Exercise: a failed middle page

Change the evidence

Separate live permissions

For a possible users report, locate the endpoint’s current permissions and supported properties in official documentation. Distinguish delegated access, where a signed-in user’s context is involved, from application access. Do not guess a broader scope to make a failed request succeed.

Plan rate-limit handling

A 429 is not an empty page. A live collector should honour the service’s retry guidance, bound the retries, and mark a run failed when the retry budget is exhausted. Retrying every error identically may repeat authorization failures indefinitely.

Specify the report boundary

Add a collected-at timestamp, record count, page count, requested properties and completeness flag. A reviewer should be able to see whether the result came from a complete collection rather than infer completeness from a polished CSV.

Diagnose failures

The report always contains the first hundred records

Check whether the collector follows next-links rather than assuming one response is complete. A service page limit is not the size of the tenant.

The collector gets forbidden and returns no users

Authorization failure is not an empty directory. Preserve the error and review endpoint permission, token context and consent.

Retrying creates an infinite run

Use bounded retries and a page-loop guard. The recovery rule must terminate and report failure when it cannot satisfy the collection contract.

A second worked example

# Local sample: no connection required
$users = @([pscustomobject]@{
 DisplayName='Ana Example'; UserPrincipalName='ana@example.test'
})
$users | Select-Object DisplayName, UserPrincipalName
# Optional live pattern: after approved SDK install and permission review
# Connect-MgGraph -Scopes 'User.ReadBasic.All'
# Get-MgUser -All -Property DisplayName,UserPrincipalName |
#   Select-Object DisplayName,UserPrincipalName
# Disconnect-MgGraph

The local section proves projection of sample properties, not live permissions. The commented pattern shows the relationship between sign-in, retrieval and output. Verify current consent and endpoint requirements before running it in an authorized tenant. -All requests all pages supported by that cmdlet; selecting fields also limits what you retain in the report.

Transfer exercise

A report has exactly one page of users. What evidence should you inspect before concluding that this is the entire directory?

Worked transfer answer

Inspect paging behavior, applied filters, permission scope and any errors. Compare the intended population with an approved independent count. A successful first page is not proof of completeness. Never log access tokens to debug the mismatch.