azurepowershellazure-active-directoryactive-directorymicrosoft-graph-api

Get-MgUser Provisioningerrors always null


Does anyone know if there is a way to get AAD Connect provisioning errors via Graph? MSOL cmdlets still work, but Get-MGUser doesn't return the error.

This works:

(Get-MsolUser -ObjectId $objectId).dirsyncprovisioningerrors

This always returns null:

Get-MgUser -UserId $objectId | Select-Object provisioningerrors

Solution

  • With Graph, the property you're looking for is onPremisesProvisioningErrors, you should also note that this property is only returned on $select:

    property details

    This means that you will need to -Select onPremisesProvisioningErrors using the cmdlet. In summary, if you want to find all objects with sync errors you can use the following:

    $getMgUserSplat = @{
        Filter = "onPremisesProvisioningErrors/any(e: e/category eq 'PropertyConflict')"
        All    = $true
        Select = "displayName", "onPremisesProvisioningErrors"
    }
    
    Get-MgUser @getMgUserSplat
    

    Alternatively, if you want to make the direct API call using Invoke-MgGraphRequest the code would be:

    $filter = "onPremisesProvisioningErrors/any(e: e/category eq 'PropertyConflict')"
    $select = "displayName, onPremisesProvisioningErrors"
    $uri = 'v1.0/users?$filter={0}&$select={1}' -f $filter, $select
    
    $result = do {
        $req = Invoke-MgGraphRequest GET $uri
        $uri = $req['@odata.nextLink']
        if ($req['value']) { $req['value'] }
    }
    while ($uri)
    
    $result