Description
Describe the bug
I am running an audit job to retrieve audit events. I create the hash table containing the audit query and attempt to submit it with the New-MgBetaSecurityAuditLogQuery cmdlet, but the cmdlet fails.
$AuditJob = New-MgBetaSecurityAuditLogQuery -BodyParameter $AuditQueryParameters
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Invalid URI: The format of the URI could not be determined.
If the session is disconnected and reconnected with Disconnect-MgGraph and Connect-MgGraph, the cmdlet runs as expected. This makes me think that the automatic access token refresh is being ignored by the cmdlet, which then thinks that it is not authorized to submit the job and therefore fails. The error message is very misleading...
Expected behavior
I expect to be able to submit audit jobs...
How to reproduce
Here's the code I used:
$AuditQueryName = ("Copilot Interactions audit job created at {0}" -f (Get-Date -format 'dd-MMM-yyyy HH:mm'))
$StartDate = (Get-Date).AddDays(-30)
$EndDate = (Get-Date).AddDays(1)
$AuditQueryStart = (Get-Date $StartDate -format s)
$AuditQueryEnd = (Get-Date $EndDate -format s)
[array]$AuditQueryOperations = "CopilotInteraction"
$AuditQueryParameters = @{}
#$AuditQueryParameters.Add("@odata.type","#microsoft.graph.security.auditLogQuery")
$AuditQueryParameters.Add("displayName", $AuditQueryName)
$AuditQueryParameters.Add("OperationFilters", $AuditQueryOperations)
$AuditQueryParameters.Add("filterStartDateTime", $AuditQueryStart)
$AuditQueryParameters.Add("filterEndDateTime", $AuditQueryEnd)
Submit the audit query
$AuditJob = New-MgBetaSecurityAuditLogQuery -BodyParameter $AuditQueryParameters
To reproduce, submit a job and let it run. Wait an hour to make sure that the existing access token has expired. Try and submit an audit job again. It fails...
I suspect that the same problem exists with the other cmdlets that interact with the AuditLogQuery API like Get-MgBetaSecurityAuditLogQueryRecord and Get-MgBetaSecurityAuditLogQuery
SDK Version
V2.26.1
Latest version known to work for scenario above?
I noticed this in previous versions but didn't report it
Known Workarounds
run Disconnect-MgGraph, then Connect-MgGraph, and the cmdlet will work.
Debug output
Are you sure you want to perform this action?
Performing the operation "New-MgBetaSecurityAuditLogQuery_Create" on target "Call remote 'POST /security/auditLog/queries' operation".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): y
DEBUG: [CmdletException]: Received exception with message 'UriFormatException - Invalid URI: The format of the URI could not be determined. : at System.Uri.CreateThis(String uri, Boolean dontEscape, UriKind uriKind, UriCreationOptions& creationOptions)
at System.Uri..ctor(String uriString)
at Microsoft.Graph.PowerShell.Authentication.Core.Utilities.AuthenticationHelpers.GetInteractiveBrowserCredentialAsync(IAuthContext authContext, CancellationToken cancellationToken)
at Microsoft.Graph.PowerShell.Authentication.Core.Utilities.AuthenticationHelpers.GetTokenCredentialAsync(IAuthContext authContext, CancellationToken cancellationToken)
at Microsoft.Graph.PowerShell.Authentication.Core.Utilities.AuthenticationHelpers.GetAuthenticationProviderAsync(IAuthContext authContext)
at Microsoft.Graph.PowerShell.Authentication.Helpers.HttpHelpers.GetGraphHttpClient()
at Microsoft.Graph.Beta.PowerShell.Module.BeforeCreatePipeline(InvocationInfo invocationInfo, HttpPipeline& pipeline)
at Microsoft.Graph.Beta.PowerShell.Module.CreatePipeline(InvocationInfo invocationInfo, String parameterSetName)
at Microsoft.Graph.Beta.PowerShell.Cmdlets.NewMgBetaSecurityAuditLogQuery_Create.ProcessRecordAsync()'
New-MgBetaSecurityAuditLogQuery_Create: Invalid URI: The format of the URI could not be determined.
DEBUG: [CmdletEndProcessing]: - New-MgBetaSecurityAuditLogQuery end processing.
Configuration
Name Value
PSVersion 7.5.0
PSEdition Core
GitCommitId 7.5.0
OS Microsoft Windows 10.0.26100
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
Other information
No response