An endpoint contract comes before a module command

An endpoint contract comes before a module command

For a Microsoft Graph request, identify resource path, operation, access mode, required permission and expected response shape. Installing the SDK does not grant authorization. Delegated and application access are different contexts; a user sign-in in a browser is not evidence for an unattended collector.

This course's fixture simulates Graph-shaped pages. It deliberately avoids tenant access, credentials and consent. Use it to learn control flow and failure handling before adapting a collector to a documented endpoint. Record collection scope so a later report does not treat a filtered result as an organization-wide inventory.

Reasoning model

An API report is complete only when every required page has been retrieved successfully under a known filter and permission scope. A successful first response is not a complete inventory. Follow the service-provided continuation mechanism rather than reconstructing offsets. A retry loop needs bounds and must distinguish transient throttling from persistent authorization failure. Record completion state so a partial report cannot masquerade as an empty or final inventory.

Official reference for further study

Follow the chain without redefining completeness

$ErrorActionPreference = 'Stop'
$pages = @{
    'page-1' = @{value=@([pscustomobject]@{id='1';displayName='Ana'});'@odata.nextLink'='page-2'}
    'page-2' = @{value=@([pscustomobject]@{id='2';displayName='Ben'});'@odata.nextLink'=$null}
}
function Read-FixturePages {
    param([hashtable]$Pages,[string]$First)
    $seen = [System.Collections.Generic.HashSet[string]]::new()
    $url = $First
    $items = [System.Collections.Generic.List[object]]::new()
    while ($url) {
        if (-not $seen.Add($url)) { throw 'Repeated page link' }
        if (-not $Pages.ContainsKey($url)) { throw 'Missing page response' }
        $page = $Pages[$url]
        foreach ($item in $page.value) { $items.Add($item) }
        $url = $page['@odata.nextLink']
    }
    return $items.ToArray()
}
$result = @(Read-FixturePages -Pages $pages -First 'page-1')
$result | Select-Object id,displayName | Format-Table
if (($result.id -join ',') -ne '1,2') { throw 'Pagination test failed' }

Follow the chain without redefining completeness

Microsoft Graph can return an @odata.nextLink for another page. A page's HTTP success is not the same as a complete collection. In the offline fixture, page-1 yields Ana and points to page-2, which yields Ben and terminates. The expected population is two records.

Now make the second page empty but retain a valid subsequent link to a third page. Empty page content is not a universal end condition; the pagination contract determines continuation. For a real adapter, use supported next links, preserve required headers, bound work and validate destinations before forwarding credentials. Provider paging behavior varies by endpoint.

Evidence laboratory — attempt before reading the solution

A mocked directory API returns page 1 with users U1,U2 and next link N2. The first N2 request returns 429 with Retry-After 3 seconds; the approved test harness then returns U3,U4 and next link N3. N3 returns U5 and no continuation. A faulty script stops after page 1 and labels its output “all users.” Trace the correct sequence, expected unique-user count and the completion flag. All responses here are fixtures; no live tenant call is required.

Official reference for further study

Exercise: a failed middle page

# Local sample: no connection required
$users = @([pscustomobject]@{
 DisplayName='Ana Example'; UserPrincipalName='ana@example.test'
})
$users | Select-Object DisplayName, UserPrincipalName
# Optional live pattern: after approved SDK install and permission review
# Connect-MgGraph -Scopes 'User.ReadBasic.All'
# Get-MgUser -All -Property DisplayName,UserPrincipalName |
#   Select-Object DisplayName,UserPrincipalName
# Disconnect-MgGraph

Exercise: a failed middle page

The first page contains 100 users and the second request receives a throttling response with a Retry-After value. The report deadline is sooner than the required wait. What should the collector publish?

Worked laboratory solution

Official reference for further study

Workbook already downloaded

Collector acceptance tests

Collector acceptance tests

Exercise a normal chain, terminal empty result, missing page, repeated link, malformed item and bounded-retry exhaustion. Define a stable identity and reject contradictory duplicates under your chosen contract. Distinguish “collected zero items completely” from “collected nothing because authentication failed.”

