13reak 

Apparently, Microsoft broke the API a bit when retiring some of its parts

https://techcommunity.microsoft.com/blog/microsoft-entra-blog/action-required-msonline-and-azuread-powershell-retirement---2025-info-and-resou/4364991

The Microsoft Extractor Suite broke.

➡️ Workaround:

You can get up to 50.000 events via the Azure Web Portal. So filter for a username or a small timeframe.

⚠️ Note: you cannot download everything via the Web Portal, after 50.000 events, it'll just stop.

#DFIR #Azure #Cloud #knowledgedrop

Action required: MSOnline and AzureAD PowerShell retirement - 2025 info and resources | Microsoft Community Hub

Retirement of MSOnline PowerShell begins in April 2025. Learn about the timeline and required actions.

TECHCOMMUNITY.MICROSOFT.COM
Jun 11, 2025 at 12:26pmWeb
Show threadIchinin   ✅🎯🙄Jun 11, 2025
@13reak Reminds me of the Palo Alto firewall appliance from years back, you could only poll like 100k records or something, then the session was terminated. Totally braindead.