Search for a command to run...
Why I hate Microsoft Graph SDK PowerShell modules... 😉
I work as System Administrator for more than 15 years now and I love to make my life easier by automating work & personal stuff via PowerShell (even silly things like food recipes list generation).
No comments yet. Be the first to comment.
Or any other Azure service requiring special authentication strength
If you are using Azure Local (HCI), you might find the following PowerShell script AzureLocalVMImageUpdater.ps1 useful. What is it good for? The code replaces the Windows VM images in the specified Azure Local cluster(s) with the latest compatible ve...
Problem It happens that the hardware hash of your Autopilot device gets changed. Thanks to the replacement of the motherboard or some other issue. This can lead to future problems when your users need to reinstall the operating system, but the Autopi...
Learn how to use undocumented Azure APIs for massive performance gains
Keeping a secure, version-controlled backup of your Intune-managed device data, including BitLocker, LAPS, and FileVault keys, is a best practice for any modern IT team. In this post, I’ll guide you through an Azure DevOps pipeline that automates the...
Several weeks ago I started to migrate our PowerShell scripts from using soon-to-be-deprecated AzureAD and MSOnline modules and replace them with the Microsoft Graph SDK module.
During this time I came across various gotchas that I will summarize in this short post.
This post is from 9.2.2023 and is referring to Graph modules of 1.20.0 version, but most of the mentioned info still apply for 2.x versions unfortunately.
For example cmdlet Get-MgDirectoryObjectById. The funny thing is that just the object saved in the property AdditionalProperties has case-sensitive properties. The main object properties aren't case sensitive 😃
It lacks examples. Especially unfortunate when an object has to be passed as an argument and you have no idea what it should look like.
It is crazy big (so it is super hard to find what you are looking for)
It is missing the description of the parameters
Like why can't I pass the output of the Get-MgUser to the Update-MgUser?!
If connecting to Graph API using Connect-MgGraph with the new permission scope (you will have to grant consent), you will see a popup like below that shows the official Microsoft Graph PowerShell application as unverified. WTF Microsoft?!
Remove-Item "$env:USERPROFILE\.graph" -Recurse -Force to clean the cacheInvoke-MgGraphRequestdoesn't manage paging! So not all results will be returned at once and you need to solve this on your ownAllparameter is used!All parameter just the first 100 or so items will be returned (because of paging)But if you connect using saved credentials, no following prompts will be shown
This super complicates unattended scripting. In such case, you probably use service principal and authenticate using a certificate. But if such script calls any function or script that again calls Connect-MgGraph (because it is convenient to start your Graph code by making a connection), it will timeout/error.
I've solved this by passing AccessToken
The new v2.x module version is fine though
The object with all available properties is always returned, but not all properties will be populated
The properties you want to retrieve can be specified by the Property parameter (Get-MgUser -Property DisplayName, Id) or parameter ExpandProperty if the property is expandable. Using a wildcard*isn't supported (but there is a workaround).
property or expandProperty parameter should be used to get the property dataGet-MgGroup command returns property Owners only if expandProperty parameter will be used! If you call it like Get-MgGroup -property owners , there will be no error, but also the owner's property will be always empty no matter what! See this github issue.For example Get-MgGroup returns property MembersWithLicenseErrors which is always empty because it is a relationship property and you have to use the command Get-MgGroupMemberWithLicenseError instead to get this data 😒
A.k.a. Microsoft.Graph.Authentication, Microsoft.Graph.Applications, ... in 1.20.0 version for example
Otherwise, you will see strange errors when trying to import a module with a different version
Invoke-MgInvalidateUserRefreshToken)v1.x
Call Select-MgProfile -Name Beta before Invoke-MgInvalidateUserRefreshToken
But don't forget to reverse to the stable API version ASAP!
v2.x
Invoke-MgBetaInvalidateUserRefreshToken insteadNew-MgInvitation -InvitedUserDisplayName $displayName -SendInvitationMessage:$truedebugparameter to get more detailed information and called URI
Find-MgGraphCommand -Urihttps://graph.microsoft.com/v1.0/deviceManagement| Select-ObjectCommandFind-MgGraphCommand -Command Get-MgUser | Select-Object URI
Use Chrome addon https://graphxray.merill.net
Open the Azure or Intune page where the results you are interested in are shown >> press F12 to open Developer Tools >> switch to Network tab >> search for graph.microsoft.com in the results
Connect-MgGraph -Scopes 'DeviceManagementManagedDevices.Read.All'
How to find those scopes is mentioned later in this list
Find-MgGraphCommand -Command Get-MgUser | Select-Object Permissions
Find-MgGraphPermission -SearchString read
How to get all permissions required by selected code (and its dependencies)
Format-Custom to expand the returned object's propertiesGet-MgUser -Top 1 | Format-Custom
Will expand the object properties so you will get a better understanding about the while object
ne,not,endsWithneeds to haveConsistencyLevel = 'Eventual'parameter setne,not,endsWithcan be used only on some types of objectsnotandneoperators are supported only in advanced queriesconsistencyLevel parameter has to be specified