How to use Sync-PnPSharePointUserProfilesFromAzureActiveDirectory with OnPremisesExtensionAttributes

[gabbsmo]

The documentation only mentions Graph extensions. Is there a way to use the built in on premises extensions attributes?

$user = Get-PnPAzureADUser -Identity "nobody@contoso.com" -Select OnPremisesExtensionAttributes
Sync-PnPSharePointUserProfilesFromAzureActiveDirectory -UserProfilePropertyMapping @{ "MyCustomProperty" = "ExtensionAttribute12" } -Folder "Import"

Error: Sync-PnPSharePointUserProfilesFromAzureActiveDirectory: Failed to create sync job. Ensure you're providing users to sync and that the mapping is correct.

Syncing with a standard property, such as DisplayName works fine.

[r998877]

I also want to know. Please can someone make a statement?

[AndersRask]

As answered elsewhere, the extension attributes are only added to your AAD schema when AD Connect is configured.

If you want these attributes populated, set up AD Connect.
There's a ton of posts online if you google how to set this up.
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-sync-feature-directory-extensions

[r998877]

I see filled extension attributes in the AAD portal.

When I try to get the value of extensionAttribute3 via PowerShell ...

$users = Get-PnPAzureADUser -Identity $Config.TestUser -Select "DisplayName","EmployeeID", "MobilePhone", "extension_6cecf999ecb14aa7b3221e3d1c670160_extensionAttribute3"

... it doesn't appear in the output (the ID in the attribute name is correct)

This post here does the same and the extensionAttributes are shown (see first and second screenshot in this post).

The only way I've figured out so far to get the extensionAttributes is to -Select for "OnPremisesExtensionAttributes"

However, Sync-PnPSharePointUserProfilesFromAzureActiveDirectory does not take this into account.

When using the extension attribute in the sync mapping (as it should be)

$SyncMapping = @{"CellPhone"="MobilePhone";"CostCenter"="extension_6cecf999ecb14aa7b3221e3d1c670160_extensionAttribute3"}

and calling

Sync-PnPSharePointUserProfilesFromAzureActiveDirectory -UserProfilePropertyMapping $SyncMapping -Users $users -Folder $Config.SPOJobDocLib

The JSON file is created in the doc lib specified, but it does not contain a value for the extension attribute.

[r998877]

To add: I'm using PnP.PowerShell 2.2.0.

[AndersRask]

So the sync runs without errors? Then the mapping found the attribute, so it is weird that the json does not contain even an empty value.

Out of curiosity, what do you see if you use Get-AzureADUser from the AzureAD module (PoSh 5.1 only!)
$user = Get-AzureADUser -ObjectId $userPrincipalName
$user.ExtensionProperty

Do you see the extension attribute there, and does the field name (guid) match?

I'm no expert on the subject, but I don't think OnPremisesExtensionAttributes and directory extensions (ExtensionProperty) are the same thing.

I just set this up at a customer, and it worked fine with the properties that I verified in $user.ExtensionProperty.extension_11888abdaa4d47e392169cf1eb75ebd2_countryCode
but I don't have access to their tenant anymore, and my own dev tenant does not have extensions, so I can't test it here.

I found this article on the different extension attributes
https://merill.net/2023/02/azure-ad-extensions-and-attributes/

[r998877]

$user = Get-AzureADUser -ObjectId $userPrincipalName
$user.ExtensionProperty

results in

So, it is empty.

Thanks for the link that explains different types of extensions. I'm referring to extensionAttributes 1-15, so I guess selecting for extension_6cecf999ecb14aa7b3221e3d1c670160_whatever only works for custom extensions, not for onPremisesExtensionAttributes)

As a workaround I will use
https://pnp.github.io/powershell/cmdlets/New-PnPUPABulkImportJob.html
and create the json file beforehand on my own with with data from Get-PnPAzureADUser -Identity $Config.TestUser -Select "OnPremisesExtensionAttributes"

[AndersRask]

I havent dug enough into the PnP.Framework code that is used to fetch the user properties to know, if there is a way to get the onpremises extension attributes to work. Alternatively you could probably talk with the AD guys in your company about how the properties are mapped in AD Connect, and if it can be mapped to the custom extension properties.