Daily.Entra.News
Aboutmerill.net
Microsoft Entra ID
Provisioning

Clear attribute values (Preview)

15 September 2026Feature update+37 / −8 lines

In brief

The documentation adds preview support for clearing mapped target attributes through Workday and SAP SuccessFactors inbound provisioning, with configuration, schema, testing, and troubleshooting guidance.

What Entra admins need to know

Administrators using HR-driven provisioning can configure null-value flow to clear target attributes when source values are emptied. No action is required unless they want to use this capability.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Preview scope and limitations

  • Clearing attribute values is available in preview for for:
    • API-driven inbound provisioning to:
      • to Microsoft Entra ID.ID and on-premises Active Directory.
      • On-Workday inbound user provisioning to Microsoft Entra ID and on-premises Active Directory.
      • SAP SuccessFactors inbound user provisioning to Microsoft Entra ID and on-premises Active Directory.
    • Clearing attribute values is only supported for single-valued attributes.
    • This feature can be enabled for custom security attribute provisioning.
    • Clearing attribute values isn't currently supported for:
      • Outboundfor outbound application provisioning scenarios.
      • Inbound provisioning fromscenarios, including Workday orWriteback and SAP SuccessFactors.
      SuccessFactors Writeback.
    • Clearing multi-valued attributes is not supported.

    How attribute values are cleared

    For API-driven inbound provisioning to on-premises Active Directory, review the additional role and server prerequisites, and then configure the provisioning agent and Active Directory connection.

    For HR-driven provisioning, first configure one of the supported inbound provisioning apps:

    Enable null value flow for the source attribute

    First, configure the source schema attribute to flow null values. The name of the source schema editor varies by provisioning integration.

    For instructions to submit the request, see Quickstart API-driven inbound provisioning with Graph Explorer or Quickstart for API-driven inbound provisioning with cURL.

    Workday and SAP SuccessFactors provisioning

    For Workday and SAP SuccessFactors inbound provisioning, the connector retrieves attribute values directly from the HR system during a provisioning cycle. You don't submit a /bulkUpload request to clear an attribute value.

    1. Follow the steps in Enable null value flow for the source attribute.
    2. Under Advanced options, select Edit attribute list for Workday or Edit attribute list for SuccessFactors, as appropriate.
    3. Select Flow null values only for each source attribute whose null or empty value should remove the mapped target value.
    4. Follow the steps in Enable null value flow in the target mapping for each corresponding target attribute.
    5. Clear the value in Workday or SAP SuccessFactors.
    6. Allow the next provisioning cycle to process the source change, or use provision on demand to test a specific user.

    Workday uses XPath expressions and SAP SuccessFactors uses JSONPath expressions to retrieve source attributes. The attribute must be present in the provisioning app schema and retrieved by the connector before the provisioning service can evaluate its null or empty value.

    If a null or empty value should populate a fallback value or preserve the existing target value instead of clearing it, see Troubleshoot HR user update issues.

    Verify the attribute was cleared

    After the provisioning service processes the request,source update, verify the result in the provisioning logs and the target directory.

    1. In your provisioning app, select Provisioning logs.
    2. Open the provisioning event for the user. | The source uses a placeholder value instead of null. | Configure the source integration to return a null or empty value instead of a placeholder, or transform the placeholder before provisioning. | | An API-driven provisioning request doesn't clear the attribute. | Use an explicit JSON null or empty string value. If you rely on omission for a child attribute, confirm that its containing complex object or collection element remains in the payload. Also confirm that the payload matching attribute identifies the existing target user. | | An API-driven provisioning request unexpectedly clears an attribute. | Confirm that the attribute wasn't omitted from the payload. Include its current non-empty value whenever you want to preserve the existing target value. | | A Workday or SAP SuccessFactors change doesn't clear the attribute. | Confirm that the HR connector retrieved the source change. Use provision on demand to test the user, and review the provisioning logs for the source value that the connector returned. |

    Next steps

Daily Entra.News

Get daily email updates

Get a concise summary of the latest Microsoft Entra updates delivered straight to your inbox.

Loading the secure signup form…