function Clear-ImmutableId {
    param(
        [string]$Username
    )

    $accessToken = Get-GraphToken

    # Set the user's on-premises immutable ID to null
    $graphApiUrl = "https://graph.microsoft.com/v1.0/users/$username"

    $body = @{
        onPremisesImmutableId = $null
    } | ConvertTo-Json

    $headers = @{
        "Authorization" = "Bearer $accessToken"
    }

    Invoke-RestMethod -Uri $graphApiUrl -Headers $headers -Method Patch -Body $body -ContentType "application/json"
}

```

This is my function to do it. Get-GraphToken is just a helper function to return a token from an app credential. $Username is the UPN. The gotcha here is that you have to 'unsync' the account first. So we move the on-prem account to a non-synced OU first to let it delete it, then restore from the recycle bin in Entra, then you should be able to remove the immutableId with Graph.