Remove extension properties from sync

Tomass Pētersons 336

Hi,

For testing I added some directory extensions to sync with Azure AD:
alt text

After that I started to receive error messages:

Unable to update this object in Azure Active Directory, because the attribute  
[extension_2241f0b77381486bb25ee28906a52afd_thumbnailPhoto], in the local Directory  
exceeds the maximum allowed length. If you want to update, reduce the length in the  
local directory services, and then try again

I removed those directory extensions from sync. But I still receive error messages. Powershell returns this:
alt text

How I can remove those extension properties from sync?

Marcus Rath 1 Reputation point

2021-06-29T14:48:03.77+00:00

Hi,

I think meanwhile the issue is solved but for others with the same problem the solution is described in the following article from microsoft.

The way to only deselect the extension attribute in the Azure AD Connect wizard only works if it was never synchronized to Azure AD, otherwise you need to create custom rule to set the value on empty.

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-change-the-configuration#do-not-flow-an-attribute

There are two ways to not flow an attribute. The first is by using the installation wizard to remove selected attributes. This option works if you have never synchronized the attribute before. However, if you have started to synchronize this attribute and later remove it with this feature, the sync engine stops managing the attribute and the existing values are left in Azure AD.

Best regards,
Marcus

https://blog.matrixpost.net
Broonster 46 Reputation points

2023-08-10T21:35:47.2333333+00:00

I realize this is an old thread but could you first clear all the values from on-prem AD for the synced extension attribute so that the metaverse no longer has any values either and then use the AAD connect wizard to remove the extension attribute?

4 answers

AmanpreetSingh-MSFT 56,306 Reputation points

2020-01-21T03:45:29.957+00:00

@Tomass Pētersons Did you run full sync after you removed these extension attributes? Removing extension attributes from sync scope requires a full sync.

-----------------------------------------------------------------------------------------------------------

Please "Accept as answer" wherever the information provided helps you to help others in the community.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment
bwd 1 Reputation point

2020-01-28T16:05:36.773+00:00

Same thing is happening to me, and I performed a full sync after removing the attribute extension. I don't know why it is trying to sync an attribute that does not exist.
Please sign in to rate this answer.
Shadab Basha 261 Reputation points

2021-07-05T15:03:33.613+00:00

@AmanpreetSingh-MSFT -

Hello Aman,

Please advise.

Tested it just now, Enabling Directory Extension adds the sync rule and attributes.

Deselecting the attribute from Directory Extensions removes the rule and Metaverse Attribute for the Extension , however doesnt trigger deletion for the attribute and value connected to objects( Example : user objects).

Also just removing the value using the options mentioned in the article below, doest fix the issue as the main goal is to remove the extension attribute along with the value from each effected object.

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-change-the-configuration#do-not-flow-an-attribute

Suggestion: Similar to how we are adding rules to add the extension attribute and, there should be Sync Rules added to remove the values as well.

Please confirm what is the recommended way of removing the extension attributes and values from the impacted objects ?

Impacted object means, objects which currently has the extension attribute with value populated.
Sign in to comment
Karan Sharma 1 Reputation point

2021-07-13T00:40:09.23+00:00

Agree with ShadabBasha-7764's comment. I am experiencing the same where I cant remove the attribute even though I have deselected it from AAD sync.

We need a way of removing the extension attribute. Can anyone from Microsoft suggest a way to resolve this?
Please sign in to rate this answer.
DGS 1 Reputation point

2022-03-10T20:19:07.78+00:00

Today i had a similiar problem (with users) and stumbled on this entry. For anyone who wants to remove the extension attributes after deselecting or disabling extension synchronisation for users(and doing a full sync), you can do it via powershell.
*
https://learn.microsoft.com/en-us/powershell/module/azuread/remove-azureaduserextension?view=azureadps-2.0
*

[TESTED]The the bulk operation for users:

Get-AzureADUser -Filter "DirSyncEnabled eq true" -all $true | ForEach-Object {$_ | Remove-AzureADUserExtension -ExtensionName "replace with your extion name"}

*
conversation with myself
Does this have any impact if we remove it? -> not really right?
Is it clean if we remove it? -> for sure!
Could this be implemented in the sync? -> please microsoft!
Is it really gone? -> not really, it's still visible at some configuration points in Azure, maybe it's gone in some days

[DISCLAIMER]
If there are any errors, in the output investigate, i had one and the property was not removed, after resolving it everything went smoothly (*thank god i've seen this error it saved alot of time for my next project :D )

DGS 1 Reputation point

2022-03-10T22:46:14.107+00:00

You notice in my last post i said i couln't fully clean it.
Triggered me hard, and read through everything I found on the web
This was because the AzureADMSApplication named Tenant Schema Extension App still contains it. (Created when you first sync extension attributes)
Once you created the extension in it, you will be unable to remove it! Tried the command "Remove-AzureADMSApplicationExtensionProperty" but only getting a permission error

I hope this happens to no one... thanks microsoft

Also I found a post which describes that you can null the value in the sync rules, but I think my script does the job :D .

These are the things microsoft does to me which don't let me sleep at night
Sign in to comment
Radina Mileva (Tek Experts) 0 Reputation points

2023-06-29T11:08:21.04+00:00

Refresh schema, run full sync
Please sign in to rate this answer.

0 comments No comments
Sign in to comment