Export AADUser - User with $ in UPN

[gitbpotalan]

Description of the issue

As soon as export reaches a user with UserPrincipalName starting with $, the job terminates with no visible error.
Is there any way to :
-Make the job continue after encountering a "terminating error"
-Or fix users containing special characters, such as $ ?

Same error using Get-MgUser -UserId $user@domain.com :

Get-MgUser : Resource '@domain.com' does not exist or one of its queried reference-property objects are not present.
Status: 404 (NotFound)
ErrorCode: Request_ResourceNotFound
Date: 2025-06-20T08:54:23
Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : e603ff53-ed50-4e28-a228-1e2987530bcb
client-request-id : cb36e0a2-ae0b-4912-8d6b-82df0ed6229a
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"West Europe","Slice":"E","Ring":"5","ScaleUnit":"002","RoleInstance":"AM2PEPF00032C64"}}
x-ms-resource-unit : 1
Cache-Control : no-cache
Date : Fri, 20 Jun 2025 08:54:23 GMT
At line:1 char:1

• Get-MgUser -UserId $user@domain.com

•   + CategoryInfo          : InvalidOperation: ({ UserId = @it.... , Headers =  }:<>f__AnonymousType15`4) [Get-MgUser_Get], Exception
    + FullyQualifiedErrorId : Request_ResourceNotFound,Microsoft.Graph.PowerShell.Cmdlets.GetMgUser_Get
  
  

Microsoft 365 DSC Version

V1.25.604.1

Which workloads are affected

Azure Active Directory (Entra ID)

The DSC configuration

Export-M365DSCConfiguration -CertificateThumbprint xxx -TenantId xxx -ApplicationId xxx -Path xxx -FileName xxx.ps1 -Components AADUser

Same problem with filters :
Export-M365DSCConfiguration -Components AADUser -ApplicationId xxx -TenantId xxx -CertificateThumbprint xxx -Filters @{AADUser = "UserPrincipalName eq '`$user@domain.com'"}
Exporting Microsoft 365 configuration for Components: AADUser
There is a newer version of the 'Microsoft365DSC' module available on the gallery.
To update the module and it's dependencies, run the following command:
Update-M365DSCModule

Authentication methods specified:
- Service Principal with Certificate Thumbprint

Connecting to {MicrosoftGraph}...✅
[1/1] Extracting [AADUser] using {CertificateThumbprint}...
    |---[1/1] $user@domain.com❌
⌛ Export took {1 seconds} for {1 instances}

Verbose logs showing the problem

Export-M365DSCConfiguration -Components AADUser -ApplicationId xxx -TenantId xxx -CertificateThumbprint xxx -Filters @{AADUser = "UserPrincipalName eq '`$user@domain.com'"}
Exporting Microsoft 365 configuration for Components: AADUser
There is a newer version of the 'Microsoft365DSC' module available on the gallery.
To update the module and it's dependencies, run the following command:
Update-M365DSCModule

Authentication methods specified:
- Service Principal with Certificate Thumbprint

Connecting to {MicrosoftGraph}...✅
[1/1] Extracting [AADUser] using {CertificateThumbprint}...
    |---[1/1] $user@domain.com❌
⌛ Export took {1 seconds} for {1 instances}

Environment Information + PowerShell Version

OsName               : Microsoft Windows Server 2022 Datacenter
OsOperatingSystemSKU : DatacenterServerEdition
OsArchitecture       : 64-bit
WindowsVersion       : 2009
WindowsBuildLabEx    : 20348.1.amd64fre.fe_release.210507-1500
OsLanguage           : en-US
OsMuiLanguages       : {en-US, fr-FR}

Key   : PSVersion
Value : 5.1.20348.2849
Name  : PSVersion

Key   : PSEdition
Value : Desktop
Name  : PSEdition

Key   : PSCompatibleVersions
Value : {1.0, 2.0, 3.0, 4.0...}
Name  : PSCompatibleVersions

Key   : BuildVersion
Value : 10.0.20348.2849
Name  : BuildVersion

Key   : CLRVersion
Value : 4.0.30319.42000
Name  : CLRVersion

Key   : WSManStackVersion
Value : 3.0
Name  : WSManStackVersion

Key   : PSRemotingProtocolVersion
Value : 2.3
Name  : PSRemotingProtocolVersion

Key   : SerializationVersion
Value : 1.1.0.1
Name  : SerializationVersion

[FabienTschanz]

@gitbpotalan A dollar sign is an invalid character for a user principal name. See https://learn.microsoft.com/en-us/office/troubleshoot/office-suite-issues/username-contains-special-character for more information. That's not a scenario that we can fix because the query to Graph is invalid:

PS> Get-MgUser -UserId '$asdf@domain.onmicrosoft.com'
Get-MgUser_Get: The request URI is not valid. Since the segment 'users' refers to a collection, this must be the last segment in the request URI or it must be followed by an function or action that can be bound to it otherwise all intermediate segments must refer to a single resource.

Status: 400 (BadRequest)
ErrorCode: BadRequest
Date: 2025-06-21T09:53:57

But I'll take a note about the feature request for continuing an export even if an error occurs. That's a scenario probably many people will need.

[gitbpotalan]

Hello @FabienTschanz, is there any way to make the script not terminate and continue to the next user ?

[FabienTschanz]

Currently not. What we could possibly implement is to force the export to continue even if an error occurs, e.g. with using -ErrorAction Continue passed to Export-M365DSCConfiguration. I'll take a look at this.