Update-MgUser unable to remove CustomSecurityAttribute value from user

[mariussm]

Describe the bug

I am trying to remove a customSecurityAttribute from a user, by setting an attribute value to null through the CustomSecurityAttributes parameter of Update-MgUser. However, the body is not sent correctly to Graph, causing the null to never be set.

Expected behavior

The customSecurityAttribute is removed from the user through a patch request with a null value.

How to reproduce

Update-MgUser -userid ce3d945f-fc56-4b19-9891-665ca05a998d -CustomSecurityAttributes @{
    "IssueTokenCSA" = @{
        "@odata.type" = "#microsoft.graph.customSecurityAttributeValue"
        "ssn"         = $null
    }   
}

SDK Version

2.32.0

Latest version known to work for scenario above?

No response

Known Workarounds

Forging the request manually works just fine:

Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/users/ce3d945f-fc56-4b19-9891-665ca05a998d" -Body (@{
        "customSecurityAttributes" = @{
            "IssueTokenCSA" = @{
                "@odata.type" = "#microsoft.graph.customSecurityAttributeValue"
                "ssn"         = $null
            }
        }
    } | ConvertTo-Json -Depth 10) -ContentType "application/json"

Debug output

As you can see, the body is missing the ssn = null part.

Click to expand log

Update-MgUser -userid ce3d945f-fc56-4b19-9891-665ca05a998d -CustomSecurityAttributes @{ "IssueTokenCSA" = @{ "@odata.type" = "#microsoft.graph.customSecurityAttributeValue" "ssn" = $null } } -Debug

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
PATCH

Absolute Uri:
https://graph.microsoft.com/v1.0/users/ce3d945f-fc56-4b19-9891-665ca05a998d

Headers:
FeatureFlag : 00000003
Cache-Control : no-store, no-cache
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.26200; en-150),PowerShell/7.5.4
SdkVersion : graph-powershell/2.32.0
client-request-id : 88290648-0f15-498c-b257-90c5097cb246
Accept-Encoding : gzip,deflate,br

Body:
{
"customSecurityAttributes": {
"IssueTokenCSA": {
"@odata.type": "#microsoft.graph.customSecurityAttributeValue"
}
}
}

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
NoContent

Headers:
Cache-Control : no-cache
Strict-Transport-Security : max-age=31536000
request-id : 3ab5e8b8-9202-4f58-be61-c107ef6572f6
client-request-id : 88290648-0f15-498c-b257-90c5097cb246
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Norway East","Slice":"E","Ring":"2","ScaleUnit":"001","RoleInstance":"OSL2EPF00000164"}}
x-ms-resource-unit : 1
Date : Tue, 18 Nov 2025 10:35:04 GMT

Body:

DEBUG: [CmdletEndProcessing]: - Update-MgUser end processing.

Configuration

No response

Other information

No response