Does anyone know if there is a way to get AAD Connect provisioning errors via Graph? MSOL cmdlets still work, but Get-MGUser doesn't return the error.
This works:
(Get-MsolUser -ObjectId $objectId).dirsyncprovisioningerrors
This always returns null:
Get-MgUser -UserId $objectId | Select-Object provisioningerrors
With Graph, the property you're looking for is onPremisesProvisioningErrors
, you should also note that this property is only returned on $select
:
This means that you will need to -Select onPremisesProvisioningErrors
using the cmdlet. In summary, if you want to find all objects with sync errors you can use the following:
$getMgUserSplat = @{
Filter = "onPremisesProvisioningErrors/any(e: e/category eq 'PropertyConflict')"
All = $true
Select = "displayName", "onPremisesProvisioningErrors"
}
Get-MgUser @getMgUserSplat
Alternatively, if you want to make the direct API call using Invoke-MgGraphRequest
the code would be:
$filter = "onPremisesProvisioningErrors/any(e: e/category eq 'PropertyConflict')"
$select = "displayName, onPremisesProvisioningErrors"
$uri = 'v1.0/users?$filter={0}&$select={1}' -f $filter, $select
$result = do {
$req = Invoke-MgGraphRequest GET $uri
$uri = $req['@odata.nextLink']
if ($req['value']) { $req['value'] }
}
while ($uri)
$result