

[jamesshuriff]

Describe the bug
The Update-MgUser cmdlet cannot clear the onPremisesImmutableId property.

To Reproduce
Execute a command such as:
Update-MgUser -UserId [UserId] -OnPremisesImmutableId $null

Expected behavior
The property should clear.

The payload generated by Update-MgUser is:
{"onPremisesImmutableId": ""}
It should be:
{"onPremisesImmutableId":null}

Module Version
2.11.1

Environment Data

Name                           Value
----                           -----
PSVersion                      5.1.20348.2110
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.20348.2110
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

[timayabi2020]

Hi James Shuriff (@jamesshuriff) kindly share the debug information for this request by providing a -Debug parameter at the end of the command.

[jamesshuriff]

DEBUG: [CmdletBeginProcessing]: - Update-MgUser begin processing with parameterSet 'UpdateExpanded'.
DEBUG: [Authentication]: - AuthType: 'Delegated', TokenCredentialType: 'DeviceCode', ContextScope: 'CurrentUser', AppName: 'Microsoft Graph Command Line Tools'.
DEBUG: [Authentication]: - Scopes: [openid, profile, User.Read, User.ReadWrite.All, email].

Confirm
Are you sure you want to perform this action?
Performing the operation "Update-MgUser_UpdateExpanded" on target "Call remote 'PATCH /users/{user-id}' operation".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"):
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
PATCH

Absolute Uri:
https://graph.microsoft.com/v1.0/users/7ad49bfe-d327-4ada-9c2f-fb7ec21b8045

Headers:
FeatureFlag                   : 00000043
Cache-Control                 : no-store, no-cache
User-Agent                    : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.22631; en-US),PowerShell/7.4.1
Accept-Encoding               : gzip
SdkVersion                    : graph-powershell/2.15.0
client-request-id             : 16382a65-e10e-4367-9217-b4e7583308b3

Body:
{
  "onPremisesImmutableId": ""
}


DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
BadRequest

Headers:
Cache-Control                 : no-cache
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : 8ff2d280-34ca-48d8-93c4-6890642759f9
client-request-id             : 16382a65-e10e-4367-9217-b4e7583308b3
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"Canada Central","Slice":"E","Ring":"3","ScaleUnit":"002","RoleInstance":"YT2PEPF000001A4"}}
x-ms-resource-unit            : 1
Date                          : Mon, 08 Apr 2024 12:48:10 GMT

Body:
{
  "error": {
    "code": "Request_BadRequest",
    "message": "Invalid value specified for property 'onPremisesImmutableId' of resource 'User'.",
    "details": [
      {
        "code": "InvalidLength",
        "message": "The onPremisesImmutableId should be between 1 and 256 characters.",
        "target": "onPremisesImmutableId"
      }
    ],
    "innerError": {
      "date": "2024-04-08T12:48:10",
      "request-id": "8ff2d280-34ca-48d8-93c4-6890642759f9",
      "client-request-id": "16382a65-e10e-4367-9217-b4e7583308b3"
    }
  }
}


Update-MgUser_UpdateExpanded: Invalid value specified for property 'onPremisesImmutableId' of resource 'User'.

Status: 400 (BadRequest)
ErrorCode: Request_BadRequest
Date: 2024-04-08T12:48:10

Headers:
Cache-Control                 : no-cache
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : 8ff2d280-34ca-48d8-93c4-6890642759f9
client-request-id             : 16382a65-e10e-4367-9217-b4e7583308b3
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"Canada Central","Slice":"E","Ring":"3","ScaleUnit":"002","RoleInstance":"YT2PEPF000001A4"}}
x-ms-resource-unit            : 1
Date                          : Mon, 08 Apr 2024 12:48:10 GMT

DEBUG: [CmdletEndProcessing]: - Update-MgUser end processing.

[salbeck-sit]

Still not possible in SDK v2.17.0 so it might be something that the API-owner doesn't want or doesn't know how to do ?

Here's a working way to do it:
Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/Users/$($userObj.id)" -Body @{OnPremisesImmutableId = $null} -ErrorAction Stop

[jamesshuriff]

Still not possible in SDK v2.17.0 so it might be something that the API-owner doesn't want or doesn't know how to do ?

Here's a working way to do it: Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/Users/$($userObj.id)" -Body @{OnPremisesImmutableId = $null} -ErrorAction Stop

Or they were not aware of it. Hence, the bug report.

[JeremyTBradshaw]

Still an issue in 2.2.25

Update-MgUser_UpdateExpanded: Invalid value specified for property 'onPremisesImmutableId' of resource 'User'.

Status: 400 (BadRequest)
ErrorCode: Request_BadRequest
Date: 2024-12-19T13:17:45

Headers:
Cache-Control                 : no-cache
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : 7523a03c-8cfb-4fdf-8289-b6938062a402
client-request-id             : 0e8ca5c2-ec44-4119-97f6-4b9503ef1953
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"Canada East","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"QB1PEPF00006A43"}}
x-ms-resource-unit            : 1
Date                          : Thu, 19 Dec 2024 13:17:45 GMT

Feels overdue to be fixed especially when I got the M365 Message Center email this morning about MSOnline and AzureAD modules getting farther along into their deprecation. This is something we've been doing for almost a decade now and only in the newest tool is it broke.

[JeremyTBradshaw]

Still an issue now in February 2025 and seems like nothing has happened since my comment on December 2024. James Shuriff (@jamesshuriff) gave the requested Debug info within 5 days of it being requested back in April 2024. Please make some priority for this. Both MSOL and AzureAD modules could do this without issue. This is the new/current thing and it's way behind.

[jhugery-blade]

Just confirmed as of March 3/7/2025, this issue is still not resolved. Having to revert to using MSOnline to clear the attribute, quite frustrating.

[JeremyTBradshaw]

I have recently been doing this in PowerShell 7:

Import-Module AzureAD -UseWindowsPowerShell
Connect-AzureAD -AccountId <my UPN>
Set-AzureADUser -ObjectId <UPN or ObjectId of target account> -ImmutableId $null

Looks like AzureAD module still has a place in the present day. I hope it doesn't stop working before this issue gets resolved.

If it does, it's not the end of the world to just leave a non-blank ImmutableId, at least in some cases. In the cases where it's the end of the world, I suppose we can at least use Update-MgUser to set it to some false value, for example:

Update-MgUser -UserId NewlyCloudOnlyAccount@tenant123.onmicrosoft.com -OnPremisesImmutableId 'DoNotMatchWithAnyADUsers=='