Skip to main content

​
Get-MgCustomSecurityAttributeInfo

​
SYNOPSIS

Reports custom security attributes assigned to users, devices, and service principals (enterprise apps) in Microsoft Entra ID.

​
SYNTAX

​
DESCRIPTION

Queries Microsoft Graph to enumerate custom security attribute assignments across users, devices, and service principals. Auto-discovers all attribute sets in the tenant, or restricts the scope to a single set when -AttributeSet is provided. The output is one row per (entity, attribute set, attribute name, value) so it can be filtered/pivoted easily.

​
EXAMPLES

​
EXAMPLE 1

Auto-discovers all attribute sets and returns assignments across users, devices, and service principals.

​
EXAMPLE 2

Returns assignments only for the ‘ComplianceData’ attribute set.

​
EXAMPLE 3

Returns assignments only for users and service principals (skips devices).

​
EXAMPLE 4

Returns only the attribute definitions assigned to nobody, with their set and their status.

​
EXAMPLE 5

Exports results to an Excel file in the user’s profile directory, with one worksheet per entity type, plus an ‘Unused’ worksheet listing the definitions nobody uses.

​
PARAMETERS

​
-AttributeSet

Restricts the report to a single attribute set name. If omitted, all attribute sets discovered in the tenant are reported.

​
-EntityType

Limits the entity types scanned. Valid values: User, Device, ServicePrincipal. Default is all three.

​
-ExportPath

Optional output directory for the Excel export (defaults to the user profile).

​
-ExportToExcel

(Optional) If specified, exports the results to an Excel file in the user’s profile directory.

​
-ForceNewToken

Switch parameter to force getting a new token from Microsoft Graph.

​
-OnlyAssigned

If specified, only entities that actually have at least one custom security attribute assignment are returned. This is the default behavior; the switch is kept for explicit/discoverable usage.

​
-UnusedOnly

Returns the attribute definitions that exist in the tenant but are assigned to no entity, instead of the assignments themselves. These are the cleanup candidates: a definition nobody uses still shows up in every attribute picker and still has to be governed. The scan is the same either way, so the count is always reported, whether or not this switch is present. The count is only trustworthy when every entity type was scanned without error. With a restricted -EntityType, or after an entity read failure, the result is reported as scoped: an attribute assigned only on a skipped entity type would otherwise look unused. A failure to read the definitions themselves is different: there is nothing to compare the assignments against, so the unused report is unavailable rather than scoped.

​
CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

​
INPUTS

​
OUTPUTS

​
System.Management.Automation.PSObject

Not documented.

​
NOTES

Required Microsoft Graph permissions:
  • CustomSecAttributeDefinition.Read.All
  • CustomSecAttributeAssignment.Read.All
  • User.Read.All
  • Device.Read.All
  • Application.Read.All
The custom security attribute on devices is in preview at the time of writing and uses the Graph beta endpoint. Reading customSecurityAttributes requires the caller to be granted the ‘Attribute Assignment Reader’ (or higher) directory role in addition to the application/delegated permissions above.