Pagination stopped working for multiple Graph resources

[Semptra]

Describe the bug

Pagination stopped working correctly for multiple Microsoft Graph API resources since 2024-06-29. In particular, this includes the following endpoints (but potentially could affect more, those are the ones we are using and noticed the problem for):

• List secureScoreControlProfiles
• List alerts

When using those endpoints with $top OData query parameter and following the @odata.nextLink, I'm getting the following error:

The query specified in the URI is not valid. Query option 'SkipToken' is not allowed. To allow it, set the 'AllowedQueryOptions' property on EnableQueryAttribute or QueryValidationSettings.

Before the 2024-06-29, both endpoints worked correctly with $top OData query parameter.

Note: this issue is most likely not an SDK problem, but rather an issue in Microsoft Graph API. I can reproduce this issue in Microsoft Graph Explorer:

After clicking the link:

Expected behavior

Code executes without errors.

How to reproduce

var graphServiceClient = new GraphServiceClient(credentials);

var response = await graphServiceClient.Security.SecureScoreControlProfiles.GetAsync(requestConfiguration =>
{
    requestConfiguration.QueryParameters.Top = 1;
});

var profiles = new List<SecureScoreControlProfile>();

var pageIterator = PageIterator<SecureScoreControlProfile, SecureScoreControlProfileCollectionResponse>
    .CreatePageIterator(graphServiceClient, response, (profile) =>
    {
        profiles.Add(profile);

        return true;
    });

await pageIterator.IterateAsync();

SDK Version

5.36.0

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output

Click to expand log

``` { "error": { "code": "", "message": "The query specified in the URI is not valid. Query option 'SkipToken' is not allowed. To allow it, set the 'AllowedQueryOptions' property on EnableQueryAttribute or QueryValidationSettings.", "innerError": { "message": "Query option 'SkipToken' is not allowed. To allow it, set the 'AllowedQueryOptions' property on EnableQueryAttribute or QueryValidationSettings.", "date": "2024-07-01T09:02:07", "request-id": "b5cd51b7-3c92-4324-9986-0158046877c9", "client-request-id": "6997a046-9624-4df8-4ecf-334c74e86679" } } } ```

Configuration

No response

Other information

No response

[andrueastman]

Thanks for raising this @Semptra

As this is an API side issue, any chance you are in a position to file a support ticket using your tenant information to have this followed up?

https://developer.microsoft.com/en-us/graph/support

[VoVanHaiQS]

I got the same issue, attempting to workaround with "odata.nextlink" option, but still get the same error: "The query specified in the URI is not valid. Query option 'SkipToken' is not allowed. To allow it, set the 'AllowedQueryOptions' property on EnableQueryAttribute or QueryValidationSettings."

[crodriguezSofteng]

Can confirm this happens for example with /security/secureScoreControlProfiles with skiptoken:

first page is ok

but query with skiptoken fails

[Semptra]

@andrueastman my team has created a support ticket via Azure Portal using our subscription, so I probably can't share the link here. Hoping for a quick resolution since it does seem to affect multiple tenants.

[crodriguezSofteng]

btw you can workarround /security/secureScoreControlProfiles?$top=1000 because afaik for now MS doesn't have more than 1000 security controls The alert endpoint is more problematic because you might have more than 1k alerts

[Semptra]

btw you can workarround /security/secureScoreControlProfiles?$top=1000 because afaik for now MS doesn't have more than 1000 security controls The alert endpoint is more problematic because you might have more than 1k alerts

Thanks, that's what we did already for Secure Score Profiles. For alerts, the alternative might be to implement pagination using $top in combination with $skip parameters, but I'm not sure how reliable it would be.

[scottzach1]

This exact issue is also impacting us and our customers. We are also observing it on the /beta/security/tiIndicators endpoint.

@Semptra thank you for raising a support ticket. Have you had any response from Microsoft?

[rs-seccompsme2]

We are also experiencing this same issue on /security/secureScoreControlProfiles and it is impacting a Function App performing assessments for us in multiple customer tenants. We are making the calls from a PowerShell module.

[Semptra]

This issue can be closed now, Microsoft reached out back to us and confirmed that they have rolled back the breaking changes. Can confirm that secureScoreControlProfiles pagination is now working.