SOLVED

Microsoft Graph Filter by specific Domain Name

%3CLINGO-SUB%20id%3D%22lingo-sub-1101684%22%20slang%3D%22en-US%22%3EMicrosoft%20Graph%20Filter%20by%20specific%20Domain%20Name%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1101684%22%20slang%3D%22en-US%22%3E%3CUL%3E%3CLI%3EI%20have%20over%2020000%20users%20and%20we%20have%20four%20sub-domain.%3C%2FLI%3E%3CLI%3EI'm%20trying%20reduce%20the%20results%20when%20making%20a%20Graph%20call%20by%20only%20calling%20those%20users%20with%20a%20specific%20userPrincipalName%20sub-domain.%3C%2FLI%3E%3C%2FUL%3E%3CP%3EWhen%20I%20execute%20the%20query%20it's%20return%20all%20users%20that%20has%20the%20main%20domain%20name%20(maindomain.net)%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EQuestion%3A%20How%20can%20I%20execute%20a%20graph%20call%20and%20return%20only%20users%20with%20specific%20sub-domain%20along%20with%20the%20other%20filters.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%24uri%20%3D%20%22%3CA%20href%3D%22https%3A%2F%2Fgraph.microsoft.com%2Fv1.0%2FauditLogs%2FsignIns%3F%24filter%3DappDisplayName%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgraph.microsoft.com%2Fv1.0%2FauditLogs%2FsignIns%3F%24filter%3DappDisplayName%3C%2FA%3E%20eq%20'Windows%20Sign%20In'%20AND%20deviceDetail%2FoperatingSystem%20eq%20'Windows'%20AND%20createdDateTime%20ge%20%24CurrentDate%20AND%20endwith(userPrincipalName%2C'%40group.maindomain.net')%20%26amp%3B%24Top%3D1000%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20You%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E-Larry%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1101684%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMicrosoft%20Graph%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1102139%22%20slang%3D%22en-US%22%3ERe%3A%20Microsoft%20Graph%20Filter%20by%20specific%20Domain%20Name%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1102139%22%20slang%3D%22en-US%22%3EI%20just%20tested%20this%20query%20and%20this%20works%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fgraph.microsoft.com%2Fv1.0%2Fauditlogs%2Fsignins%3Ffilter%3Dendswith(userPrincipalName%2C%26quot%3Bdomainxxx.onmicrosoft.com%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgraph.microsoft.com%2Fv1.0%2Fauditlogs%2Fsignins%3Ffilter%3Dendswith(userPrincipalName%2C%22domainxxx.onmicrosoft.com%3C%2FA%3E%22)%3CBR%20%2F%3E%3CBR%20%2F%3EI%20see%20you%20have%20'endwith'%2C%20without%20the%20s.%20That%20might%20be%20the%20problem%3F%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1102178%22%20slang%3D%22en-US%22%3ERe%3A%20Microsoft%20Graph%20Filter%20by%20specific%20Domain%20Name%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1102178%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3B%20Thank%20you%20for%20responding%2C%20I've%20added%20the%20%22S%22%20and%20still%20not%20working.%20Also%2C%20I%20moved%20the%20endswith%20at%20the%20beginning%20of%20the%20URL.%20Sorry%20to%20say%20I%20can't%20use%20the%20onmicrosoft.com%20address%2C%20it%20doesn't%20have%20the%20sub-domain%20attached%20to%20the%20onmicrosoft.com%20address%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAll%20the%20other%20filters%20is%20working%20just%20that%20one%20filter%20I'm%20having%20the%20issue.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%24uri%20%3D%20%22%3CA%20href%3D%22https%3A%2F%2Fgraph.microsoft.com%2Fv1.0%2FauditLogs%2FsignIns%3F%24filter%3Dendswith(userPrincipalName%2C'southeast.xxxxxxxxxxxx.org%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgraph.microsoft.com%2Fv1.0%2FauditLogs%2FsignIns%3F%24filter%3Dendswith(userPrincipalName%2C'southeast.xxxxxxxxxxxx.org%3C%2FA%3E')%20AND%20appDisplayName%20eq%20'Windows%20Sign%20In'%20AND%20deviceDetail%2FoperatingSystem%20eq%20'Windows'%20AND%20createdDateTime%20ge%20%24CurrentDate%20%26amp%3B%24Top%3D1000%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20You%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E-Larry%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1102185%22%20slang%3D%22en-US%22%3ERe%3A%20Microsoft%20Graph%20Filter%20by%20specific%20Domain%20Name%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1102185%22%20slang%3D%22en-US%22%3ECould%20you%20try%20it%20with%20just%20the%20filter%20on%20the%20UPN%20and%20check%20what%20that%20gives%20you%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1102193%22%20slang%3D%22en-US%22%3ERe%3A%20Microsoft%20Graph%20Filter%20by%20specific%20Domain%20Name%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1102193%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3BThank%20you%20again....%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Estill%20getting%20the%20same%20results%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%24uri%20%3D%20%22%3CA%20href%3D%22https%3A%2F%2Fgraph.microsoft.com%2Fv1.0%2FauditLogs%2FsignIns%3F%24filter%3Dendswith(userPrincipalName%2C'southeast.xxxxxxxxxxxx.org%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgraph.microsoft.com%2Fv1.0%2FauditLogs%2FsignIns%3F%24filter%3Dendswith(userPrincipalName%2C'southeast.xxxxxxxxxxxx.org%3C%2FA%3E')%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E-Larry%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1102275%22%20slang%3D%22en-US%22%3ERe%3A%20Microsoft%20Graph%20Filter%20by%20specific%20Domain%20Name%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1102275%22%20slang%3D%22en-US%22%3E%3CP%3EAs%20noted%20in%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fgraph%2Fapi%2Fsignin-list%3Fview%3Dgraph-rest-1.0%26amp%3Btabs%3Dhttp%23attributes-supported-by-filter-parameter%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Edocumentation%3C%2FA%3E%2C%20only%20startswith%20and%20eq%20operators%20are%20supported%20for%20userPrincipalName.%20Welcome%20to%20the%20wonderful%20world%20of%20crappy%20oData%20filtering...%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor
  • I have over 20000 users and we have four sub-domain.
  • I'm trying reduce the results when making a Graph call by only calling those users with a specific userPrincipalName sub-domain.

