"Expired or Invalid pagination request. Default Expiry time is 00:30:00" Error when returning 1000 or more entries with Get-User - Exchange Online Powershell V3 with Certificate Based Authentication

Question

"Expired or Invalid pagination request. Default Expiry time is 00:30:00" Error when returning 1000 or more entries with Get-User - Exchange Online Powershell V3 with Certificate Based Authentication

Ryan Graham 15

Hello,

I'm upgrading my scripts to EXO v3.1.0 due to Microsoft's depreciation of version 2.0.5 at the end of June. Now, I'm running into an error with the below command.

$UserList = Get-User -ResultSize unlimited

When I use certificate-based authentication for Exchange Online and the Get-User command returns over 1000 users, I get the below error every time: "Expired or Invalid pagination request. Default Expiry time is 00:30:00"

TerminatingError(Invoke-WebRequest): "{"error":{"code":"BadRequest","message":"Invalid Operation","innererror":{"message":"Invalid Operation","type":"Microsoft.Exchange.Admin.OData.Core.ODataServiceException","stacktrace":" at Microsoft.Exchange.AdminApi.CommandInvocation.CommandInvocation.InvokeCommand(QueryContext queryContext, CmdletInvokeInputType cmdletInvokeInputType)\r\n at Microsoft.Exchange.Admin.OData.Core.PathSegmentToExpressionTranslator.Translate(OperationImportSegment segment)\r\n at Microsoft.Exchange.Admin.OData.Core.QueryContext.ResolveQuery(ODataContext context, Int32 level)\r\n at Microsoft.Exchange.Admin.OData.Core.Handlers.OperationHandler.Process(IODataRequestMessage requestMessage, IODataResponseMessage responseMessage)\r\n at Microsoft.Exchange.Admin.OData.Core.Handlers.RequestHandler.Process(Stream requestStream)","internalexception":{"message":"Expired or Invalid pagination request. Default Expiry time is 00:30:00","type":"System.Exception","stacktrace":""}}}}"

The newer commands, like Get-ExoMailbox, work fine regardless of the number of users/objects. Any help would be greatly appreciated.

Anonymous

2023-06-02T01:29:52.7133333+00:00

We are investigating your issue. We will get back to you once there are any updates.
Anonymous

2023-06-06T07:28:30.6466667+00:00

Just wanted to check if the answer shared below helped. If it helped, then would request you to please "Accept the answer" as it would be helpful to others in the community as well.
Chris Martinelli 0 Reputation points

2023-07-06T14:39:09.0133333+00:00

Same issue here.Get-Mailbox -ResultSize unlimited -Filter {(RecipientTypeDetails -eq 'UserMailbox') -and (Alias -ne 'xxxxxx')} | Remove-MailboxPermission -User ******@xxxxxx.onmicrosoft.com -AccessRights fullaccess -InheritanceType all
Lennard Lobrij 11 Reputation points

2024-05-13T11:26:00.6766667+00:00

Is there any update on this? Since the beginning of May I suddenly get the "Expired or Invalid pagination request. Default Expiry time is 00:30:00" error when running Get-DistributionGroup -ResultSize unlimited.
I've tried using multiple > v3.X versions (3.1.0, 3.4.0 & 3.5.0) of the Exchange Online Management Powershell module, and they all give the same error.

Interestingly I only get this error when using certificate based authentication, as soon as I authenticate with my admin account I just get all the Distribution Groups (I connect from the same machine, using the same script and the same Powershell module as my attempt with Certificate Based Authentication).
AzureGuineaPig 1 Reputation point

2024-05-17T14:38:57.4566667+00:00

Same issue here
AzureGuineaPig 1 Reputation point

2024-05-17T14:40:06.5066667+00:00

Likewise, it started in the late April or early May 2024 timeframe. I have some scheduled reporting scripts that leverage CBA and the Get-Mailbox -ResultSize Unlimited cmdlet/parameter. But, they’re returning an ‘Expired or Invalid pagination request. Default Expiry time is 00:30:00’ error. When I run them interactively without using CBA, they work fine.
Agnieszka Stojanik 0 Reputation points

2024-07-11T07:01:41.17+00:00
I spent the whole evening yesterday trying to solve this issue and fortunately found a solution :) I had to use xxx.onmicrosoft.com domain instead of our custom one when connecting to Exchange:
Connect-ExchangeOnline -Organization xxx.onmicrosoft.com ...

FYI:

I'm using Get-MailContact command on result set exceeding 1000 records

Connection to EXO is performed using access token, but it shouldn't make any difference

HTH

@AzureGuineaPig
Lennard Lobrij 11 Reputation points

2024-08-05T20:50:22+00:00
@Agnieszka Stojanik I'm curious on how you've got it working! I'm already using the -Organization [customer].onmicrosoft.com instead of the custom domain, but still get the error.

Can you elaborate some more on your implementation? For example:

Which Powershell version do you use?

Which Exchange Online Management Powershell module version?

How did you manage to connect to Exchange Online using the access token? How did you generate the required JWT token from the App Registration secret? Or did you generate the JWT token based on the App Registration Certificate?
I myself use certificate based authentication. I've tried to connect via an App Registration Secret (the same App Registration where my certificate is configured, so the API permissions are the same for both), but using a secret I keep getting UnAuthorized error messages.

Could you share some more of your script?

