Recently in our tenant appeared a new employeeId attribute to the user entity.
We have over 40k user accounts; some of them created as pure Azure AD Users and others as Mail Users (via Exchange Online).
For many accounts, attempting to POST to the employeeId fails with the following error:
Unable to update the specified properties for objects that have originated within an external service.
We have tried with Microsoft Graph (/Beta), Azure Graph API (v1.6) and via the AAD v2 PowerShell module.
Is this user being synchronized from on-premises (using AD Connect)? If so then most of the properties for the user are mastered in on-premises AD and cannot be changed/updated in the cloud. You need to update this property in the on-premises AD (and it'll sync).
UPDATE: Sorry for the late response. The issue was that for cloud-only users that were created through Exchange (like Exchange PowerShell) meant that these users are "marked" as created by Exchange. For some properties, like employeeId, this can mean that that particular property can only be updated by the creating service (Exchange). This makes sense for things like email addresses and proxyaddresses that Exchange provides and is the owner for - but doesn't make sense for employeeId.
I believe this issue is now fixed and it has been rolled out to Production. I have been able to do a rudimentary validation for this by:
- Creating a cloud-user using Exchange PowerShell, and
- Updating the newly created cloud-user's
employeeId, using a PATCH operation in Microsoft Graph preview /beta endpoint. This step is now successful (rather than throwing an error)
Please let us know if this is now fixed for your scenarios.
Hope this helps,
