microsoftgraph / msgraph-sdk-powershell

Powershell SDK for Microsoft Graph
https://www.powershellgallery.com/packages/Microsoft.Graph
Other
696 stars 168 forks source link

Get-MgDeviceManagementManagedDeviceEncryptionState Filters not working #694

Closed Underdoge closed 3 years ago

Underdoge commented 3 years ago

Hello,

Description: When I try Get-MgDeviceManagementManagedDeviceEncryptionState with a filter it seems to ignore it and gives me all results, no errors.

To Reproduce: Get-MgDeviceManagementManagedDeviceEncryptionState -All -Filter "DeviceType eq 'macMDM'"

Expected Result: It should only return devices with DeviceType of 'macMDM'.

Actual Result: It returns devices with all other DeviceTypes including 'windowsRT'. AB#9862

Underdoge commented 3 years ago

More errors/issues:

Get-MgDeviceManagementManagedDeviceEncryptionState -All -Filter "startswith(DeviceName,'AA')" gives me an internal server error.

Get-MgDeviceManagementManagedDeviceEncryptionState -Filter "DeviceName eq 'AABBCCDD')" gives me all results without any filtering, it should only return device where DeviceName is 'AABBCCDD'.

peombwa commented 3 years ago

@Underdoge This looks like a service issue since the command sends the filter query to the service as expected. Could you run Get-MgDeviceManagementManagedDeviceEncryptionState -All -Filter "startswith(DeviceName,'AA')" -Debug with a -Debug switch and share the debug logs with us.

Also, could you try running the same call in Microsoft Graph Explorer to see if it gives you the expected results - https://graph.microsoft.com/beta/deviceManagement/managedDeviceEncryptionStates?$filter=startswith(DeviceName,'AA').

Underdoge commented 3 years ago

@peombwa here's the result when running with -Debug however note that the cmdlet works just fine without the Filter : `PS C:\WINDOWS\system32> Get-MgDeviceManagementManagedDeviceEncryptionState -All -Filter "startswith(DeviceName,'AA')" -Debug DEBUG: CmdletBeginProcessing: DEBUG: CmdletProcessRecordStart: DEBUG: CmdletProcessRecordAsyncStart: DEBUG: CmdletGetPipeline: DEBUG: CmdletBeforeAPICall: DEBUG: URLCreated: https://graph.microsoft.com/beta/deviceManagement/managedDeviceEncryptionStates?$top=100&$filter=startswith(DeviceName%2C'AA') DEBUG: RequestCreated: https://graph.microsoft.com/beta/deviceManagement/managedDeviceEncryptionStates?$top=100&$filter=startswith(DeviceName%2C'AA') DEBUG: HeaderParametersAdded: https://graph.microsoft.com/beta/deviceManagement/managedDeviceEncryptionStates?$top=100&$filter=startswith(DeviceName%2C'AA') DEBUG: GET /beta/deviceManagement/managedDeviceEncryptionStates?$top=100&$filter=startswith%28DeviceName%2C%27AA%27%29 HTTP/1.1 HTTP: graph.microsoft.com

DEBUG: BeforeCall: DEBUG: ResponseCreated: DEBUG: BeforeResponseDispatch: Get-MgDeviceManagementManagedDeviceEncryptionState : { "_version": 3, "Message": "An internal server error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: c8eaefe9-3776-447d-ba87-0df84f89c6f0 - Url: https://fef.msua01.manage.microsoft.com/DeviceConfiguration_2105/StatelessDeviceConfigurationFEService/deviceManagement/managedDeviceEncryptionStates?api-version=5021-04-16&$filter=startswith(deviceName%2c%27AA%27)&$top=100", "CustomApiErrorPhrase": "", "RetryAfter": null, "ErrorSourceService": "", "HttpHeaders": "{}" } At line:1 char:1

DEBUG: Finally: DEBUG: CmdletAfterAPICall: DEBUG: CmdletProcessRecordAsyncEnd: DEBUG: CmdletProcessRecordEnd: DEBUG: CmdletEndProcessing: `

Underdoge commented 3 years ago

Also tried doing the same call through my own Poweshell script and it failed in the same fashion, error 500, Internal Server Error. It's not currently possible for me to test in Graph Explorer because my account doesn't have the required scope permissions, only my app does.

Underdoge commented 3 years ago

Hello @peombwa, I understand the 500 error when using the 'startswith' filter is a service issue. What about the first post? Get-MgDeviceManagementManagedDeviceEncryptionState -All -Filter "DeviceType eq 'macMDM'" should only get MacMDM device types but it's bringing back everything, which is actually my main concern. Thanks.

Underdoge commented 3 years ago

Hello @peombwa, I understand the 500 error when using the 'startswith' filter is a service issue. What about the first post? Get-MgDeviceManagementManagedDeviceEncryptionState -All -Filter "DeviceType eq 'macMDM'" should only get MacMDM device types but it's bringing back everything, which is actually my main concern. Thanks.

I see now this is a server issue as well, not an SDK one. Closing.

peombwa commented 3 years ago

I'd also recommend you open a service issue here https://developer.microsoft.com/en-us/graph/support to have this resolved.

Underdoge commented 3 years ago

Spoke with MS Support, looks like the endpoint doesn't support filters, that's why it's not working: https://docs.microsoft.com/en-us/graph/api/resources/intune-deviceconfig-manageddeviceencryptionstate?view=graph-rest-beta