Thanks!
Lennard Lobrij 11 Reputation points

2024-09-06T13:58:25.4833333+00:00

@Agnieszka Stojanik if you can find the time, I'm really interested in how you've got it working ;)

4 answers

Your answer

Anonymous

2023-06-02T01:29:52.7133333+00:00

We are investigating your issue. We will get back to you once there are any updates.
Anonymous

2023-06-06T07:28:30.6466667+00:00

Just wanted to check if the answer shared below helped. If it helped, then would request you to please "Accept the answer" as it would be helpful to others in the community as well.
Chris Martinelli 0 Reputation points

2023-07-06T14:39:09.0133333+00:00

Same issue here.Get-Mailbox -ResultSize unlimited -Filter {(RecipientTypeDetails -eq 'UserMailbox') -and (Alias -ne 'xxxxxx')} | Remove-MailboxPermission -User ******@xxxxxx.onmicrosoft.com -AccessRights fullaccess -InheritanceType all
Lennard Lobrij 11 Reputation points

2024-05-13T11:26:00.6766667+00:00

Is there any update on this? Since the beginning of May I suddenly get the "Expired or Invalid pagination request. Default Expiry time is 00:30:00" error when running Get-DistributionGroup -ResultSize unlimited.
I've tried using multiple > v3.X versions (3.1.0, 3.4.0 & 3.5.0) of the Exchange Online Management Powershell module, and they all give the same error.

Interestingly I only get this error when using certificate based authentication, as soon as I authenticate with my admin account I just get all the Distribution Groups (I connect from the same machine, using the same script and the same Powershell module as my attempt with Certificate Based Authentication).
AzureGuineaPig 1 Reputation point

2024-05-17T14:38:57.4566667+00:00

Same issue here
AzureGuineaPig 1 Reputation point

2024-05-17T14:40:06.5066667+00:00

Likewise, it started in the late April or early May 2024 timeframe. I have some scheduled reporting scripts that leverage CBA and the Get-Mailbox -ResultSize Unlimited cmdlet/parameter. But, they’re returning an ‘Expired or Invalid pagination request. Default Expiry time is 00:30:00’ error. When I run them interactively without using CBA, they work fine.
Agnieszka Stojanik 0 Reputation points

2024-07-11T07:01:41.17+00:00

I spent the whole evening yesterday trying to solve this issue and fortunately found a solution :) I had to use xxx.onmicrosoft.com domain instead of our custom one when connecting to Exchange:
Connect-ExchangeOnline -Organization xxx.onmicrosoft.com ...

FYI:

I'm using Get-MailContact command on result set exceeding 1000 records

Connection to EXO is performed using access token, but it shouldn't make any difference

HTH

@AzureGuineaPig
Lennard Lobrij 11 Reputation points

2024-08-05T20:50:22+00:00

@Agnieszka Stojanik I'm curious on how you've got it working! I'm already using the -Organization [customer].onmicrosoft.com instead of the custom domain, but still get the error.

Can you elaborate some more on your implementation? For example:

Which Powershell version do you use?

Which Exchange Online Management Powershell module version?

How did you manage to connect to Exchange Online using the access token? How did you generate the required JWT token from the App Registration secret? Or did you generate the JWT token based on the App Registration Certificate?
I myself use certificate based authentication. I've tried to connect via an App Registration Secret (the same App Registration where my certificate is configured, so the API permissions are the same for both), but using a secret I keep getting UnAuthorized error messages.

Could you share some more of your script?

Thanks!
Lennard Lobrij 11 Reputation points

2024-09-06T13:58:25.4833333+00:00

@Agnieszka Stojanik if you can find the time, I'm really interested in how you've got it working ;)

Answer 1

Lennard Lobrij 11

For anyone still looking for a solution, I just retested this with ExchangeOnlineManagement version 3.7.0 and it now appears to be fixed.
Adding -ResultSize Unlimited to for example Get-DistributionGroup or Get-Mailbox now returns all available results instead of the first 1000 results.

Grote, Justin 11 Reputation points

2026-07-28T18:22:12.4633333+00:00

Not my experience, I'm still throwing the error on 3.9.2 with Get-DistributionGroup and any resultsize greater than 1000 (1001 for example)

Answer 2

Grote, Justin 11

Still getting this on 3.9 for Get-DistributionGroup, which unfortunately doesn't support pagination parameters, and I do require properties that show up here not on the EXO items (Moderation Properties, etc.)

As a workaround, I use Get-ExoRecipient to get the groups, and then get those in batches via Get-DistrubutionGroup. Slow but works, but it shouldn't be necessary.

0 comments

Answer 3

Smith Pham 2,795 Independent Advisor

Dear Team,

Limit Result Size and Paginate Manually

If updating the module or switching to Get-ExoMailbox is not feasible, limit the result size to 1,000 or fewer objects per call and manually paginate through the results using a loop.

Connect-ExchangeOnline -CertificateThumbprint "<Thumbprint>" -AppId "<AppId>" -Organization "<YourTenant>.onmicrosoft.com"
$UserList = @()
$BatchSize = 1000
$Skip = 0
do {
    $Batch = Get-User -ResultSize $BatchSize -Skip $Skip
    $UserList += $Batch
    $Skip += $BatchSize
} while ($Batch.Count -eq $BatchSize)

0 comments

Answer 4

Hi @Ryan Graham ,

I tried searching a lot but didn't find any official document explicitly stating if this is a limitation in V3. I've tried submitting feedback for your post below the documentation and we can see if we can get any more information there.

https://github.com/MicrosoftDocs/office-docs-powershell/issues/10907

Meanwhile, if you need to use "Get-user" urgently, you can uninstall the V3 module for the time being and install the old version V2.

Best regards

Shaofan

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.