From 77f7372d44fbb1a40934ace6f1ccb1981fda5e9b Mon Sep 17 00:00:00 2001
From: Tomas Kracmar <tomas.kracmar@cqre.net>
Date: Tue, 14 Apr 2026 18:36:23 +0200
Subject: [PATCH] fix: fetch all groups via -AllPages for large tenants

Replaces default 100-item page limits and =999 workarounds
with -AllPages on group queries across assignment and baseline scripts.
Enables full fzf inline search/filter for group selection.
---
 Scripts/Backup-Restore-Assignments.ps1 | 8 ++++----
 Scripts/Bulk-AppAssignment.ps1         | 4 ++--
 Scripts/Bulk-AssignmentManager.ps1     | 4 ++--
 Scripts/Deploy-IntuneBaseline.ps1      | 8 ++++----
 Scripts/Export-AssignmentsToCsv.ps1    | 4 ++--
 5 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/Scripts/Backup-Restore-Assignments.ps1 b/Scripts/Backup-Restore-Assignments.ps1
index 4db5054..19b7ca5 100644
--- a/Scripts/Backup-Restore-Assignments.ps1
+++ b/Scripts/Backup-Restore-Assignments.ps1
@@ -277,9 +277,9 @@ if($Mode -eq "Backup")
 
     # Preload groups for name resolution in backup
     Write-Host "`nLoading groups for backup resolution..." -ForegroundColor Cyan
-    $backupGroupsResponse = Invoke-GraphRequest "/groups?`$select=id,displayName&`$top=999"
+    $backupGroupsResponse = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName" -AllPages
     $backupGroups = @{}
-    foreach($g in $backupGroupsResponse.value)
+    foreach($g in $backupGroupsResponse)
     {
         $backupGroups[$g.id] = $g.displayName
     }
@@ -382,8 +382,8 @@ elseif($Mode -eq "Restore")
 
     # Resolve group names to IDs in current tenant if needed
     Write-Host "`nLoading current tenant groups for name resolution..." -ForegroundColor Cyan
-    $currentGroupsResponse = Invoke-GraphRequest "/groups?`$select=id,displayName&`$top=999"
-    $currentGroups = $currentGroupsResponse.value
+    $currentGroupsResponse = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName" -AllPages
+    $currentGroups = $currentGroupsResponse
 
     $success = 0
     $skipped = 0
diff --git a/Scripts/Bulk-AppAssignment.ps1 b/Scripts/Bulk-AppAssignment.ps1
index d660f13..b67cff2 100644
--- a/Scripts/Bulk-AppAssignment.ps1
+++ b/Scripts/Bulk-AppAssignment.ps1
@@ -252,8 +252,8 @@ Write-Host "Selected $($selectedApps.Count) apps." -ForegroundColor Green
 
 #region Load Groups
 Write-Host "`nLoading Azure AD groups..." -ForegroundColor Cyan
-$groupsResponse = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName"
-$groups = $groupsResponse.value | Where-Object { $_.displayName } | Sort-Object displayName
+$groupsResponse = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName" -AllPages
+$groups = $groupsResponse | Where-Object { $_.displayName } | Sort-Object displayName
 Write-Host "Found $($groups.Count) groups." -ForegroundColor Green
 
 $groupDisplayNames = $groups | ForEach-Object { "$($_.displayName) [$($_.id)]" }
diff --git a/Scripts/Bulk-AssignmentManager.ps1 b/Scripts/Bulk-AssignmentManager.ps1
index 7500755..8597f7b 100644
--- a/Scripts/Bulk-AssignmentManager.ps1
+++ b/Scripts/Bulk-AssignmentManager.ps1
@@ -295,8 +295,8 @@ Write-Host "Selected $($selectedObjects.Count) objects." -ForegroundColor Green
 
 #region Load groups & filters
 Write-Host "`nLoading Azure AD groups..." -ForegroundColor Cyan
-$groupsResponse = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName"
-$groups = $groupsResponse.value | Where-Object { $_.displayName } | Sort-Object displayName
+$groupsResponse = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName" -AllPages
+$groups = $groupsResponse | Where-Object { $_.displayName } | Sort-Object displayName
 Write-Host "Found $($groups.Count) groups." -ForegroundColor Green
 
 Write-Host "`nLoading assignment filters..." -ForegroundColor Cyan
diff --git a/Scripts/Deploy-IntuneBaseline.ps1 b/Scripts/Deploy-IntuneBaseline.ps1
index cd0c2f2..b3d88fc 100644
--- a/Scripts/Deploy-IntuneBaseline.ps1
+++ b/Scripts/Deploy-IntuneBaseline.ps1
@@ -378,8 +378,8 @@ $groupCache = @{}
 if($baseline.ContainsKey("groups") -and $baseline["groups"])
 {
     Write-Host "`nResolving groups..." -ForegroundColor Cyan
-    $existingGroupsResp = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName&`$top=999"
-    $existingGroups = $existingGroupsResp.value
+    $existingGroupsResp = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName" -AllPages
+    $existingGroups = $existingGroupsResp
 
     foreach($grpDef in $baseline["groups"])
     {
@@ -413,8 +413,8 @@ if($baseline.ContainsKey("groups") -and $baseline["groups"])
 
 #region Pre-load all existing groups for assignment resolution
 Write-Host "`nPre-loading group directory..." -ForegroundColor Cyan
-$allGroupsResp = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName&`$top=999"
-foreach($g in $allGroupsResp.value)
+$allGroupsResp = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName" -AllPages
+foreach($g in $allGroupsResp)
 {
     if(-not $groupCache.ContainsKey($g.displayName))
     {
diff --git a/Scripts/Export-AssignmentsToCsv.ps1 b/Scripts/Export-AssignmentsToCsv.ps1
index 341f038..840230c 100644
--- a/Scripts/Export-AssignmentsToCsv.ps1
+++ b/Scripts/Export-AssignmentsToCsv.ps1
@@ -242,8 +242,8 @@ if(-not $selectedTypeTitles)
 }
 
 Write-Host "`nLoading groups for name resolution..." -ForegroundColor Cyan
-$groupsResponse = Invoke-GraphRequest "/groups?`$select=id,displayName&`$top=999"
-$groups = $groupsResponse.value
+$groupsResponse = Invoke-GraphRequest "/groups?`$select=id,displayName&`$orderby=displayName" -AllPages
+$groups = $groupsResponse
 
 $reportRows = @()