When I execute the query it's return all users that has the main domain and the users that has sub-domain. 

 

Question: How can I execute a graph call and return only users with specific sub-domain along with the other filters.

 

$uri = "https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=appDisplayName eq 'Windows Sign In' AND deviceDetail/operatingSystem eq 'Windows' AND createdDateTime ge $CurrentDate AND endwith(userPrincipalName,'@group.maindomain.net') &$Top=1000"

 

Thank You,

 

-Larry

5 Replies
Highlighted
I just tested this query and this works:
https://graph.microsoft.com/v1.0/auditlogs/signins?filter=endswith(userPrincipalName,"domainxxx.onmi...")

I see you have 'endwith', without the s. That might be the problem?
Highlighted

@Thijs Lecomte  Thank you for responding, I've added the "S" and still not working. Also, I moved the endswith at the beginning of the URL. Sorry to say I can't use the onmicrosoft.com address, it doesn't have the sub-domain attached to the onmicrosoft.com address 

 

All the other filters is working just that one filter I'm having the issue.

 

$uri = "https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=endswith(userPrincipalName,'southeast.xxx...') AND appDisplayName eq 'Windows Sign In' AND deviceDetail/operatingSystem eq 'Windows' AND createdDateTime ge $CurrentDate &$Top=1000"

 

Thank You,

 

-Larry

Highlighted
Could you try it with just the filter on the UPN and check what that gives you?
Highlighted
Highlighted
Best Response confirmed by Larry Jones (Contributor)
Solution

As noted in the documentation, only startswith and eq operators are supported for userPrincipalName. Welcome to the wonderful world of crappy oData filtering...