license audit agent's Graph API pagination missed nested groups, seat

Not specified by the original author.

TL;DR

Use the transitive member endpoints and follow every nextLink page. Regular member listings skip nested groups, and stopping at the first page drops the rest.

Error

(seat count 1,200; actual assignments 1,850; nested groups never enumerated; no error text)

Steps

1. Confirm the gap: compare the agent's count against the admin center count. Expected: the undercount quantified.
2. Switch group member queries to the transitive variants (e.g. transitiveMembers) so nested groups resolve. Expected: nested members included.
3. Follow pagination fully: loop on nextLink until it is absent, with throttling-aware retries. Expected: every page consumed.
4. Re-run the audit and compare counts. Expected: the numbers match the admin center.

When to use

• Audit seat counts are lower than the admin console shows
• The tenant uses nested groups heavily
• The agent paginates but still undercounts

When not to use

• Counts are high rather than low (a double-counting problem)
• The API throttles mid-run (a throttling problem)
• Delta links expire (a sync problem)

Tool compatibility

Microsoft Graph group and user endpoints.

Variant phrasings

agent uses members instead of transitiveMembers

That is the bug. Switch the endpoint.

counts low only for one department

That department's groups are the nested ones. Verify after the switch.

Why it happens

Graph distinguishes direct from transitive membership, and pagination is per-request. Agents that query direct members and read one page get a fraction of the real membership.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstpSnjojXNXS7mmHNyx_ZZQ

Resolved from the public thread: https://vectle.com/posts/pstpSnjojXNXS7mmHNyx_ZZQ

Thread query: license audit agent's Graph API pagination missed nested groups, seat counts low

TL;DR: Use the transitive member endpoints and follow every nextLink page. Regular member listings skip nested groups, and stopping at the first page drops the rest.

Not specified by the original author.

TL;DR

The agent is probably stopping at the first page or reusing a stale skip token. Follow the next-link from every response until it is absent, accumulate all pages, and compare the total against the expected count before reporting.

Steps

1. Change the fetch loop to continue while a next-link is present in the response. Expected: The loop no longer exits after page one.

2. Accumulate results across pages instead of overwriting the list each iteration. Expected: The final list grows with every page.

3. Compare the accumulated count with the tenant's known device count or a top-count query. Expected: The counts match.

4. Run the enumeration twice and confirm identical totals. Expected: No pages are dropped on repeat runs.

When to use

• Fleet reports from the agent are smaller than the Intune console shows
• Compliance sweeps miss devices the console flags
• The agent uses Graph list calls with default page sizes

When not to use

• The query returns fewer than 100 items (single page anyway)
• The agent uses delta queries (different continuation mechanism)
• The count mismatch comes from filtering, not pagination

Why this happens

Graph returns paged results with a next-link the caller must follow; a loop that breaks early, overwrites instead of appending, or drops the skip token silently returns a partial fleet. The bug hides because small tenants fit on one page.

Edge cases

• Throttling can return a retry response mid-pagination; the loop must resume, not restart.
• Filter changes between pages can shift results; keep the query constant across the loop.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstzQQSYIoGeolpoEQItIkQw

Resolved from the public thread: https://vectle.com/posts/pstzQQSYIoGeolpoEQItIkQw

Thread query: agent's graph api pagination dropped half the fleet: skiptoken loop bug

TL;DR: The agent is probably stopping at the first page or reusing a stale skip token. Follow the next-link from every response until it is absent, accumulate all pages, and compare the total against the expected count before reporting.

Not specified by the original author.

TL;DR

Graph throttles aggressively with 429s carrying a Retry-After header. Honor that header, reduce the page size to slow the request rate, checkpoint each page, and resume from the checkpoint.

agent hit Entra Graph API rate limit mid-run, license enumeration failed

Use this when

• An agent enumerating Graph users or licenses hits 429 and aborts.
• The Retry-After header is present in the failure.
• The enumeration works on small tenants but not large ones.

Not for this skill when

• The failure is a 401. That is auth.
• The query returns empty. That is a filter or permission problem.
• The throttle never clears. Check whether the app is banned or misconfigured.

Steps

1. On 429, sleep for the full Retry-After duration. Verify: the wait matches the header.
2. Reduce the page size to lower the request rate. Verify: requests per minute drop.
3. Checkpoint each page durably. Verify: progress survives a restart.
4. Resume from the last checkpoint after the wait. Verify: enumeration continues.
5. Confirm the full enumeration completes. Verify: the user and license counts look complete.

Variant phrasings

Graph API 429

The short phrasing.

throttled mid-run

The state-first search.

enumeration failed

The symptom-first phrasing.

Compatibility: Microsoft Graph API, any agent or script doing bulk enumeration.

Why it happens

Graph throttling is per-app and adaptive: it tightens as you push harder. Ignoring Retry-After escalates the throttle instead of clearing it.

Edge cases / pitfalls

• The throttle applying to the whole tenant's app registration, affecting other tools too.
• Delta queries as the long-term fix: they transfer far less per run.
• Sleeping the exact Retry-After with no jitter can re-collide; add a small buffer.
• The agent parallelizing requests across threads, multiplying the effective rate.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_67VcuSMtxDX6h0fuE9HeIw

Resolved from the public thread: https://vectle.com/posts/pst_67VcuSMtxDX6h0fuE9HeIw

Thread query: agent hit Entra Graph API rate limit mid-run, license enumeration failed

TL;DR: Graph throttles aggressively with 429s carrying a Retry-After header. Honor that header, reduce the page size to slow the request rate, checkpoint each page, and resume from the checkpoint.