Microsoft Graph PowerShell modules returns different results than Graph Explorer

Question

I have Microsoft.Graph.* PowerShell Modules v2.35.1 installed and I'm running the following:

Connect-MgGraph -Scopes 'Groups.Read.All'
Get-MgGroup -GroupId xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx | FL

The response shows no value for AllowExternalSenders:

AllowExternalSenders :

But, when I enter following query in Graph Explorer

https://graph.microsoft.com/v1.0/groups/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx$select=allowExternalSenders

it shows the value is set to true:

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#groups(allowExternalSenders)/$entity",
    "id": "xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "allowExternalSenders": true
}

Answer 1

Our lovely AI assistant almost got it right this time. The root cause is correct - since the AllowExternalSenders property is not returned by default, you must specifically request it, and the way to do that in PowerShell is via the -Property parameter. You still have to add it to the select statement afterwards though, and the same applies to any additional properties you might want to include:

Get-MgGroup -GroupId xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx -Property allowExternalSenders | select allowExternalSenders

Get-MgGroup -GroupId xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx -Property displayName,allowExternalSenders | select displayNameallowExternalSenders

Alternatively, you can use the "beta" module/cmdlets, as they return all properties by default.

Answer 2

The discrepancy you're experiencing between the Microsoft Graph PowerShell module and Graph Explorer regarding the AllowExternalSenders property could be due to several factors:

1. Permissions: Ensure that the permissions granted to the PowerShell session are sufficient to access all properties of the group. The Groups.Read.All permission should generally allow you to read group properties, but it's worth double-checking that the token used in PowerShell has the necessary scopes.
2. Version Differences: The PowerShell module and Graph Explorer may be using different versions of the Microsoft Graph API. The PowerShell module might not yet reflect the latest changes or properties available in the API.
3. Default Properties Returned: The PowerShell command may return a subset of properties by default. To retrieve additional properties, you might need to use a $select parameter in your PowerShell command as well, similar to how you did in Graph Explorer.

To troubleshoot further, you can try the following in PowerShell:

Get-MgGroup -GroupId xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx -Property "allowExternalSenders"

This command explicitly requests the allowExternalSenders property, which may help in retrieving the correct value.

If the issue persists, consider checking for updates to the PowerShell module or reviewing the Microsoft documentation for any known issues related to this property.

---

References:

• New-MgGroup
• Update-MgGroupByUniqueName