关于Microsoft Graph用户Delta调用中自定义属性的技术咨询

Based on your setup where you're successfully syncing custom AD attributes to Azure AD and accessing them via standard Graph calls, here's what you need to know about using these attributes with delta queries:

1. Including Custom Extension Attributes in Delta Requests #

Just like with standard user queries, you must explicitly specify your custom extension attributes in the $select parameter to get them in delta results. Delta queries don't return custom attributes by default—only core user properties.

Your delta call should look something like this:

GET https://graph.microsoft.com/v1.0/users/delta?$select=id,displayName,extension_<GUID_REMOVED>_ipPhone,extension_<GUID_REMOVED>_division

2. How Delta Tracking Works for Synchronized Attributes #

• Change Detection: When the custom attribute value is updated in your on-prem AD, after Azure AD Connect completes its sync cycle (typically 30 minutes by default), the change will be flagged in Azure AD. The next delta query will include this user in the results, with the updated custom attribute value.
• Full Attribute Return: If a user is included in delta results (due to any property change), all attributes you specified in $select (including your custom ones) will be returned, even if the custom attribute itself didn't change.
• No False Positives: If the custom attribute value doesn't change, the user won't show up in delta results just because of that attribute—only when another tracked property (or the custom one) is modified.

3. Initial vs. Subsequent Delta Syncs #

• First Sync (Initial Pull): When you run your first delta query without a deltaToken or skipToken, you'll get a full list of all users matching your query, including your custom attributes. The response will include a @odata.deltaLink to use for future calls.
• Incremental Syncs: Using the deltaLink from the previous response will only return users who have had changes (including custom attribute updates) since your last delta query. This keeps your sync efficient.

4. Troubleshooting Common Issues #

• Double-Check Attribute Names: Make sure you're using the exact extension attribute name (extension_<GUID>_<attributeName>) as you do in your standard user query. A typo here will result in the attribute not being returned.
• Verify Sync Status: If a change isn't showing up in delta results, check Azure AD Connect's sync logs to confirm the attribute update was successfully synced to Azure AD. Sync delays are normal, so wait at least one full sync cycle before troubleshooting further.
• Permissions: Ensure your application or user account has the same permissions required for standard user queries (e.g., User.Read.All or Directory.Read.All)—delta queries use the same permission set.

内容的提问来源于stack exchange，提问作者statto