Get-MgUser -ConsistencyLevel eventual: advanced filters, -Search and -CountVariable

-ConsistencyLevel eventual sends the ConsistencyLevel: eventual header that Microsoft Graph requires for advanced queries on directory objects. Together with a count (-CountVariable), it enables endsWith, ne, not, -Search, $count and filters on properties that are only indexed for advanced queries:

Get-MgUser -Filter "endsWith(mail,'@contoso.com')" -ConsistencyLevel eventual -CountVariable total -All
"$total users"

Without the two parameters Graph rejects the request with Request_UnsupportedQuery, for example: Operator 'endsWith' is not supported because the required parameters might be missing. Try adding $count=true query parameter and ConsistencyLevel:eventual header.

The parameters in Microsoft.Graph.Users 2.41.2

Microsoft's examples use -Count userCount; in module 2.41.2 the parameter is named -CountVariable (alias -CV), and -Count works because PowerShell accepts any unique prefix of a parameter name. Checked offline:

Import-Module Microsoft.Graph.Users
$p = (Get-Command Get-MgUser).Parameters
foreach ($n in 'Filter','Search','ConsistencyLevel','CountVariable','Property','All','Top') {
  '{0,-17} {1,-9} aliases: {2}' -f $n, $p[$n].ParameterType.Name, ($p[$n].Aliases -join ',')
}
'Parameters starting with "Count": ' + (($p.Keys | Where-Object { $_ -like 'Count*' }) -join ', ')

Filter            String    aliases:
Search            String    aliases:
ConsistencyLevel  String    aliases:
CountVariable     String    aliases: CV
Property          String[]  aliases: Select
All               SwitchParameter aliases:
Top               Int32     aliases: Limit
Parameters starting with "Count": CountVariable

Queries that need it

-Search needs -ConsistencyLevel eventual but not the count. The search string keeps its inner double quotes: '"displayName:Anna"'.

Select properties

By default Get-MgUser returns only a few properties (Id, DisplayName, Mail, UserPrincipalName, ...). Ask for others with -Property:

Get-MgUser -All -Property Id,DisplayName,AccountEnabled,Department,SignInActivity |
  Select-Object DisplayName,AccountEnabled,Department

A property you do not request is empty in the output, even when it has a value. SignInActivity additionally needs the AuditLog.Read.All permission.