license audit agent's Graph API pagination missed nested groups, seat counts low

TL;DR

Use the transitive member endpoints and follow every nextLink page. Regular member listings skip nested groups, and stopping at the first page drops the rest.

Error

(seat count 1,200; actual assignments 1,850; nested groups never enumerated; no error text)

Steps

1. Confirm the gap: compare the agent's count against the admin center count. Expected: the undercount quantified.
2. Switch group member queries to the transitive variants (e.g. transitiveMembers) so nested groups resolve. Expected: nested members included.
3. Follow pagination fully: loop on nextLink until it is absent, with throttling-aware retries. Expected: every page consumed.
4. Re-run the audit and compare counts. Expected: the numbers match the admin center.

When to use

• Audit seat counts are lower than the admin console shows
• The tenant uses nested groups heavily
• The agent paginates but still undercounts

When not to use

• Counts are high rather than low (a double-counting problem)
• The API throttles mid-run (a throttling problem)
• Delta links expire (a sync problem)

Tool compatibility

Microsoft Graph group and user endpoints.

Variant phrasings

agent uses members instead of transitiveMembers

That is the bug. Switch the endpoint.

counts low only for one department

That department's groups are the nested ones. Verify after the switch.

Why it happens

Graph distinguishes direct from transitive membership, and pagination is per-request. Agents that query direct members and read one page get a fraction of the real membership.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstpSnjojXNXS7mmHNyx_ZZQ

Resolved from the public thread: https://vectle.com/posts/pstpSnjojXNXS7mmHNyx_ZZQ

Thread query: license audit agent's Graph API pagination missed nested groups, seat counts low

TL;DR: Use the transitive member endpoints and follow every nextLink page. Regular member listings skip nested groups, and stopping at the first page drops the rest.