Cohort sync fails when fetching paginated Microsoft Graph group members - $skiptoken appended to $select parameter

[HashTagGlitch]

Hello team,

We are experiencing an issue with the Moodle Microsoft 365 integration plugin, specifically with the scheduled task:

local_o365\task\cohortsync

Moodle : 5.2
Plugin : 5.1.1
Php : 8.3.30

The task works correctly when syncing a manually created Microsoft Entra ID group with a small number of users.

However, when using dynamic Microsoft Entra ID groups mapped to Moodle cohorts, the task fails while fetching group members.

The groups and Teams cache update works correctly:

Fetched 1716 groups from Microsoft Graph API.
Fetched 497 teams from Microsoft Graph API.
Found 4 mappings.

The issue occurs during member retrieval for dynamic groups:

Error fetching group members for group ID 169a9a55-f811-4298-a43b-858544b9c525:
Error in API call: Parsing OData Select and Expand failed:
Term 'id?$skiptoken=RFNwdAoAAQ...' is not valid in a $select or $expand expression.

A second dynamic group fails with the same type of error:

Error fetching group members for group ID 8e60596b-b87e-41be-a975-617b60335cea:
Error in API call: Parsing OData Select and Expand failed:
Term 'id?$skiptoken=RFNwdAoAAQ...' is not valid in a $select or $expand expression.

It looks like the plugin may be incorrectly appending the Microsoft Graph pagination parameter $skiptoken to the $select parameter, resulting in something similar to:

$select=id?$skiptoken=...

Instead of handling $skiptoken as a separate query parameter or following the @odata.nextLink URL returned by Microsoft Graph.

This does not look like a permissions issue because:

• Groups are fetched successfully from Microsoft Graph.
• Cohort mappings are detected correctly.
• Manual Entra ID groups sync successfully.
• The error is an OData parsing error, not a 403 or access denied error.

Expected behavior:
The cohort sync task should correctly handle Microsoft Graph pagination when fetching members of dynamic Microsoft Entra ID groups.

Actual behavior:
The task fails for dynamic groups with an OData parsing error related to $select and $skiptoken.

Could you please confirm whether this is a known issue in the Graph pagination handling for cohort sync?

**** LOGS ****
Execute scheduled task: Cohort sync (local_o365\task\cohortsync)
... started 09:39:35. Current memory use 14.6 MB.
... Groups cache was updated recently. Skipping update. Next update in 22 seconds.
... Groups cache update skipped (rate limit). Proceeding with existing cache.
... Start processing cohort mappings.
...... Found 1716 groups.
...... Found 4 mappings.
......... Processing mapping for group ID cca149ef-e1e7-48e8-9fe8-f9aa2a177fe8 and cohort ID 2.
......... Processing mapping for group ID 169a9a55-f811-4298-a43b-858544b9c525 and cohort ID 4.
...... Error fetching group members for group ID 169a9a55-f811-4298-a43b-858544b9c525: Error in API call: Parsing OData Select and Expand failed: Term 'id?$skiptoken=RFNwdAoAAQAAAAAAAAAAFAAAAG01eFwtqr5DrwJdDbKaeQABAAAAAAAAAAAAAAAAAAAXMS4yLjg0MC4xMTM1NTYuMS40LjIzMzEGAAAAAVWamhYR-JhCpDuFhUS5xSUBATf2QzWPM39HllF-XeN3VZYB5QAAAAEBAAAA' is not valid in a $select or $expand expression.
......... Processing mapping for group ID 8e60596b-b87e-41be-a975-617b60335cea and cohort ID 7.
...... Error fetching group members for group ID 8e60596b-b87e-41be-a975-617b60335cea: Error in API call: Parsing OData Select and Expand failed: Term 'id?$skiptoken=RFNwdAoAAQAAAAAAAAAAFAAAAJ-ZSsqepgFHvrqYctJQA_sBAAAAAAAAAAAAAAAAAAAXMS4yLjg0MC4xMTM1NTYuMS40LjIzMzEGAAAAAWtZYI5-uL5BqXVhe2AzXOoBAZtzT5nCPTFPhX-lmbmb4HwB5QAAAAEBAAAA' is not valid in a $select or $expand expression.
......... Processing mapping for group ID 0a8b7a78-413c-4d02-9fcb-4b4c389dc709 and cohort ID 9.
...... Error fetching group members for group ID 0a8b7a78-413c-4d02-9fcb-4b4c389dc709: Error in API call: Parsing OData Select and Expand failed: Term 'id?$skiptoken=RFNwdAoAAQAAAAAAAAAAFAAAAN87XktqYaBAuQBZIuJ7L3ABAAAAAAAAAAAAAAAAAAAXMS4yLjg0MC4xMTM1NTYuMS40LjIzMzEGAAAAAXh6iwo8QQJNn8tLTDidxwkBATY0_Dl-O75Cq406M6Rn6QYB5QAAAAEBAAAA' is not valid in a $select or $expand expression.
... used 9 dbqueries
... used 2.2742741107941 seconds
... used 25.6 MB peak memory
Scheduled task complete: Cohort sync (local_o365\task\cohortsync)

