User export fails, actual error not exposed due to potential issue in error handling

[sopelt]

We are seeing errors at different points when exporting users and only the following information is provided:

Error exporting Users: The property 'Message' cannot be found on this object. Verify that the property exists.

This error seems to originate here. I think the error handling code might need to be more defensive in order to expose the relevant issue.

[merill]

Can you try running with the -Debug parameter? This should show the exact Graph API call that is failing. Once you do that can you try running that same command using Graph Explorer and let me know if you are still seeing the issue?

[sopelt]

Hey @merill , thank you for the swift reply. We run the export from a azure devops pipeline and usually it fails after an hour or two (the tenant has a lot of users to export) but when adding the Debug-switch it fails almost immediately (with the initially reported error) so it seems that there might be issues with setting Debug here (non-interactive shell?).

Any other ideas or does the error handling code need to check if the Message property exists?

[SamErde]

I also get the same error when running Export-AzureAD directly in PowerShell. For example:

❯ Export-AzureAD -Path .\ -Type ConditionalAccess -Debug
 Identity/Conditional/AccessPolicies
DEBUG: GET /v1.0/identity/conditionalAccess/policies HTTP/1.1
HTTP: graph.microsoft.com
ConsistencyLevel: eventual
User-Agent: Mozilla/5.0 (Windows NT 10.0; Microsoft Windows 10.0.19042; en-US) PowerShell/5.1.19041.1682 Invoke-MgGraphRequest


Confirm
Continue with this operation?
[Y] Yes  [A] Yes to All  [H] Halt Command  [S] Suspend  [?] Help (default is "Y"): y
Invoke-MgGraphRequest : The pipeline has been stopped.
At C:\Program Files\WindowsPowerShell\Modules\azureadexporter\1.0.941508\internal\Invoke-Graph.ps1:116 char:48
+ ...  $results = Invoke-MgGraphRequest -Method GET -Uri $uriQueryEndpointF ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Invoke-MgGraphRequest], PipelineStoppedException
    + FullyQualifiedErrorId : Microsoft.Graph.PowerShell.Authentication.Cmdlets.InvokeMgGraphRequest

The property 'Message' cannot be found on this object. Verify that the property exists.
At C:\Program Files\WindowsPowerShell\Modules\azureadexporter\1.0.941508\Export-AzureAD.ps1:115 char:21
+                     $e = $_.ErrorDetails.Message
+                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], PropertyNotFoundException
    + FullyQualifiedErrorId : PropertyNotFoundStrict

 Identity/Conditional/NamedLocations
DEBUG: GET /v1.0/identity/conditionalAccess/namedLocations HTTP/1.1
HTTP: graph.microsoft.com
ConsistencyLevel: eventual
User-Agent: Mozilla/5.0 (Windows NT 10.0; Microsoft Windows 10.0.19042; en-US) PowerShell/5.1.19041.1682 Invoke-MgGraphRequest


Confirm
Continue with this operation?
[Y] Yes  [A] Yes to All  [H] Halt Command  [S] Suspend  [?] Help (default is "Y"): y
The property 'Message' cannot be found on this object. Verify that the property exists.
At C:\Program Files\WindowsPowerShell\Modules\azureadexporter\1.0.941508\Export-AzureAD.ps1:115 char:21
+                     $e = $_.ErrorDetails.Message
+                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], PropertyNotFoundException
    + FullyQualifiedErrorId : PropertyNotFoundStrict

[SamErde]

Unfortunately I cannot use Graph Explorer yet in GCC-High. (Any idea when that will change?)

[c-baumgartner]

This issue is still open and I am curious if the root was solved or at least a reason was found.

I am facing the same issue that the exception handling is not able to give me a clear error while trying to get all users from an AAD tenant. Running the export with -Verbose only shows me

VERBOSE: GET https://graph.microsoft.com/beta/users?expand=extensions&$count=true&$skiptoken=m~AQAnO2U5Z4OzswOzA7 with 0-byte payload
VERBOSE: received 542616-byte response of content type application/json

So I don't know the reason why it is failing after ~300 GET commands.

[merill]

I have fixed the error handling to provide more detailed messages.

Can you please retry and let me know if you are still seeing this issue?