Working with Azure AD Extension Attributes with Azure AD PowerShell v2

In a recent blog post,, I wrote about how to use extension attributes in local Active Directory and Azure AD, for the purpose of using these extension attributes for determine membership i Azure AD Dynamic Groups.

In the process of investigating my Azure AD users (synchronized and cloud based),  I wanted to see how I could use Azure AD v2 PowerShell CmdLets for querying and updating these extension attributes. This blog post is a summary of tips and commands, and also some curious things I found. There is a link to a Gist with all the PowerShell Commands at the end of the blog post if you prefer to skip to that.

Lets start by looking into one user:


For my example user I have the following output:


In the above linked blog post, I wrote about using the msDS_cloudExtensionAttribute1 and 2 for assigning licenses, so I see those values and more.

I can also serialize the user object to JSON by using $aadUser.ToJson(), which also will show me the value of the extension attributes:


I can look into and explore the user object with Get-Member:


From there I can see that that the Extension Property, which is of type System.Collections.Generic.Dictionary supports Get and Set. So lets look into how to update those extension attributes. This obviously only work on cloud homed users, as synchronized users must be updated in local Active Directory. This series of commands shows how to add extension attributes for cloud users:


The next thing I thought about, was how can I make a list of all users with their extension attributes? I ended up with the following, where you either can get all users or make a filtered collection, and from there loop through and read any extension attributes:


When I look into my extended users list object, I can list the users and values with extension values:



So to some curios things I found. As explained in the blog post, if you are running a Hybrid Exchange organization you would probably use extensionAttribute1..15 instead of the msDS_cloudExtensionAttribute. In another Azure AD tenant I tested on that, but using the commands above I never could list out the extensionAttribute1..15 on my users. I never found a way to validate and check those values, but if I created a Dynamic Group using for example extensionAttribute1 or 2, members would be populated! So it was obvious that the value was there, I just can’t find a way to check it.

I even tested on Graph API, but did not find any extensionAttribute there either, only msDS_cloudExtensionAttribute. For example by querying:<userid or upn>?$select=extension_66868723f2984d3e8c18f0ebd134240f_msDS_cloudExtensionAttribute2


I can see my extension value.

However, if I try:<userid or upn>?$select=extensionAttribute2, I cannot see the value even I know it’s there.


Strange thing, hopefully I will find out some more on this, and please comment if you have any ideas. I will also ask this from the Azure AD team.

Here is the gist with all the commands:

# Azure AD v2 PowerShell Module CmdLets for working with Extension Attribute Properties
# Connect to Azure AD with Global Administrator
# Get a User and Read Extension Properties
$aadUser = Get-AzureADUser ObjectId <youruser>
$aadUser | Select ExpandProperty ExtensionProperty
# Serialize User Object to JSON
# Explore Object Properties
$aadUser | Get-Member
# How to: Add Extension Properties
# PS! Can only write to Cloud homed users
$aadUser = Get-AzureADUser ObjectId <yourclouduser>
$extensionProp = New-Object "System.Collections.Generic.Dictionary2[System.String,System.String]"
Set-AzureADUser ObjectId $aadUser.ObjectId ExtensionProperty $extensionProp
# Check added Extension Properties
Get-AzureADUser ObjectId <yourclouduser> | Select ExpandProperty ExtensionProperty
#region List all users with Extension Properties
$aadUsers = Get-AzureADUser | Select DisplayName, ObjectId
$aadUsersExt = @()
ForEach ($aadUser in $aadUsers) {
$user = Get-AzureADUser ObjectId $aadUser.ObjectId | Select ObjectId, DisplayName
$userDetail = Get-AzureADUser ObjectId $aadUser.ObjectId | Select ExpandProperty ExtensionProperty
        foreach ($key in $userDetail.Keys)
            if($key -like "extension_<YourTenantSchemaExtensionAppId>_msDS_cloudExtensionAttribute1")
                $ext1 = $userDetail."$key"
            elseif($key -like "extension_<YourTenantSchemaExtensionAppId>_msDS_cloudExtensionAttribute2")
                $ext2 = $userDetail."$key"
else { $ext1 = ""; $ext2 = "" }
$obj = [pscustomobject]@{"DisplayName"=$user.DisplayName; "ObjectId"=$user.ObjectId; "Ext1"=$ext1; "Ext2"=$ext2}
$aadUsersExt += $obj
# List only users with values for extension attributes
$aadUsersExt | Where {$_.Ext1 -or $_.Ext2} | FT
# List all users
# Serialize users and extension attributes to JSON
$aadUsersExt | ConvertTo-Json

8 thoughts on “Working with Azure AD Extension Attributes with Azure AD PowerShell v2

  1. Pingback: AzureAD PowerShell module | Jacques DALBERA's IT world

      1. Adam Johnson

        I think the question was about the ipPhone attribute, often used for VoIP phone extensions, not iPhones…

  2. Kev

    Very good article ! I was trying to find a way of filtering a Dynamic Group based on msExchRecipientTypeDetails and tried user.extension_[GUID]__[Attribute] with the ID of MS Exchange Online but it gives me an error … Did you find more about that ? Thanks !

  3. Pingback: Access Extended Attributes from Azure AD in MS Flow - Cloud Decoded

  4. Bart

    I’m not sure if things changed, but I get the extension attributes and their values using $aaduser.ToJson()
    contains extension attribute 1 as follows:
    “extension_c1fc7c1090b04b55a0729dde2c757c5a_extensionAttribute1”: “2000004037”

    1. Sean Knox

      @Bart, are you able to filter by extension attribute? I think that’s what the author is trying to show that you can get an extension attribute for a single user, but if you wanted lets say filter all users by the userIdentities/issuer you wouldnt would be able to. You would have to do as he did which is grab all users with their properties then filter afterwards.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s