Microsoft Graph: Removal of photoUpdateSettings Operations and What Entra Admins Should Do Next

WHAT JUST CHANGED

Feature: Microsoft Graph photoUpdateSettings resource operations
Change: Removed GET, POST, and DELETE operations
Effective Date: June 2024
Status: Deprecated/Retired (Beta endpoint only)
Affected Tenants: All Microsoft Entra ID tenants using Microsoft Graph beta for photo update settings.

The photoUpdateSettings resource in the Microsoft Graph beta endpoint has had its GET, POST, and DELETE operations removed. This means you can no longer programmatically read, create, or delete photo update settings for users via Graph API beta. Any process or script relying on these endpoints will now fail.

WHO’S IMPACTED

• Entra ID admins and identity engineers automating user profile photo governance.
• Tenants leveraging custom workflows for profile photo management (e.g., onboarding/offboarding, compliance).
• Organizations integrating Graph beta endpoints into HR or user provisioning platforms.

Roles: Global Admin, Identity Admin, User Administrator, Application Developer
Licenses: All Entra ID SKUs (Free, P1, P2), since photo update settings were not SKU-restricted.

WHY IT MATTERS

Operational Impact:

• Automated scripts for controlling who can update their profile photo (e.g., enforcing a corporate standard) will break.
• HR integration workflows may need refactoring.
• There is no supported method to audit or change photo update permissions via Graph API at this time.
• Admins must manually enforce policy, or seek alternate solutions.

Security and Compliance:

• Loss of programmatic control reduces ability to enforce consistent brand or compliance requirements.
• Potential for stale or inappropriate user photos if not managed at scale.

WHAT’S NEXT ON THE ROADMAP

Microsoft is focusing on core user profile management via Graph, moving towards richer People and Workplace Intelligence features. Expect the following developments:

• Profile Photo Management: Microsoft signals a shift to the v1.0 endpoint for user photo operations (profilePhoto), but photoUpdateSettings will not be replaced soon.
• People Insights: Expanded workplace intelligence APIs to automate org charts, presence, collaboration signals.
• Entra External ID: More B2B/B2C user lifecycle management via Graph, with improved guest profile governance.
• Conditional Access: Roadmap includes richer identity signals for CA policies, including user profile attributes.

Admins should prepare for a world where user photo policy enforcement is less API-driven and more controlled via UI or custom logic.

WHY THIS DIRECTION IS BETTER

The previous photoUpdateSettings approach was limited, only available in beta, and not fully supported. Microsoft is prioritizing reliability and security by:

• Removing unstable, non-GA endpoints that risk breaking workflows.
• Encouraging use of supported, stable v1.0 Graph APIs for profile photo operations.
• Aligning with competing IdPs (Okta, Google Workspace) where profile photo policy is managed via admin UI, not API.
• Improving overall user profile consistency by reducing fragmented policy management.

ADJACENT ENTRA CHANGES YOU NEED TO KNOW

• Entra Admin Center Navigation: User profile settings are now consolidated under Identity > Users > Profile.
• Passwordless & MFA: User profile data (including photos) is more integrated with authentication methods, especially for FIDO2 and Authenticator app experiences.
• Microsoft Graph PowerShell Module: Microsoft.Graph.Users is the recommended module for all user profile operations; avoid deprecated AzureAD/MSOnline cmdlets.

WHAT TO DO: STEP-BY-STEP ACTIONS

1. Audit Your Scripts: Identify any use of photoUpdateSettings in Graph beta workflows.
2. Switch to Supported APIs: Use /users/{id}/photo for profile photos; policy enforcement must be manual or scripted via admin portal.
3. Communicate to Stakeholders: Notify HR, IT, and compliance teams of workflow changes.
4. Update Documentation and Onboarding: Reflect removal of API-based photo permission policies.

CHECK IT YOURSELF: PowerShell Audit

This script uses the Microsoft.Graph.Users module to enumerate user profile photos and checks for update permissions. It does not attempt to modify or delete photos, and defaults to read-only.

# Connect to Microsoft Graph
Connect-MgGraph -Scopes 'User.Read.All'

# Paginated fetch of all users
$userList = @()
$skipToken = $null
Do {
    $response = Get-MgUser -PageSize 100 -SkipToken $skipToken -ErrorAction SilentlyContinue
    $userList += $response
    $skipToken = $response.OdataNextLink -replace '^.+skiptoken=', ''
} While ($skipToken)

# Check each user for profile photo existence
foreach ($user in $userList) {
    try {
        $photo = Get-MgUserPhoto -UserId $user.Id -ErrorAction Stop
        Write-Output "User: $($user.DisplayName) | Photo: Exists | Id: $($user.Id)"
    } catch {
        Write-Output "User: $($user.DisplayName) | Photo: Missing | Id: $($user.Id)"
    }
}

This script will help you understand which users currently have profile photos, but cannot audit photo update permission settings, since that resource is now removed.

PORTAL PATH

To manage profile photos and related settings in the Entra Admin Center:

1. Open Microsoft Entra admin center (https://entra.microsoft.com).
2. Navigate to Identity > Users > [Select user] > Profile.
3. Manage user photo directly via UI.

BOTTOM LINE

Prioritised Recommendation:
1. Immediately audit and replace any use of photoUpdateSettings in Graph beta scripts.
2. Switch to v1.0 supported user/photo endpoints for profile photo management.
3. Update documentation for HR, onboarding, and compliance workflows.
4. Monitor Microsoft roadmap for new user profile governance features.

The removal of photoUpdateSettings marks a shift to more stable, supported user profile APIs. Stay proactive to avoid workflow disruption, and focus on UI-driven policy for now.