microsoftgraph / microsoftgraph/entra-powershell
🪲 Characters 0xE2 0x80 0xAF presented in date time signInActivity property when expanded on MacOS
Nobody has claimed this yet.
- Dominant language
- PowerShell
- Stars
- 213
- Forks
- 46
- PR merge metrics
- No merged PRs in 30d
Description
We write a script to extract from Get-EntraUser the signInActivity property. We expand this property to get the lastSignInDateTime, lastSuccessfulSignInDateTime, and lastNonInteractiveSignInDateTime values. The script we use is:
Connect-Entra -Scope 'User.Read.All'
$allactivemembers = Get-EntraUser -Filter "accountEnabled eq true and userType eq 'Member'” -Limit 10 -Property displayName,userPrincipalName, onPremisesSamAccountName, onPremisesImmutableId, signInActivity
$allactivemembers | Select-Object -ExpandProperty 'signInActivity' | Export-Csv -Path “sampleoutput.csv"
When running the same PowerShell script on MacOS and on Windows, we get different results in the output. Specifically, in MacOS we get three non-printable characters in a date/time string, between the seconds and the AM or PM designator. They are: 0xE2 0x80 0xAF.
Thanks for reporting the bug. Please ensure you've gone through the following checklist before opening an issue:
- Make sure you can reproduce this issue using the latest released version of
Microsoft.EntraorMicrosoft.Entra.Beta. - Please search the existing issues to see if there has been a similar issue filed.
Describe the bug
To Reproduce
Steps to reproduce the behavior:
- Run the following script on a Mac:
Connect-Entra -Scope 'User.Read.All'
$allactivemembers = Get-EntraUser -Filter "accountEnabled eq true and userType eq 'Member'” -Limit 10 -Property displayName,userPrincipalName, onPremisesSamAccountName, onPremisesImmutableId, signInActivity
$allactivemembers | Select-Object -ExpandProperty 'signInActivity' | Export-Csv -Path “sampleoutput.csv"
- Using a binary editor / od -cx from the command line on a Mac, inspect the output CSV file, and you will see the extraneous characters:
0000400 l e I d " \n " 6 / 1 6 / 2 0 2 6
656c 6449 0a22 3622 312f 2f36 3032 3632
0000420 4 : 4 3 : 0 5 ** ** P M " , "
3420 343a 3a33 3530 80e2 50af 224d 222c
0000440 a d d 0 9 5 4 b - b 1 1 8 - 4 c
6461 3064 3539 6234 622d 3131 2d38 6334
0000460 a 9 - b 7 5 1 - 7 f 9 d 8 9 2 5
3961 622d 3537 2d31 6637 6439 3938 3532
0000500 7 5 0 0 " , " 6 / 1 7 / 2 0 2 6
3537 3030 2c22 3622 312f 2f37 3032 3632
0000520 1 2 : 4 6 : 5 8 ** ** P M " ,
3120 3a32 3634 353a e238 af80 4d50 2c22
0000540 " a d d 0 9 5 4 b - b 1 1 8 - 4
6122 6464 3930 3435 2d62 3162 3831 342d
0000560 c a 9 - b 7 5 1 - 7 f 9 d 8 9 2
6163 2d39 3762 3135 372d 3966 3864 3239
0000600 5 7 5 0 0 " , " 6 / 1 7 / 2 0 2
3735 3035 2230 222c 2f36 3731 322f 3230
0000620 6 1 2 : 4 6 : 5 8 ** ** P M "
2036 3231 343a 3a36 3835 80e2 50af 224d
0000640 , " f 7 e 5 0 b f 7 - 2 3 d 9 -
222c 3766 3565 6230 3766 322d 6433 2d39
0000660 4 a 5 6 - b f 3 b - b a f 7 3 e
6134 3635 622d 3366 2d62 6162 3766 6533
- Run the same script on a PC, and the extraneous characters are not present.
Expected behavior
The output should be the same on a PC or Mac (with, perhaps, the lack of \r on a Mac at line ends)
Debug Output
⚠ ATTENTION: Be sure to remove any sensitive information that may be in the logs.
Debug Output
DEBUG: ============================ TRANSFORMATIONS ============================
DEBUG: Method : GET
DEBUG: Uri : /v1.0/users/?$select=displayName,userPrincipalName,onPremisesSamAccountName,onPremisesImmutableId,signInActivity&$top=10&$Filter=accountEnabled eq true and userType eq 'Member'
DEBUG: =========================================================================
DEBUG: GET /v1.0/users/?$select=displayName,userPrincipalName,onPremisesSamAccountName,onPremisesImmutableId,signInActivity&$top=10&$Filter=accountEnabled%20eq%20true%20and%20userType%20eq%20'Member' HTTP/1.1
HTTP: graph.microsoft.com
User-Agent: PowerShell/7.6.3 EntraPowershell/1.0.12 Get-EntraUser
DEBUG: GET https://graph.microsoft.com/v1.0/users/?$select=displayName,userPrincipalName,onPremisesSamAccountName,onPremisesImmutableId,signInActivity&$top=10&$Filter=accountEnabled%20eq%20true%20and%20userType%20eq%20'Member'
HTTP/1.1 200 OK
Cache-Control: no-cache
Transfer-Encoding: chunked
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
request-id: cfe9c58f-3f89-4938-9b01-05fa34b7f1a3
client-request-id: aefb7bd5-7ba6-45c6-94bd-0e6ff668bfed
x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"West US 2","Slice":"E","Ring":"4","ScaleUnit":"000","RoleInstance":"CO1PEPF00016241"}}
x-ms-resource-unit: 1
OData-Version: 4.0
Date: Thu, 18 Jun 2026 16:57:44 GMT
Content-Type: application/json; odata.metadata=minimal; odata.streaming=true; IEEE754Compatible=false; charset=utf-8
Content-Encoding: gzip
$allactivemembers | Select-Object -ExpandProperty 'signInActivity' -Debug
Produces the data, but if you inspect it, it shows the extraneous, non-printable characters. The command od -cx reveals them:
0000000 \n l a s t N o n I n t e r a c t
6c0a 7361 4e74 6e6f 6e49 6574 6172 7463
0000020 i v e S i g n I n D a t e T i m
7669 5365 6769 496e 446e 7461 5465 6d69
0000040 e : 6 / 1 8 / 2 0 2 6 9
2065 3a20 3620 312f 2f38 3032 3632 3920
0000060 : 0 4 : 3 5 ** ** A M \n l a s t
303a 3a34 3533 80e2 41af 0a4d 616c 7473
0000100 S i g n I n R e q u e s t I d
Module Version
ModuleType Version PreRelease Name ExportedCo
mmands
Script 1.0.12 Microsoft.Entra.Authentication {Add-Entr…
Script 1.0.12 Microsoft.Entra.Users {Get-Entr…
Environment Data
Name Value
PSVersion 7.6.3
PSEdition Core
GitCommitId 7.6.3
OS macOS 26.5.1
Platform Unix
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.4
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
Screenshots
N/A
Additional context
We have verified this is a MacOS-only issue. Data is "clean" on Wimdows.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the reported Connect-Entra and Get-EntraUser script, then compare the exported CSV bytes from macOS and Windows around the signInActivity date/time values. The issue is done when the macOS and Windows outputs match without the 0xE2 0x80 0xAF characters, aside from the expected line-ending difference.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell
- Domain
- cli, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100