microsoft / EntraExporter

PowerShell module to export a local copy of an Entra (Azure AD) tenant configuration.
https://aka.ms/EntraExporter
MIT License
568 stars 89 forks source link

Extra urlencoded '$' sign in accessPackageResourceRoleScopes request #47

Closed mathias-nyman closed 1 year ago

mathias-nyman commented 1 year ago

Fetching the Access Package Resource Role Scopes yields the following error:

  Line |
 116 |  …  $results = Invoke-MgGraphRequest -Method GET -Uri $uriQueryEndpointF …
     |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | GET https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages/f9cc86bc-de22-4fe2-b278-e34661ad711b?$expand=accessPackageResourceRoleScopes(%24$expand%3DaccessPackageResourc
     | Request Transfer-Encoding: chunked Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 request-id: fc296106-87a4-40a6-8cc4-46ad60b1801e client-request-id: cee25f84-9ac2-4b5b-b688-ebe99f5hee
     | {"ServerInfo":{"DataCenter":"Sweden Central","Slice":"E","Ring":"5","ScaleUnit":"001","RoleInstance":"GV2PEPF00002098"}} Date: Thu, 17 Aug 2023 07:30:30 GMT Content-Type: application/json Content-Encodin
     | {"error":{"code":"BadRequest","message":"Parsing OData Select and Expand failed: Term '($$expand=accessPackageResourceRole,accessPackageResourceScope)' is not valid in a $select or $expand
     | expression.","innerError":{"date":"2023-08-17T07:30:30","request-id":"fc296106-87a4-40a6-8cc4-46ad60b1801e","client-request-id":"cee25f84-9ac2-4b5b-b688-ebe99f5hee51"}}}

The issue seems to be that the inner '$expand' is prepended with an urlencoded '$' (%24). I'm not sure which component does this; perhaps the graph api library? Replacing the '$expand' with just 'expand' fixes the issue.