API-Driven Inbound Provisioning Tips – Microsoft Entra ID

Function Add-SchemaAttribute {
    param(
        [Parameter(Mandatory)]
        [string]$ServicePrincipalId,

        [Parameter()]
        [ValidateSet("API", "On Premises Active Directory")]
        $Set = "API",

        [Parameter(Mandatory = $true)]
        [string[]]
        $AttributeName
    )
    
    $ServicePrincipal = Get-MgServicePrincipal -ServicePrincipalId $ServicePrincipalId
    $job = Get-MgServicePrincipalSynchronizationJob -ServicePrincipalId $ServicePrincipal.Id
    $uri = "https://graph.microsoft.com/v1.0/servicePrincipals/$($ServicePrincipal.Id)/synchronization/jobs/$($job.Id)/schema"

    # The get-mgschema cmdlets don't return all the things that we need, use graph directly instead
    $schemaJson = Invoke-MgGraphRequest -Method GET -Uri $uri 

    # Each "connector" has a directory, one for AD and one for the provisioning service API
    $apiDir = $schemaJson.directories | Where-Object name -eq $Set
    $apiObject = $apiDir.objects | Where-Object { $_ -is [hashtable] -and $_.attributes }

    foreach ($attr in $AttributeName) {
        Write-Verbose "Processing attribute $attr"
        if ($apiObject.attributes | Where-Object name -eq $attr) {
            Write-Verbose "Attribute $attr already exists"
        }
        else {
            $apiObject.attributes += @{
                name        = $attr
                type        = 'String'
                anchor      = $false
                caseExact   = $false
                multivalued = $false
                required    = $false
            }
        }
    }

    $putURI = "https://graph.microsoft.com/v1.0/servicePrincipals/$($ServicePrincipal.Id)/synchronization/jobs/$($job.Id)/schema"
    $body = ($schemaJson | ConvertTo-Json -Depth 100) 
    Invoke-MgGraphRequest -Method PUT -Uri $putURI -Body $body -ContentType 'application/json'
}