Disambiguate bulk-license failures and harden Graph batch error parsing for case-colliding keys

[Copilot]

Bulk license failures were surfacing ambiguous error text and, in some cases, a JSON parse exception (keepCopy/KeepCopy) that obscured the actual upstream Graph failure. The issue came from shared Graph batch error normalization and from indistinguishable error-stage messaging in the bulk license flow.

• Error-source disambiguation in bulk license flow

  • Invoke-ExecBulkLicense now wraps the user lookup batch (New-GraphBulkRequest) in a dedicated try/catch.
  • Lookup failures are rethrown with stage-specific context (before license assignment) so they are not conflated with Set-CIPPUserLicense failures.

• Case-safe Graph error payload parsing

  • In New-GraphBulkRequest, error JSON parsing now uses ConvertFrom-Json -AsHashtable for ErrorDetails.Message.
  • Message extraction handles both error.message and error.Message to tolerate payloads with inconsistent casing.

• Scope correction

  • Reverted the earlier entrypoint-level request deserialization change in CippEntrypoints.psm1; fix remains scoped to the actual failing paths.

# Invoke-ExecBulkLicense.ps1
try {
    $UserLookupResults = New-GraphBulkRequest -tenantid $TenantFilter -Requests @($UserLookupRequests)
} catch {
    $LookupError = Get-CippException -Exception $_
    throw "Failed to lookup users before license assignment for tenant $TenantFilter. Error: $($LookupError.NormalizedError)"
}

# New-GraphBulkRequest.ps1
$ErrorJson = $_.ErrorDetails.Message | ConvertFrom-Json -AsHashtable -ErrorAction Stop
$Message = $ErrorJson.error.message ?? $ErrorJson.error.Message

Original prompt

https://raw.githubusercontent.com/Zacgoose/CIPP-API/refs/heads/dev/Modules/CIPPCore/Public/Set-CIPPUserLicense.ps1

Failed to process bulk licence operation: too many child clauses specified in search filter expression containing 'or' operators:71 max allowed is 71

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[Zacgoose]

@copilot can we go even faster by building a bulk request object like what we do for assigning the licence, so it's only 1 api request that we make with multiple 15 long requests

[Copilot]

@copilot can we go even faster by building a bulk request object like what we do for assigning the licence, so it's only 1 api request that we make with multiple 15 long requests

Implemented in 9c837fc: user lookup now builds a single New-GraphBulkRequest payload with 15-user filter chunks, then executes that bulk payload once and aggregates results (with per-chunk failure handling). No UI changes in this update.