Deliver the scope, endpoint/version plan, permission justification, sanitized error references and collection status. A production adapter also needs secret handling and redirect/destination review. The learner project remains offline unless an explicitly authorized tenant lab is separately arranged; no live Graph execution is claimed by these fixtures.

Transfer project — changed conditions

Implement a mock page-fetch function and test normal pagination, a repeated next link, retry exhaustion and a duplicated user across pages. Decide whether the report needs unique identities or raw records and document your deduplication key. Add a permission review showing the exact read operation and the least-privilege documented authorization for the chosen mode. Keep secrets and raw tokens out of logs.

Practical assessment rubric

Score each dimension 0–2: 0 = absent or materially incorrect; 1 = partly correct with an unresolved gap; 2 = correct, explicit and supported by the supplied evidence or an actual labeled lab result.

1. Evidence/model: identify the relevant entities, inputs, assumptions and boundaries without inventing facts.
2. Main result: derive the case-specific expected result, calculation or decision and show the intermediate reasoning.
3. Failure/boundary: test the changed condition and explain why the original conclusion does or does not transfer.
4. Verification: supply reproducible steps and expected/observed results; label manual traces as manual, not executed.
5. Communication/safety: explain limitations, owners and a proportionate next action without unsafe or unnecessary access.

Target: at least 8/10, with no zero in main result or communication/safety. This is a local learning rubric, not an accredited certification standard. A written/manual solution demonstrates reasoning only; operational competence additionally requires the relevant executable lab in an authorized environment. The native multiple-choice score is separate and does not automatically grade this rubric.

Submission template

• My input/evidence and assumptions:
• Expected result with calculations or trace:
• My implementation/decision and justification:
• Changed-condition result:
• Observed execution, or explicitly labeled manual trace:
• Failure and recovery evidence:
• Unverified limitation and next action:
• Self-score with evidence for each dimension:

Remediation

If the main result is wrong, reconstruct the supplied case from the raw inputs before changing code or controls. If the boundary case is wrong, identify the assumption that changed and rerun both the original and changed case. If verification is missing, do not convert a prediction into an observed result. Reattempt the transfer task without copying the worked solution, then explain it to another person.

Official reference for further study

Assessment: explain your decisions

Choose an answer and write your reason before opening each explanation. Then explain why the other choices do not fit the evidence. Use missed questions to revisit the lesson. This knowledge check is only one part of assessment: complete the practical transfer project as well. It does not predict certification-exam success.

1. Which permission direction fits basic inventory?

1. Documented minimum read access
2. Directory-wide write by default
3. A copied admin token

2. Does one successful response establish complete inventory?

1. Always
2. No; pagination and scope matter
3. Only if formatted

3. Which should be excluded from debug logs?

1. Row count
2. Error category
3. Raw access token

4. A Graph-shaped page is empty but has a supported nextLink. Is collection necessarily complete?

1. No; follow the paging contract
2. Yes, empty always means end
3. Yes, if the first request succeeded

5. A required Retry-After exceeds this job’s budget. What should it do?

1. Publish the first page as the entire directory
2. Defer or report incomplete rather than retry too early or claim completeness
3. Ignore the delay

6. The next page repeats a previously visited link. What should the fixture do?

1. Silently declare completion
2. Repeat forever until the service changes
3. Stop with an explicit loop error

7. When can the fixture report be labeled complete?

1. After N3 succeeds and supplies no continuation.
2. After the first HTTP success.
3. As soon as two users are displayed.

8. What is the expected unique-user count?

1. Four because throttling discards page 2.
2. Five.
3. Two.

9. Retries exhaust at N2. What should the report say?

1. All users: two.
2. No users exist.
3. Partial/incomplete with the error and collected rows clearly identified.

Use the explained questions above for offline practice. A scored attempt requires the course assessment on CogniSkill.ca.

Optional deeper study

If you want a longer learning path, inspect the related CogniSkill SC-300 books in the existing book panel. Choose by the book’s actual scope and edition. The exercises, downloads and answers in this course are complete without purchase.