MDE List Machine API Results Discrepancy

Wong, Vincent 0

I'm currently using the MDE List Machine API to pull device information for my logic app to populate an excel file. I am able to create an excel file and populate it with most device information using the logic app, however when i compare the results to the results if i manually export the Computers and Mobile device list from the MDE Device Inventory, I notice that the logic app file is showing 2500 less devices. Why is this happening? Both files are filtering for the same values and are being pulled on the same weekly time frame. I am also removing duplicate values by device name from both. Does the API and manual export pull devices differently?

MayankBargali-MSFT 70,016 Reputation points

2024-03-26T02:35:30.8966667+00:00

@Wong, Vincent Thanks for reaching out. Can you please confirm which API you are referring to? It would be great if you could share the reference document of the API endpoint that you are calling from your HTTP action or the connector action reference document.

I am not sure if you are referring to Defender endpoint API? Do you see nextlink parameter in the response that has the link to get the next page set of devices that could be returned?
Wong, Vincent 0 Reputation points

2024-03-26T15:10:54.69+00:00

That's right I'm referring to this List Machines API: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api/get-machines?view=o365-worldwideThere are around 27,000 devices in my organization, so i have 3 separate API calls in my logic app that each pull 10,000 entries. So the first API would include $top=10,000&$skip=0, the next API would include $top=10,000&$skip=10000, and the last API would include $top=10,000&$skip=20000. My logic app produces 24,000 device results in the excel file, which is around 3000 less than what's expected. If my logic app is truly pulling all devices possible, I'm not sure why there's still a discrepancy.
MayankBargali-MSFT 70,016 Reputation points

2024-03-27T02:38:01.6833333+00:00

@Wong, Vincent Thanks for your response. Can you test your last API which include $top=10,000&$skip=20000 outside the logic app using fiddler, postman or any REST tool so we can confirm if the API itself result the less result or there in case the API return the right result but your excel doesn't have the right data. You can also review the run history of your logic app to validate what was the return data from your last API execution. Can you please also confirm what is the action you are using and how you are storing the data to excel (one row at a time or in one shoot) and the screenshot would help to understand your workflow better.

Share via

MDE List Machine API Results Discrepancy