Forum Discussion

Iron Contributor

Jan 10, 2020

Solved

Microsoft Graph Filter by specific Domain Name

I have over 20000 users and we have four sub-domain. I'm trying reduce the results when making a Graph call by only calling those users with a specific userPrincipalName sub-domain. When I execut...

Azure Active Directory (AAD)

VasilMichev
Jan 10, 2020
As noted in the documentation, only startswith and eq operators are supported for userPrincipalName. Welcome to the wonderful world of crappy oData filtering...

Thijs Lecomte

Bronze Contributor

Jan 10, 2020

I just tested this query and this works:
https://graph.microsoft.com/v1.0/auditlogs/signins?filter=endswith(userPrincipalName,"domainxxx.onmicrosoft.com")

I see you have 'endwith', without the s. That might be the problem?

EntilZha

Iron Contributor

Jan 10, 2020

Thijs Lecomte Thank you for responding, I've added the "S" and still not working. Also, I moved the endswith at the beginning of the URL. Sorry to say I can't use the onmicrosoft.com address, it doesn't have the sub-domain attached to the onmicrosoft.com address

All the other filters is working just that one filter I'm having the issue.

$uri = "https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=endswith(userPrincipalName,'southeast.xxxxxxxxxxxx.org') AND appDisplayName eq 'Windows Sign In' AND deviceDetail/operatingSystem eq 'Windows' AND createdDateTime ge $CurrentDate &$Top=1000"

Thank You,

-Larry

Thijs Lecomte
Bronze Contributor
Jan 10, 2020
Could you try it with just the filter on the UPN and check what that gives you?
- EntilZha
  Iron Contributor
  Jan 10, 2020
  Thijs Lecomte Thank you again....
  
  still getting the same results
  
  $uri = "https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=endswith(userPrincipalName,'southeast.xxxxxxxxxxxx.org')"
  
  -Larry