Get-MgGroupMember for large Group

[BohrenAn]

Hi there, i've got a very large AAD Group with 35'392 Members

$Group = Get-MgGroup -Filter "DisplayName eq 'DG_MDM_MDS'
$Members = Get-MgGroupMember -GroupId $Group.Id -All

After a while the PowerShell Window get's closed.

Or i get this Error in Windows Terminal
$Group = Get-MgGroup -Filter "DisplayName eq 'DG_MDM_MDS'"
$Members = Get-MgGroupMember -GroupId $Group.Id -All -Property UserPrincipalName,OnPremisesSamAccountName,UserType,AccountEnabled

Process is terminated due to StackOverflowException.
[Verarbeitung des Prozesses mit Code 3221225725 beendet]

I could do Paging, but the max is 999 Members.
$Members = Get-MgGroupMember -GroupId $Group.Id -PageSize 999

How do i know, that there are more Members available and page through the next paging batch?
Skip Parameter did not work - if that was the way to go to the next Page

PS C:> $Group = Get-MgGroup -Filter "DisplayName eq 'AAD-IcewolfUsers'"
PS C:> $Members = Get-MgGroupMember -GroupId $Group.Id -PageSize 3 -skip 0
Get-MgGroupMember : '$skip' is not supported by the service.
In Zeile:1 Zeichen:1

• $Members = Get-MgGroupMember -GroupId $Group.Id -PageSize 3 -skip 0

•   + CategoryInfo          : InvalidOperation: ({ GroupId = d59...ndProperty =  }:<>f__AnonymousType27`9) [Get-MgGrou
   pMember_List3], RestException`1
    + FullyQualifiedErrorId : Request_BadRequest,Microsoft.Graph.PowerShell.Cmdlets.GetMgGroupMember_List3
  
  

Regards
Andres

[peombwa]

@BohrenAn, which version of PowerShell are you using? Please share the output of the following with us:

Environment

• $PSVersionTable
• $host.CurrentCulture

Modules

• Get-Module microsoft.graph -ListAvailable

Also, all directory object APIs do not support OData $skip, see https://docs.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0&tabs=http#optional-query-parameters.

[BohrenAn]

PS C:> $PSVersionTable

Name Value

---

PSVersion 5.1.22000.282
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.22000.282
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

PS C:> $host.CurrentCulture

LCID Name DisplayName

---

2055 de-CH Deutsch (Schweiz)

PS C:> Get-Module microsoft.graph -ListAvailable
Verzeichnis: C:\Program Files\WindowsPowerShell\Modules
ModuleType Version Name ExportedCommands

---

Manifest 1.9.0 Microsoft.Graph

The Error happens in the 1.8.0 and 1.9.0

Also, all directory object APIs do not support OData $skip, see https://docs.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0&tabs=http#optional-query-parameters

Why do you provide that parameter then?
https://docs.microsoft.com/en-us/powershell/module/microsoft.graph.groups/get-mggroupmember?view=graph-powershell-1.0
Get-MgGroupMember
-GroupId
[-ExpandProperty <String[]>]
[-Filter ]
[-Property <String[]>]
[-Search ]
[-Skip ]
[-Sort <String[]>]
[-Top ]
[-PageSize ]
[-All]
[-CountVariable ]
[]

Regards
Andres

[peombwa]

Thanks for the info!

This sounds like a memory exhaustion issue since you are holding 35k+ directory objects in memory at once.

You can process the members in batches without holding them in memory. Please note that Get-MgGroup -All fetches pages asynchronously (we return data pages to the caller via the pipeline as soon as they are ready, as opposed to bottlenecking the entire collection in memory and returning it only once it has all been retrieved). You can pipe the asynchronously fetched members to your action without holding them in a variable. i.e.,

$Group = Get-MgGroup -Filter "DisplayName eq 'DG_MDM_MDS'"
Get-MgGroupMember -GroupId $Group.Id -All | %{
    # Do action without holding members in a variable.
    $_.Id
}

We cannot hide -Skip because the metadata that the SDK is generated from isn't annotated to tell us which OData query parameter an API supports. The workload owners are working on this.

[BohrenAn]

Hi Peter,
I've tried again. I get an "StackOverflowException" and still have plenty of RAM available. The used RAM for the Powershell Process never exeeds 300 MB.
I am running a Computer with 64GB RAM and using PowerShell 5.1 (x64 Version).

############################################################################

MS Graph Module

This time not saved to a Variable. Instead piped to the Measure Command

############################################################################
PS C:> Import-Module Microsoft.Graph.Authentication
PS C:> Import-Module Microsoft.Graph.Groups
PS C:> Import-Module Microsoft.Graph.Users
PS C:> Connect-MgGraph -ClientID $AppID -TenantId $TenantID -CertificateThumbprint $CertificateThumbprint
Welcome To Microsoft Graph!
PS C:> $Group = Get-MgGroup -Filter "DisplayName eq 'DG_MDM_MDS'"
PS C:> Get-MgGroupMember -GroupId $Group.Id -All -Property UserPrincipalName,OnPremisesSamAccountName,UserType,AccountEnabled | measure

Process is terminated due to StackOverflowException.

C:>

############################################################################

Azure AD Module

I am able to get all Members, store them in a Variable and process them

############################################################################
PS C:> $Members = Get-AzureADGroupMember -ObjectId 1b597422-ee98-41a6-967e-944e69cb415b -All:$true
PS C:> $Members | measure

Count : 35993
Average :
Sum :
Maximum :
Minimum :
Property :

PS C:> $PS = Get-Process -Name PowerShell
PS C:> $ps

Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName

---

1482 81 1135784 1187612 37.09 16704 1 powershell

PS C:> 1135784/1024
1109.1640625
#This used about 1.1 GB of RAM

Regards
Andres

[peombwa]

Could you try running the same script in PowerShell 7? I'm not able to repro this in my tenant with 2k users.

Let me see if I can repro this in a group with more users.

[BohrenAn]

Can confirm it works in PowerShell 7.2