From 33e1118cc6f5c6913d02f130b5c1483489942c00 Mon Sep 17 00:00:00 2001
From: Tomas Kracmar <tomas.kracmar@cqre.net>
Date: Tue, 14 Apr 2026 18:39:50 +0200
Subject: [PATCH] fix: restore .value access when using -AllPages on group
 queries

Invoke-GraphRequest with -AllPages returns the full response object
with accumulated items in .value, not a flat array.
---
 Scripts/Backup-Restore-Assignments.ps1 | 4 ++--
 Scripts/Bulk-AppAssignment.ps1         | 2 +-
 Scripts/Bulk-AssignmentManager.ps1     | 2 +-
 Scripts/Deploy-IntuneBaseline.ps1      | 4 ++--
 Scripts/Export-AssignmentsToCsv.ps1    | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/Scripts/Backup-Restore-Assignments.ps1 b/Scripts/Backup-Restore-Assignments.ps1
index 19b7ca5..c89e15b 100644
--- a/Scripts/Backup-Restore-Assignments.ps1
+++ b/Scripts/Backup-Restore-Assignments.ps1
@@ -279,7 +279,7 @@ if($Mode -eq "Backup")
     Write-Host "`nLoading groups for backup resolution..." -ForegroundColor Cyan
     $backupGroupsResponse = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName" -AllPages
     $backupGroups = @{}
-    foreach($g in $backupGroupsResponse)
+    foreach($g in $backupGroupsResponse.value)
     {
         $backupGroups[$g.id] = $g.displayName
     }
@@ -383,7 +383,7 @@ elseif($Mode -eq "Restore")
     # Resolve group names to IDs in current tenant if needed
     Write-Host "`nLoading current tenant groups for name resolution..." -ForegroundColor Cyan
     $currentGroupsResponse = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName" -AllPages
-    $currentGroups = $currentGroupsResponse
+    $currentGroups = $currentGroupsResponse.value
 
     $success = 0
     $skipped = 0
diff --git a/Scripts/Bulk-AppAssignment.ps1 b/Scripts/Bulk-AppAssignment.ps1
index b67cff2..ac9113c 100644
--- a/Scripts/Bulk-AppAssignment.ps1
+++ b/Scripts/Bulk-AppAssignment.ps1
@@ -253,7 +253,7 @@ Write-Host "Selected $($selectedApps.Count) apps." -ForegroundColor Green
 #region Load Groups
 Write-Host "`nLoading Azure AD groups..." -ForegroundColor Cyan
 $groupsResponse = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName" -AllPages
-$groups = $groupsResponse | Where-Object { $_.displayName } | Sort-Object displayName
+$groups = $groupsResponse.value | Where-Object { $_.displayName } | Sort-Object displayName
 Write-Host "Found $($groups.Count) groups." -ForegroundColor Green
 
 $groupDisplayNames = $groups | ForEach-Object { "$($_.displayName) [$($_.id)]" }
diff --git a/Scripts/Bulk-AssignmentManager.ps1 b/Scripts/Bulk-AssignmentManager.ps1
index 8597f7b..5b8f3b4 100644
--- a/Scripts/Bulk-AssignmentManager.ps1
+++ b/Scripts/Bulk-AssignmentManager.ps1
@@ -296,7 +296,7 @@ Write-Host "Selected $($selectedObjects.Count) objects." -ForegroundColor Green
 #region Load groups & filters
 Write-Host "`nLoading Azure AD groups..." -ForegroundColor Cyan
 $groupsResponse = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName" -AllPages
-$groups = $groupsResponse | Where-Object { $_.displayName } | Sort-Object displayName
+$groups = $groupsResponse.value | Where-Object { $_.displayName } | Sort-Object displayName
 Write-Host "Found $($groups.Count) groups." -ForegroundColor Green
 
 Write-Host "`nLoading assignment filters..." -ForegroundColor Cyan
diff --git a/Scripts/Deploy-IntuneBaseline.ps1 b/Scripts/Deploy-IntuneBaseline.ps1
index b3d88fc..5d66297 100644
--- a/Scripts/Deploy-IntuneBaseline.ps1
+++ b/Scripts/Deploy-IntuneBaseline.ps1
@@ -379,7 +379,7 @@ if($baseline.ContainsKey("groups") -and $baseline["groups"])
 {
     Write-Host "`nResolving groups..." -ForegroundColor Cyan
     $existingGroupsResp = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName" -AllPages
-    $existingGroups = $existingGroupsResp
+    $existingGroups = $existingGroupsResp.value
 
     foreach($grpDef in $baseline["groups"])
     {
@@ -414,7 +414,7 @@ if($baseline.ContainsKey("groups") -and $baseline["groups"])
 #region Pre-load all existing groups for assignment resolution
 Write-Host "`nPre-loading group directory..." -ForegroundColor Cyan
 $allGroupsResp = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName" -AllPages
-foreach($g in $allGroupsResp)
+foreach($g in $allGroupsResp.value)
 {
     if(-not $groupCache.ContainsKey($g.displayName))
     {
diff --git a/Scripts/Export-AssignmentsToCsv.ps1 b/Scripts/Export-AssignmentsToCsv.ps1
index 840230c..adb2b44 100644
--- a/Scripts/Export-AssignmentsToCsv.ps1
+++ b/Scripts/Export-AssignmentsToCsv.ps1
@@ -243,7 +243,7 @@ if(-not $selectedTypeTitles)
 
 Write-Host "`nLoading groups for name resolution..." -ForegroundColor Cyan
 $groupsResponse = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName" -AllPages
-$groups = $groupsResponse
+$groups = $groupsResponse.value
 
 $reportRows = @()