Get-MgDeviceManagementManagedDeviceEncryptionState Filters not working

[Underdoge]

Hello,

Description: When I try Get-MgDeviceManagementManagedDeviceEncryptionState with a filter it seems to ignore it and gives me all results, no errors.

To Reproduce: Get-MgDeviceManagementManagedDeviceEncryptionState -All -Filter "DeviceType eq 'macMDM'"

Expected Result: It should only return devices with DeviceType of 'macMDM'.

Actual Result: It returns devices with all other DeviceTypes including 'windowsRT'. AB#9862

[Underdoge]

More errors/issues:

Get-MgDeviceManagementManagedDeviceEncryptionState -All -Filter "startswith(DeviceName,'AA')" gives me an internal server error.

Get-MgDeviceManagementManagedDeviceEncryptionState -Filter "DeviceName eq 'AABBCCDD')" gives me all results without any filtering, it should only return device where DeviceName is 'AABBCCDD'.

[peombwa]

@Underdoge This looks like a service issue since the command sends the filter query to the service as expected. Could you run Get-MgDeviceManagementManagedDeviceEncryptionState -All -Filter "startswith(DeviceName,'AA')" -Debug with a -Debug switch and share the debug logs with us.

Also, could you try running the same call in Microsoft Graph Explorer to see if it gives you the expected results - https://graph.microsoft.com/beta/deviceManagement/managedDeviceEncryptionStates?$filter=startswith(DeviceName,'AA').

[Underdoge]

@peombwa here's the result when running with -Debug however note that the cmdlet works just fine without the Filter : `PS C:\WINDOWS\system32> Get-MgDeviceManagementManagedDeviceEncryptionState -All -Filter "startswith(DeviceName,'AA')" -Debug DEBUG: CmdletBeginProcessing: DEBUG: CmdletProcessRecordStart: DEBUG: CmdletProcessRecordAsyncStart: DEBUG: CmdletGetPipeline: DEBUG: CmdletBeforeAPICall: DEBUG: URLCreated: https://graph.microsoft.com/beta/deviceManagement/managedDeviceEncryptionStates?$top=100&$filter=startswith(DeviceName%2C'AA') DEBUG: RequestCreated: https://graph.microsoft.com/beta/deviceManagement/managedDeviceEncryptionStates?$top=100&$filter=startswith(DeviceName%2C'AA') DEBUG: HeaderParametersAdded: https://graph.microsoft.com/beta/deviceManagement/managedDeviceEncryptionStates?$top=100&$filter=startswith(DeviceName%2C'AA') DEBUG: GET /beta/deviceManagement/managedDeviceEncryptionStates?$top=100&$filter=startswith%28DeviceName%2C%27AA%27%29 HTTP/1.1 HTTP: graph.microsoft.com

DEBUG: BeforeCall: DEBUG: ResponseCreated: DEBUG: BeforeResponseDispatch: Get-MgDeviceManagementManagedDeviceEncryptionState : { "_version": 3, "Message": "An internal server error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: c8eaefe9-3776-447d-ba87-0df84f89c6f0 - Url: https://fef.msua01.manage.microsoft.com/DeviceConfiguration_2105/StatelessDeviceConfigurationFEService/deviceManagement/managedDeviceEncryptionStates?api-version=5021-04-16&$filter=startswith(deviceName%2c%27AA%27)&$top=100", "CustomApiErrorPhrase": "", "RetryAfter": null, "ErrorSourceService": "", "HttpHeaders": "{}" } At line:1 char:1

• Get-MgDeviceManagementManagedDeviceEncryptionState -All -Filter "star ...

• 
  + CategoryInfo          : InvalidOperation: ({ Top = 100, Sk...ndProperty =  }:<>f__AnonymousType2`8) [Get-MgDeviceMan...ptionState_List], RestException`1
  + FullyQualifiedErrorId : InternalServerError,Microsoft.Graph.PowerShell.Cmdlets.GetMgDeviceManagementManagedDeviceEncryptionState_List
  DEBUG: GET https://graph.microsoft.com/beta/deviceManagement/managedDeviceEncryptionStates?$top=100&$filter=startswith%28DeviceName%2C%27AA%27%29
  HTTP/1.1 500 Internal Server Error
  Transfer-Encoding: chunked
  Vary: Accept-Encoding
  Strict-Transport-Security: max-age=31536000
  request-id: c8eaefe9-3776-447d-ba87-0df84f89c6f0
  client-request-id: c8eaefe9-3776-447d-ba87-0df84f89c6f0
  x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"North Central US","Slice":"E","Ring":"5","ScaleUnit":"003","RoleInstance":"CH01EPF00007831"}}
  Date: Fri, 11 Jun 2021 00:34:00 GMT
  Content-Encoding: gzip
  Content-Type: application/json

DEBUG: Finally: DEBUG: CmdletAfterAPICall: DEBUG: CmdletProcessRecordAsyncEnd: DEBUG: CmdletProcessRecordEnd: DEBUG: CmdletEndProcessing: `

[Underdoge]

Also tried doing the same call through my own Poweshell script and it failed in the same fashion, error 500, Internal Server Error. It's not currently possible for me to test in Graph Explorer because my account doesn't have the required scope permissions, only my app does.

[Underdoge]

Hello @peombwa, I understand the 500 error when using the 'startswith' filter is a service issue. What about the first post? Get-MgDeviceManagementManagedDeviceEncryptionState -All -Filter "DeviceType eq 'macMDM'" should only get MacMDM device types but it's bringing back everything, which is actually my main concern. Thanks.

[Underdoge]

Hello @peombwa, I understand the 500 error when using the 'startswith' filter is a service issue. What about the first post? Get-MgDeviceManagementManagedDeviceEncryptionState -All -Filter "DeviceType eq 'macMDM'" should only get MacMDM device types but it's bringing back everything, which is actually my main concern. Thanks.

I see now this is a server issue as well, not an SDK one. Closing.

[peombwa]

I'd also recommend you open a service issue here https://developer.microsoft.com/en-us/graph/support to have this resolved.

[Underdoge]

Spoke with MS Support, looks like the endpoint doesn't support filters, that's why it's not working: https://docs.microsoft.com/en-us/graph/api/resources/intune-deviceconfig-manageddeviceencryptionstate?view=graph-rest-beta