***** END *****

Thank you.

[HashTagGlitch]

Hello team,

I performed additional testing on my side and I was able to identify and confirm the root cause of the issue.

The problem appears to be related to how the query parameters are constructed when calling Microsoft Graph for paginated results.

I applied the following local fix in the file:

/local/o365/classes/rest/unified.php

Original code:

public function get_transitive_group_members(string $groupobjectid): array {
$endpoint = '/groups/' . $groupobjectid . '/transitiveMembers/microsoft.graph.user?$select=id';
return $this->paginatedapicall('get', $endpoint);
}

Modified code:

public function get_transitive_group_members(string $groupobjectid): array {
$endpoint = '/groups/' . $groupobjectid . '/transitiveMembers/microsoft.graph.user';
return $this->paginatedapicall('get', $endpoint, ['$select' => 'id']);
}

After applying this change:

• Cohort sync works correctly
• Dynamic Microsoft Entra ID groups are now processed successfully
• No more OData parsing errors related to $skiptoken

This confirms that the issue was caused by an incorrect construction of the query string.

It seems that $select should not be embedded directly in the endpoint, but passed separately so that pagination parameters are appended correctly.

Please let me know if you would like me to test a patch or provide additional logs.

Thank you.

[weilai-irl]

Hi @HashTagGlitch

Thank you for reporting the issue. I acknowledge the bug, and I can confirm your findings and solutions are absolutely correct. I have created PRs containing the fix, and they will be included in the next release. I have also checked for other paginated Graph API calls in the integration and confirmed that there were no other errors like this. This particular change was made by a community user in the last release, and we failed to spot this during our review.

Thank you for reporting the issue and providing the solution.

Regards,
Lai

[HashTagGlitch]

Hi @weilai-irl ,

Thank you for your quick feedback and for confirming the root cause.

Glad I could help identify the issue. I appreciate the fast turnaround and the fix being included in the next release.

I’ll keep an eye on the upcoming version and update our environment accordingly.

Thanks again for your support.

Regards,

[weilai-irl]

Hi @HashTagGlitch

Thank you for your acknowledgement. I'll keep this open until the fix is released.

Regards,
Lai

[phager-at]

Hi all,

So, seems like Copilot itself suggested the change causing the bug in the pull request for Moodle 5.1 #3051 (comment).
Then it has spotted the bug with the same changes in the pull request for Moodle 5.0: #2971 (comment).
And ultimately didn't find it in the pull request for Moodle 4.5 (with same changes again): #2970 (comment)

I think I'll stick to my colleagues reviewing my code for now. 😂

Huge thanks for fixing the bug that fast! I just rolled out the buggy version and have temporarily applied the fix directly.

Best Regards

Philipp

Hi @HashTagGlitch

Thank you for reporting the issue. I acknowledge the bug, and I can confirm your findings and solutions are absolutely correct. I have created PRs containing the fix, and they will be included in the next release. I have also checked for other paginated Graph API calls in the integration and confirmed that there were no other errors like this. This particular change was made by a community user in the last release, and we failed to spot this during our review.

Thank you for reporting the issue and providing the solution.

Regards, Lai