Table of Contents
Limited Support for Exchange Custom Attributes for Synchronized Groups
In September 2026, Microsoft introduced limited support for the fifteen Exchange custom attributes for group objects synchronized from on-premises Active Directory. The Graph enables access to the custom attributes through the onPremisesExtensionAttributes resource, which the Graph also supports for user accounts.
Currently, support is read-only. If you want to update the value of custom attributes, use Exchange Online cmdlets like Set-DistributionGroup (assuming that writeback is enabled for Entra Cloud Sync).
Microsoft hasn’t explained why the current limitations exist. The restriction might reflect how these attributes are sourced and maintained in hybrid environments. It’s possible that it’s because the on-premises groups often record information in these attributes for use in business processes and synchronization makes the data available within Microsoft 365. Another possibility is that Microsoft built the feature to cater explicitly for situations where Active Directory is the source of authority for groups. Figure 1 shows an example of fetching some custom attributes from Exchange Online distribution groups.
However, the most likely explanation is the limited support within the Graph to update group objects like distribution groups which are owned by Exchange. You can’t run the Update-MgGroup cmdlet to update a distribution group, so it’s logical that the Graph wouldn’t support updates for the custom attributes for anything other than Entra security and Microsoft 365 groups.
Limited On-Premises Group Types
The types of groups that Microsoft Entra Cloud Sync can synchronize from on-premises Active Directory are distribution groups and security groups (mail-enabled or not). Although Entra ID supports Microsoft 365 groups, those groups are outside the scope of the feature because Microsoft 365 groups cannot be synchronized from Active Directory.
The prerequisite for use of the feature is to have some Entra ID groups synchronized from on-premises. Once that’s done, you can retrieve the properties of the groups with the Get-MgGroup cmdlet.
This command shows how to retrieve synchronized groups where the value of extension attribute 1 (customAttribute1 to Exchange) is not null. Entra ID deems this to be an advanced query, so parameters for the consistency level header and count variable must be used:
Get-MgGroup -Filter "onPremisesSyncEnabled eq true and onPremisesExtensionAttributes/extensionAttribute1 ne null" -Property Id, onPremisesExtensionAttributes, displayName -ConsistencyLevel Eventual -CountVariable GroupCount
Here’s another example of accessing custom attributes. In this case, the filter looks for synchronized groups which are mail enabled and not Microsoft 365 groups. The query fetches values for all fifteen custom attributes and then expands their values.
Get-MgGroup -Filter "onPremisesSyncEnabled eq true and mail ne null and NOT groupTypes/any(c:c eq 'Unified')" -Property id, displayName, onPremisesExtensionAttributes -ConsistencyLevel eventual -CountVariable count | Select-Object id -ExpandProperty onPremisesExtensionAttributes
Graph support is unavailable for the five multi-value custom attributes found for all Exchange Online mail-enabled objects.
Counting and the Graph
The CountVariable parameter is often associated with advanced queries but serves a different purpose than ConsistencyLevel. The consistency level header tells Graph to process the request as an advanced query. By contrast, CountVariable instructs the SDK to request the count of matching objects and store the returned value in a PowerShell variable.
Many examples found in Microsoft documentation include both parameters because they demonstrate how to retrieve counts, but advanced queries do not automatically require CountVariable. For example, the startsWith query shown below works without a count variable because it only returns matching groups. The query also works if the parameter is present:
[array]$Groups = Get-MgGroup -Filter "startsWith(DisplayName, 'Office')" -ConsistencyLevel Eventual -CountVariable Count
The overhead of requesting a count is usually negligible, so some developers routinely include CountVariable in advanced queries even when they don’t need the count.
Access to Custom Attributes is Welcome
I’ve been using custom attributes with Exchange mail-enabled objects since Exchange Server 2007. The arrival of support for these attributes for group objects, albeit limited, is welcome. It will be interesting to see how Microsoft develops this capability in the future.
Need help to write and manage PowerShell scripts for Microsoft 365, including Azure Automation runbooks? Get a copy of the Automating Microsoft 365 with PowerShell eBook, available standalone or as part of the Microsoft 365 for IT Pros eBook bundle.