How to use Microsoft Graph API to update the visibiliy of custom user attribute in a user flow?

Question

How to use Microsoft Graph API to update the visibiliy of custom user attribute in a user flow?

Lucas Pires Savassa 20

I have created a custom user attribute that represents the quantity of virtual currency that the user has.

This attribute is not supposed to appear during sign-up, but I'd like to manipulate it programmatically and include it in the ID token.

I read the documentation and had the idea to hide this custom attribute, by setting its visibility to false. But I don't know how to do that. The document explains that I should use the Graph API, but it doesn't provide the steps to do so.

I've never used the Graph API. How can I accomplish this?

Appreciate any feedback

VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2026-02-26T01:14:54+00:00
Hello Lucas Pires Savassa,

You’re on the right track conceptually, but there’s an important distinction to clear up first.

In Azure AD B2C / Microsoft Entra External ID, custom user attributes don’t have a standalone “visibility” flag that you toggle directly on the attribute itself. Visibility is controlled at the user flow level, not on the attribute object.

What you want is supported, but it’s done by configuring how the attribute is used in the user flow, not by updating the attribute definition alone.

How this works in practice

Create the custom attribute (which you already did).

Do NOT add the attribute to the sign‑up page of the user flow.

In the portal, under the user flow → User attributes, simply don’t select that attribute.

This already ensures the user never sees or edits it during sign‑up.

Include the attribute in Application Claims

Under Application claims, select your custom attribute so it’s emitted in the ID token.

Update the attribute programmatically using Microsoft Graph

You update the attribute value directly on the user object, not through the user flow.

Example:

PATCH https://graph.microsoft.com/v1.0/users/{userId}

Content-Type: application/json

{

"extension_<appIdWithoutHyphens>_virtualCurrency": 500

}

This is the recommended and supported approach.

About “hiding” attributes via Microsoft Graph

The documentation you saw refers to user flow page layout configuration, which is available only in Microsoft Graph beta and only applies to how attributes render on specific pages.

You can technically update a user flow using:

http isn’t fully supported. Syntax highlighting is based on Plain Text.

PATCH https://graph.microsoft.com/beta/identity/b2cUserFlows/{userFlowId}

…but this is not required for your scenario and is mainly intended for advanced UI customization. For a backend‑managed attribute like virtual currency, it’s better to simply:

Exclude it from sign‑up

Update it via Graph or backend logic

Emit it as a claim in the token

https://learn.microsoft.com/en-us/graph/api/identitycontainer-list-b2cuserflows?view=graph-rest-beta&tabs=http

https://learn.microsoft.com/en-us/graph/api/resources/b2cidentityuserflow?view=graph-rest-beta
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2026-03-04T12:17:26.0466667+00:00

Lucas Pires Savassa I’m following up on my previous comment as I haven’t received a response. Please let me know if you need any additional information or assistance from my side.
Lucas Pires Savassa 20 Reputation points

2026-03-18T23:27:09.1633333+00:00

Hi, @VEMULA SRISAI

Sorry for not following up. Thanks a lot for the detailed instructions. I hadn't had the time to execute them yet, but I'm confident that they will work. Will let you know as soon as possible.

Best regards!

1 answer

Your answer

VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2026-03-04T12:17:26.0466667+00:00

Lucas Pires Savassa I’m following up on my previous comment as I haven’t received a response. Please let me know if you need any additional information or assistance from my side.
Lucas Pires Savassa 20 Reputation points

2026-03-18T23:27:09.1633333+00:00

Hi, @VEMULA SRISAI

Sorry for not following up. Thanks a lot for the detailed instructions. I hadn't had the time to execute them yet, but I'm confident that they will work. Will let you know as soon as possible.

Best regards!

Answer 1

To keep the custom attribute off the sign-up page but still set it programmatically and have it available on the user object (and then in tokens), configure its hidden and editable flags via Microsoft Graph.

For external sign-up user flows, the attribute visibility is controlled by the authenticationAttributeCollectionInputConfiguration resource. The key flags are:

hidden: false by default (attribute is shown on the sign-up page). Set to true to hide it.
editable: true by default (user can edit it). Set to true or false depending on whether it should be user-editable if/when shown.

To achieve the scenario “not visible on sign-up, but set programmatically”:

Set hidden = true
Set editable = true

This hides the attribute from the page while still allowing it to be set via Graph or a custom extension.

High-level steps using Microsoft Graph:

Ensure the custom attribute is created in Microsoft Entra External ID and added to the user flow so it exists as an attribute in that flow.
Use Microsoft Graph to update the user flow’s page layout configuration and set the flags for that attribute via the authenticationAttributeCollectionInputConfiguration resource.
- The documentation calls out this resource and points to an example on “updating the page layout of a self-service sign up user flow” that shows how to set hidden and editable for each attribute.
After the attribute is hidden and still editable programmatically, use Microsoft Graph to set its value on the user object (for example, via extension attributes as described for External ID) and configure the user flow/claims mapping so that this attribute is emitted in the ID token.

The key behavior from the documentation:

To hide the attribute but still allow programmatic setting:
- hidden = true
- editable = true
This is configured using the authenticationAttributeCollectionInputConfiguration resource on the user flow via Microsoft Graph.

Once configured, the attribute will not appear during sign-up, but applications can set it through Graph and then include it in tokens via the user flow’s claims configuration.

References:

How to use Microsoft Graph API to update the visibiliy of custom user attribute in a user flow?

How this works in practice

1 answer

Your answer