[3/9] Enumerating Managed Identities - InvalidOperation: You cannot call a method on a null-valued expression.

[albert-widjaja]

Hi Team,

When the script is reaching the [3/9] Enumerating Managed Identities stage, it throws error:

[*] Status: Processing managed identity 1 of 12580 (updates every 125 managed identities)...
InvalidOperation: You cannot call a method on a null-valued expression.
[*] Status: Processing managed identity 125 of 12580...
InvalidOperation: You cannot call a method on a null-valued expression.
[*] Status: Processing managed identity 250 of 12580...

Is there anything that needs to be done to fix the above issue?

[zh54321]

Hi, thank you very much for reporting this issue.

Could please confirm the following:

• Is the total number of managed identities reported by the script correct (12580)?
• Which PowerShell version are you using (Windows PowerShell 5.1 or PowerShell 7.x)?

I’ve tried to reproduce the problem in two different test tenants but haven’t been able to observe the same behavior so far. That said, I do have a suspicion about what might be causing it.

My current hypothesis is related to the parsing of the AlternativeNames of a specific ManagedIdentity . I guess despite the error the HTML report of the Managed Identities is generated (for example: ManagedIdentities_202601XXXXXX_XXXX_XXXX.html).
Could you please check whether there are any managed identities in the main table where the IsExplicit field is empty? You can easily identify those by setting the column filter to = empty.

If you do find such an entry, could you please click on the display name of that managed identity (which should jump the detailed view) and verify whether the Object Path field is empty as well?

If possible, it would be very helpful if you could run the following Microsoft Graph PowerShell command against one of the affected managed identities and compare the output to a “normal” AlternativeNames value (for example one that looks like {isExplicit=True, /subscriptions/...}):

$ObjectID = "YOUR MI OBJECTID"
Get-MgServicePrincipal -ServicePrincipalId $ObjectID | Select-Object AlternativeNames

Any differences you notice compared to a working managed identity would be extremely useful for further analysis.

Thanks again for taking the time to report this and for your help in troubleshooting.

[zh54321]

Hi Albert,

I just released an update that includes a safer way of parsing the Managed Identity properties (in particular the fields derived from AlternativeNames). This is the area I suspect is triggering the “You cannot call a method on a null-valued expression” error when the script hits a managed identity with an unexpected or empty value.

Could you please pull the latest version and run the script again?

If the issue still reproduces, it would help a lot if you could share:

• Your PowerShell version (Windows PowerShell 5.1 vs PowerShell 7.x)
• If the total number of managed identities reported by the script correct (12580)?
• Confirm whether the MI row has an empty IsExplicit or empty Object Path in the HTML report)

Cheers