Get-MDATPDevice -all only retrieves 10.000 objects

[HenrikBernhard]

When running
Get-MDATPDevice -all it only retrieves 10.000 devices

It seems to be caused by the max page size being 10.000 as described in
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/get-machines?view=o365-worldwide

[danlacher]

That is correct. I have provided Alex an additional function for the next release to help around the 10k limit.

[HenrikBernhard]

Thanks for the quick reply!
Any idea on timelines for the next release?

Considering if I should try to add support for the skip parameter, to get the second page of results - but if a release is coming somewhat soon I could probably wait and spend my time on other stuff :)

[alexverboon]

Hello @HenrikBernhard , @danlacher , apologies for the late response, I had plans last summer to work on the update, but plans got crossed due to high workload. I hope I'll make it till this summer to get a big update out.

[AS-Watson-Admin]

Hi Alex,

Would you know if this issue is still in the pipeline to address? Because we can't clean up our stale records in Defender, we reach the max of 10,000 devices and can't run reports on the rest of the objects.

[danlacher]

I have a code block that will recursively call the API to get the next url that the JSON returns, I will code a version into one of the functions for example before I request to publish it across 24 ps1 files.