Why schema extension

Is this page helpful? Yes No. Any additional feedback? Skip Submit. Submit and view feedback for This product This page. View all page feedback. Description for the schema extension. The unique identifier for the schema extension definition.

This property cannot be changed after creation. The appId of the application that is the owner of the schema extension. Id fl. The result looks as here. Now, every user object has these properties available.

Well, this is done with the Update-MgSchemaExtension command. See the documentation at Update schemaExtension. This was tricky and it took us some time to figure it out: The sample code and documentation does not state that the owner of the extensions is required in the request to be successful.

Without the owner a write-error is thrown Wrong request: using Microsoft. Update: As we learned, one application can only create up to 5 schema extensions. Keep that in mind!

With this knowledge, to add the property "i sdirector " as a Boolean field, we need to take care of two things: We have to send the full schema and it is required to add the owner appid again , as here. Id filled. Otherwise we have to fill the data again. Then, we can no longer delete properties in the schema or the schema itself. We can only deprecate it. If a schema is no longer required and the status is not set to"Available", we can use the Remove-command as described at Delete schemaExtension and shown as here.

Note: "The signed-in user can only delete schemaExtensions they own where the owner property of the schemaExtension is the appId of an application the signed-in user owns. Id If the operation was successful, no response is sent. Azure AD prohibits the removal if the schema extension is final, as here:. Update: We ran into some issues when deleting schema extensions. Sometimes, the schema extension is removed, and sometimes not.

We reproduced and documented that issue and opened a case for that You can find some more issues at Get-MgUser not returning extension attributes We simulate the work of the app with Graph Explorer here. We sign-in, set the permissions as above and try out the REST requests.

So far so good. In contrast to the definition of the schema extensions, accessing the schema extensions as application does work. To make this clear: once existing, apps can use the schema definitions with Microsoft Graph. Not all properties must be provided, we could set one single property as well. So, the request contains a body with the data in JSON format.

If we send false data that does not correspond to the property type definitions , we get a HTTP Bad request result. If the data is not filled for a user, the request does not deliver any schema extension information. To get all users with the schema extension data, we can run a GET operation with the select parameter as here:.

We played around for getting the correct syntax for querying for custom property data. This Graph query returns all users with a specific value in one of the properties and outputs only the required data, like the user and the custom data. We want to get all users where the schema extension cost center is starting with "K".

Of course, the question has arisen, if we can use the user schema extensions in Dynamic Groups aka in a Security Group with dynamic membership. So, we tried this, and created a new Security Group with Dynamic User membership type. Here, we added the appId. So far, this sounds logically. The appId was accepted. We wanted to include all users that have a specific costcenter set.

The syntax for our query would look as here at least, we expected that it works in the same way as other rules : user. Unfortunately, this does not work. If you don't extend the schema, use the hierarchy maintenance tool , preinst. For example, you plan to create content at a primary site and then deploy that content to a secondary site below a different primary site.

If you extend the Active Directory schema, the secondary site automatically gets the source primary site's public key. Otherwise, use preinst. When you extend the schema for Configuration Manager, the following classes and attributes are added to the schema and available to all Configuration Manager sites in that Active Directory forest. The schema extensions might include attributes and classes from previous versions of the product but not used by the latest version.

For example:. Prepare Active Directory for site publishing. Feedback will be sent to Microsoft: By pressing the submit button, your feedback will be used to improve Microsoft products and services.

Privacy policy. Skip to main content. This browser is no longer supported. Download Microsoft Edge More info. Contents Exit focus mode. Considerations There are no new Active Directory schema extensions for Configuration Manager current branch.

Extending the schema is a forest-wide, one-time, irreversible action. Devices and clients that don't use the Active Directory schema Mobile devices that are managed by the Exchange Server connector The client for macOS computers Mobile devices that are enrolled by Configuration Manager on-premises MDM Windows clients that you configure for internet-only client management Windows clients that Configuration Manager detects to be on the internet Features that benefit The following Configuration Manager features benefit from extending the Active Directory schema.

Client computer installation and site assignment When you install a new client on a Windows computer, it searches Active Directory Domain Services for installation properties. If you don't extend the schema, use one of the following options to provide configuration details: Use client push installation. Provide at least the following client installation properties on the command line: Specify a management point or source path from which the computer can download the installation files.

Port configuration for client-to-server communication When a client installs, it uses the port information from Active Directory. If you don't extend the schema, use one of the following options to provide new port configurations to existing clients: Reinstall clients. Use options that configure the new port.