/flags/microsoft-graph/get-mguser-all
Get-MgUser -All: return every user, not just the first 100
- tool
- Microsoft Graph PowerShell
- command
- Get-MgUser
- flag
- -All
- default
- off (only the first page is returned: 100 users by default)
Get-MgUser -All returns every user that matches the request. Microsoft Graph returns lists in pages, and without -All the cmdlet stops after the first page. For users the Graph API documents "The default and maximum page sizes are 100 and 999 user objects respectively" (with lower limits when you select signInActivity). In any tenant with more than 100 users, a report without -All is incomplete.
Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -All | Measure-Object
Get-MgUser -All -PageSize 999 -Property Id, DisplayName, UserPrincipalName, AccountEnabled |
Select-Object DisplayName, UserPrincipalName, AccountEnabled
Get-MgUser -All -Filter "accountEnabled eq false"Parameter sets
-All, -Top, -PageSize, -Filter and -ConsistencyLevel belong to the List parameter set; -UserId selects a single user in another set. Checked offline in Windows PowerShell 5.1 with Microsoft.Graph.Users 2.41.2:
Import-Module Microsoft.Graph.Users
$c = Get-Command Get-MgUser
foreach ($n in 'All', 'Top', 'PageSize', 'UserId') {
'{0}: {1}, sets {2}' -f $n, $c.Parameters[$n].ParameterType.Name, (($c.Parameters[$n].ParameterSets.Keys | Sort-Object) -join ', ')
}
try { Get-MgUser -UserId anna@contoso.com -All -ErrorAction Stop } catch { $_.Exception.Message }
try { Get-MgUser -All -ErrorAction Stop } catch { $_.Exception.Message }Output
All: SwitchParameter, sets List Top: Int32, sets List PageSize: Int32, sets List UserId: String, sets Get Parameter set cannot be resolved using the specified named parameters. Authentication needed. Please call Connect-MgGraph.
The last two lines show the two usual errors: mixing sets gives Parameter set cannot be resolved, and a valid call without a session gives Authentication needed. Please call Connect-MgGraph.
-All, -Top and -PageSize
| Parameter | Effect | Example |
|---|---|---|
| (none) | first page only (100 users by default) | Get-MgUser |
| -All | every page until the end | Get-MgUser -All |
| -Top N | only the first N users | Get-MgUser -Top 10 |
| -PageSize N | users per request; fewer round trips with -All | Get-MgUser -All -PageSize 999 |
| -Filter / -Search | narrow the result on the server | Get-MgUser -All -Filter "userType eq 'Guest'" |
| -CountVariable + -ConsistencyLevel eventual | total count, advanced queries | see -ConsistencyLevel eventual |
Pitfalls
- Properties.
-Alldoes not add properties: the default set (displayName, mail, userPrincipalName, id and a few more) is still all you get; request others with-Property(Get-MgUser -Property). - Throttling. Very large tenants with
-Alland a small page size send many requests; use-PageSize 999and only the properties you need. - Advanced filters. Filters such as
endsWithneed-ConsistencyLevel eventualwith-CountVariable(-ConsistencyLevel eventual). - Permissions. Reading all users needs
User.Read.All(orDirectory.Read.All) inConnect-MgGraph -Scopes(Connect-MgGraph -Scopes).
FAQ
Why does Get-MgUser return only 100 users?
Microsoft Graph returns users in pages, and the default page size for the users list is 100. Without -All the cmdlet returns only the first page. Add -All to follow every next page.
What is the difference between -All, -Top and -PageSize?
-All follows every page until the end. -Top N returns only the first N users. -PageSize N sets how many users each request returns (up to 999 for users), which reduces the number of requests when combined with -All.
Can I use -All with -UserId?
No. -All belongs to the List parameter set and -UserId to the Get set, so combining them fails with Parameter set cannot be resolved using the specified named parameters.