microsoftgraph / microsoftgraph/msgraph-sdk-powershell
Update-MgUser unable to remove CustomSecurityAttribute value from user
@ramsessanchez is already working on this.
Since Nov 24, 2025.
- Dominant language
- C#
- Stars
- 898
- Forks
- 230
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 31
Description
Describe the bug
I am trying to remove a customSecurityAttribute from a user, by setting an attribute value to null through the CustomSecurityAttributes parameter of Update-MgUser. However, the body is not sent correctly to Graph, causing the null to never be set.
Expected behavior
The customSecurityAttribute is removed from the user through a patch request with a null value.
How to reproduce
Update-MgUser -userid ce3d945f-fc56-4b19-9891-665ca05a998d -CustomSecurityAttributes @{
"IssueTokenCSA" = @{
"@odata.type" = "#microsoft.graph.customSecurityAttributeValue"
"ssn" = $null
}
}
SDK Version
2.32.0
Latest version known to work for scenario above?
No response
Known Workarounds
Forging the request manually works just fine:
Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/users/ce3d945f-fc56-4b19-9891-665ca05a998d" -Body (@{
"customSecurityAttributes" = @{
"IssueTokenCSA" = @{
"@odata.type" = "#microsoft.graph.customSecurityAttributeValue"
"ssn" = $null
}
}
} | ConvertTo-Json -Depth 10) -ContentType "application/json"
Debug output
As you can see, the body is missing the ssn = null part.
Click to expand log
Update-MgUser -userid ce3d945f-fc56-4b19-9891-665ca05a998d -CustomSecurityAttributes @{ "IssueTokenCSA" = @{ "@odata.type" = "#microsoft.graph.customSecurityAttributeValue" "ssn" = $null } } -DebugDEBUG: ============================ HTTP REQUEST ============================
HTTP Method:
PATCH
Absolute Uri:
https://graph.microsoft.com/v1.0/users/ce3d945f-fc56-4b19-9891-665ca05a998d
Headers:
FeatureFlag : 00000003
Cache-Control : no-store, no-cache
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.26200; en-150),PowerShell/7.5.4
SdkVersion : graph-powershell/2.32.0
client-request-id : 88290648-0f15-498c-b257-90c5097cb246
Accept-Encoding : gzip,deflate,br
Body:
{
"customSecurityAttributes": {
"IssueTokenCSA": {
"@odata.type": "#microsoft.graph.customSecurityAttributeValue"
}
}
}
DEBUG: ============================ HTTP RESPONSE ============================
Status Code:
NoContent
Headers:
Cache-Control : no-cache
Strict-Transport-Security : max-age=31536000
request-id : 3ab5e8b8-9202-4f58-be61-c107ef6572f6
client-request-id : 88290648-0f15-498c-b257-90c5097cb246
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Norway East","Slice":"E","Ring":"2","ScaleUnit":"001","RoleInstance":"OSL2EPF00000164"}}
x-ms-resource-unit : 1
Date : Tue, 18 Nov 2025 10:35:04 GMT
Body:
DEBUG: [CmdletEndProcessing]: - Update-MgUser end processing.
Configuration
No response
Other information
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.