MsOnline PowerShell Module retirement - replacement for Get-MsolUser Errors cmd

Question

MsOnline PowerShell Module retirement - replacement for Get-MsolUser Errors cmd

mark terry 185

Hi all,

We have used the MSonline PowerShell module in the past (specifically the Get-MsolUser command) to gather errors for cloud based users. The example command we have used is below:

***(Get-MsolUser -UserPrincipalName ***@test.com).Errors.ErrorDetail.ObjectErrors.ErrorRecord.ErrorDescription | fl

MSFT are discontinuing support for the MSOnline PowerShell module. Does anyone know of a way to get this error information other than by using MSOnline PowerShell?

Thanks!

Accepted answer

0 additional answers

Your answer

Answer 1

Vasil Michev 119.5K MVP Volunteer Moderator

There are several replacements, depending on the type of error. For "provisioning" errors, you can use the serviceProvisioningErrors property on the user resource:

GET https://graph.microsoft.com/beta/users?$select=id,userPrincipalName,serviceProvisioningErrors

The other property you might be interested in is onPremisesProvisioningErrors. Sadly, no filtering seems to be supported on any of these currently, so we don't have the equivalent of:

Get-MsolUser -HasErrorsOnly

If you are interested in more details, I published an article on this back in the day: https://www.michev.info/blog/post/5602/reporting-on-user-provisioning-errors-via-the-graph-api

mark terry 185

Hi Vasil. Thanks for the response! I don't have any experience with Graph, but when I tried the script you provided in your article (running from a PowerShell ISE Window), I get the error below. Any more information on this would be great!

PS D:\> $uri = 'https://graph.microsoft.com/beta/users?$select=id,userPrincipalName,serviceProvisioningErrors'
$Gr = Invoke-WebRequest -Headers $AuthHeader1 -Uri $uri -Verbose -Debug
$result = ($gr.Content | ConvertFrom-Json).value
 
#Filter only the users with errors
$Err = $result | ? {$_.serviceProvisioningErrors}
 
#Human-readable output
$Err | select userPrincipalName, @{n="Errors";e={ ([[xml]]$_.serviceProvisioningErrors.errorDetail).ServiceInstance.ObjectErrors.ErrorRecord.ErrorDescription } }
 
At line:9 char:53
+ $Err | select userPrincipalName, @{n="Errors";e={ ([[xml]]$_.serviceP ...
+                                                     ~
Missing type name after '['.
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : MissingTypename

Vasil Michev 119.5K MVP Volunteer Moderator

Apologies, the article assumes that you are familiar with the Graph API and know how to handle the authentication bits.

You can just use the Graph SDK for PowerShell instead:

Connect-MgGraph -Scopes User.Read.All

$result = Get-MgUser -All -Property id,userPrincipalName,serviceProvisioningErrors | select id,userPrincipalName,serviceProvisioningErrors

$Err = $result | ? {$_.serviceProvisioningErrors}
$Err | fl userPrincipalName, @{n="Errors";e={ ([xml]$_.ServiceProvisioningErrors.AdditionalProperties.errorDetail).ServiceInstance.ObjectErrors.ErrorRecord.ErrorDescription } }

mark terry 185 Reputation points

2025-03-10T20:55:02.3333333+00:00
Hi Vasil,

Not sure if that is working. This is what I get when I run the "old" Get-MSOlUser method on the specific user I am troubleshooting. Note, that it returns an error indicating that the mailbox can't be disabled because of the related Exchange Org wide Retention Policy:

(Get-MsolUser -UserPrincipalName ******@test.com).Errors.ErrorDetail.ObjectErrors.ErrorRecord.ErrorDescription | fl

text : {Exchange can't disable the mailbox "user1" because it is on In-Place Hold. ComplianceTagHoldApplied: false, DelayHoldApplied: false, DelayReleaseHoldApplied: false, OrganizationPolicies Applied: mbxd73505e824084a6ca289a4aa1d202c50:2, UserPolicies Applied: , restrictivePolicies Applied: . For more information, please see the PowerShell cmdlets, Get-OrganizationConfig , <, >, |fl inplace*, and Get-Mailbox ...}

If I use your method (substituting Get-MgUser -All with **Get-MgUser -UserId ****@test.com), it does not return any data at all.

Any more thoughts or fab ideas would be welcome!

Vasil Michev 119.5K MVP Volunteer Moderator

I am able to get users with the exact same error using the method above:

UserPrincipalName : ******@michev.info
Errors            : {Exchange can't disable the mailbox "vasilUS" because it is on In-Place Hold. ComplianceTagHoldApplied: false, DelayHoldApplied: false, DelayReleaseHoldApplied: false,
                    OrganizationPolicies Applied: mbx6590cabc176344cba96d8fae0188764d:2, UserPolicies Applied: , restrictivePolicies Applied: . For more information, please see the PowerShell
                    cmdlets, Get-OrganizationConfig <>|fl inplace*, and Get-Mailbox <>|fl compl*,delay*,inplace*, Exchange can't disable the mailbox "vasilUS" because it is on In-Place Hold.
                    ComplianceTagHoldApplied: false, DelayHoldApplied: false, DelayReleaseHoldApplied: false, OrganizationPolicies Applied: mbx6590cabc176344cba96d8fae0188764d:2, UserPolicies
                    Applied: , restrictivePolicies Applied: . For more information, please see the PowerShell cmdlets, Get-OrganizationConfig <>|fl inplace*, and Get-Mailbox <>|fl
                    compl*,delay*,inplace*}

If it's not working for you, check the permissions on the user you're running it with, and make sure consent has been granted to the User.Read.All scope.

mark terry 185 Reputation points

2025-03-11T15:30:13.1733333+00:00

Hi Vasil. I think I figured out why I was not getting any results. I found someone else who had the same issue (https://learn.microsoft.com/en-us/answers/questions/2181726/msoluer-to-graph-cmd). It looks like one needs to use the get-mgbetauser cmdlet to extract this info.

Thanks for helping me track this down. Much appreciated!
Vasil Michev 119.5K Reputation points MVP Volunteer Moderator

2025-03-11T16:29:19.3333333+00:00

That might depend on the Graph module version you're on, the serviceProvisioningErrors property is exposed on both /v1.0 and /beta endpoints. Anyway, glad you got it sorted.
Raja Pothuraju 23,465 Reputation points Microsoft External Staff Moderator

2025-03-17T10:02:09.5433333+00:00

Hello @mark terry,

If all your concerns have been resolved, I would greatly appreciate it if you could mark the answer as "Accepted." This helps both us and others in the community.

Share via

MsOnline PowerShell Module retirement - replacement for Get-MsolUser Errors cmd

0 additional answers

Your answer