I need help converting a few commands from msoluser to mguser, to change the immutableid

[NoSubstitute]

In our setup we have a SAML with Google Workspace provisioning users to M365.
When a user is renamed, for various reasons, and their email changes in Workspace, it pushes this new address to the account in EntraID, but it doesn't change the ImmutableId, making login to something like Sharepoint fail, because it expects the UPN and the ImmutableId to be the same (or whatever, I just know it fails because the ImmutableId is wrong - it still has the old address).

This worked with msoluser, but with MS Graph and mguser, the commands and options I have do not work, so I need help fiding alternative options to accomplish the same thing.

Here are the commands. edu.lomma.se is one of our tenants.

1. Find all users in tenant where the upn is different from the immutableid.

Get-MsolUser -All -DomainName edu.lomma.se | where { $_.UserPrincipalName -ne $_.ImmutableId } | Select DisplayName,UserPrincipalName,ImmutableId

2. When I know which are incorrect I need to fix that by changing the immutableid in three steps. YES, IT IS POSSIBLE!

Set-MsolUserPrincipalName -UserPrincipalName [email protected] -NewUserPrincipalName [email protected]

Set-MsolUser -UserPrincipalName [email protected] -ImmutableId "[email protected]"

Set-MsolUserPrincipalName -UserPrincipalName [email protected] -NewUserPrincipalName [email protected]

I've tried to figure this out by myself, but it's just too hard.
I've only managed to list all users with edu.lomma.se.

Get-MgUser -All | where UserPrincipalName -like "*@edu.lomma.se"

I have not at all been able to list users with the ImmutableId value, whiich of course is necessary for the comparison part of the command. I tried adding it with -Property, but nothing shows.

Get-MgUser -All -Property DisplayName,UserPrincipalName,OnPremisesImmutableId | where UserPrincipalName -like "*@edu.lomma.se"

[CupOfJoe-L]

I ran your line of code in our tenant without any issues.
Some checkpoints which you might want to check off, or already have:

• If the field is populated
• Which version of the SDK you are running. Unlikely the problem though.

Get-MgUser -Property DisplayName,UserPrincipalName,OnPremisesImmutableId | Select DisplayName,UserPrincipalName,OnPremisesImmutableId
The above at least allowed me to verify what was where.

[NoSubstitute]

Thank you so much for testing.
I see you skipped the -All option. Perhaps that is what is tripping me up.
I will test it and get back to you.

Yes, the fields are populated, as I'm fairly sure both values are necessary for an account to exist.
At least, they most definitely are for the accounts in question.

[CupOfJoe-L]

The -All option is just a matter if you want all the results or just the first, up to 100, results that fulfill your condition(s).

Then it is indeed a bit peculiar that they don't appear in your results.

[NoSubstitute]

OH! I can now print a filtered list of the users that deviates!

Get-MgUser -All -Property DisplayName,UserPrincipalName,OnPremisesImmutableId | Select DisplayName,UserPrincipalName,OnPremisesImmutableId | where UserPrincipalName -like "*@edu.lomma.se" | where { $_.UserPrincipalName -ne $_.OnPremisesImmutableId }

So, now I'm looking for the replacement command for this old MsoUser-command.

Set-MsolUserPrincipalName

[CupOfJoe-L]

What changed and enabled you to print out the list?

[NoSubstitute]

I'm not certain of any change.

I may just have been super slow in testing your suggested command. Friday the week after, I left for a two week vacation, and haven't had time to sit down for more testing until now.

As soon as I got some data to show, it was just a question of combining some old thoughts and new ways to filter the data.

[NoSubstitute]

FOUND IT!
O = old command
N = new command

O Set-MsolUserPrincipalName -UserPrincipalName [email protected] -NewUserPrincipalName [email protected]
N Update-MgUser -UserId [email protected] -UserPrincipalName [email protected]

O Set-MsolUser -UserPrincipalName [email protected] -ImmutableId "[email protected]"
N Update-MgUser -UserId [email protected] -OnPremisesImmutableId [email protected]

O Set-MsolUserPrincipalName -UserPrincipalName [email protected] -NewUserPrincipalName [email protected]
N Update-MgUser -UserId [email protected] -UserPrincipalName [email protected]

So, it wasn't that different, but just hard to find.

I now have a complete process using MS Graph instead of MsolUser.