Get-MgGroup/Get-MgBetaGroup: -Filter with 'displayName eq' fails to match names with trailing whitespace/newlines

[areyno08]

Describe the bug

Issue Summary

The -Filter parameter with displayName eq fails to match group names that contain trailing whitespace or newline characters (\r\n), while the same names are successfully matched using startswith() filter. This creates inconsistent behavior and breaks automation scripts that rely on exact name matching.

Root Cause Identified

Groups with names containing invisible trailing whitespace or newline characters cannot be found using the exact match syntax (displayName eq 'Name'), despite being shown in the results when using startswith(displayName,'Name'). This is confirmed by examining the response JSON, which shows \r\n` at the end of the displayName value.

Expected behavior

The filter displayName eq 'Name' should properly match group names regardless of trailing whitespace or newline characters, especially since these characters are often invisible in the admin interfaces and can be difficult to detect.

Alternatively, if exact matching is required including whitespace, then the documentation should clearly state this behavior and provide guidance on handling invisible characters in filter conditions.

How to reproduce

1. Create or identify a group with a name that has trailing whitespace or newline characters (In our case, "AppDevice-Adobe Creative Cloud SDL\r\n")
2. Run Get-MgBetaGroup -Filter "displayName eq 'AppDevice-Adobe Creative Cloud SDL'"
3. Observe that no results are returned despite the group existing
4. Run Get-MgBetaGroup -Filter "startswith(displayName,'AppDevice-Adobe Creative Cloud SDL')" -ConsistencyLevel eventual
5. Observe that the group is found, and the response JSON shows trailing \r\n in the displayName

Confirmed in Graph Explorer: Direct API calls to /beta/groups?$filter=displayName eq 'AppDevice-Adobe Creative Cloud SDL' return no results, while /beta/groups?$filter=startswith(displayName,'AppDevice-Adobe Creative Cloud SDL') returns the group with trailing whitespace.

SDK Version

2.27.0

Latest version known to work for scenario above?

No response

Known Workarounds

1. Use startswith() as a workaround and handle any additional filtering in PowerShell:
   Get-MgBetaGroup -Filter "startswith(displayName,'exact-name')" -ConsistencyLevel eventual

2. Edit the group name in the admin portal to remove trailing whitespace (requires careful editing as the whitespace is invisible).

3. For programmatic access, trim the input string and the strings from the results:
   $name = "AppDevice-Adobe Creative Cloud SDL".Trim()
   Get-MgBetaGroup -Filter "startswith(displayName,'$name')" | Where-Object { $_.DisplayName.Trim() -eq $name }

Debug output

Click to expand log

```

Debug Output

When trying to filter with an exact match:

PS C:\> $DebugPreference = 'Continue'
PS C:\> Get-MgBetaGroup -Filter "displayName eq 'AppDevice-Adobe Creative Cloud SDL'" -ConsistencyLevel eventual
DEBUG: [CmdletBeginProcessing]: - Get-MgBetaGroup begin processing with parameterSet 'List'.
DEBUG: [Authentication]: - AuthType: 'Delegated', TokenCredentialType: 'InteractiveBrowser', ContextScope: 'CurrentUser', AppName: 'Microsoft Graph Command Line Tools'.
DEBUG: ============================ HTTP REQUEST ============================
HTTP Method:
GET
Absolute Uri:
https://graph.microsoft.com/beta/groups?$filter=displayName eq 'AppDevice-Adobe Creative Cloud SDL'
Headers:
ConsistencyLevel              : eventual
FeatureFlag                   : 00000003
Cache-Control                 : no-store, no-cache
User-Agent                    : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.20348; en-US),PowerShell/5.1.20348.2849
SdkVersion                    : graph-powershell-beta/2.27.0
client-request-id             : 5e397xxx-xxxx-xxxx-xxxx-xxxxx9fdeaaf6

DEBUG: ============================ HTTP RESPONSE ============================
Status Code:
OK
Headers:
Transfer-Encoding             : chunked
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : e13d3c12-0d4f-4dab-a66c-7db34c530dd3
client-request-id             : 5e397xxx-xxxx-xxxx-xxxx-xxxxx9fdeaaf6
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"East US","Slice":"E","Ring":"5","ScaleUnit":"000","RoleInstance":"BL6PEPFxxxxxxxx"}}
x-ms-resource-unit            : 1
OData-Version                 : 4.0
Cache-Control                 : no-cache
Date                          : Fri, 09 May 2025 17:04:27 GMT
Body:
{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#groups",
  "value": []
}
DEBUG: [CmdletEndProcessing]: - Get-MgBetaGroup end processing.

## Working Example with startswith()

```powershell
PS C:\> Get-MgBetaGroup -Filter "startswith(displayName,'AppDevice-Adobe Creative Cloud SDL')" -All -ConsistencyLevel eventual
DEBUG: [CmdletBeginProcessing]: - Get-MgBetaGroup begin processing with parameterSet 'List'.
DEBUG: [Authentication]: - AuthType: 'Delegated', TokenCredentialType: 'InteractiveBrowser', ContextScope: 'CurrentUser', AppName: 'Microsoft Graph Command Line Tools'.

DEBUG: ============================ HTTP REQUEST ============================
HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/beta/groups?$filter=startswith(displayName,'AppDevice-Adobe Creative Cloud SDL')

Headers:
ConsistencyLevel              : eventual
FeatureFlag                   : 00000003
Cache-Control                 : no-store, no-cache
User-Agent                    : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.20348; en-US),PowerShell/5.1.20348.2849
SdkVersion                    : graph-powershell-beta/2.27.0
client-request-id             : d75baXXX-XXXX-XXXX-XXXX-XXXX6ec8e1caf

DEBUG: ============================ HTTP RESPONSE ============================
Status Code:
OK

Headers:
Transfer-Encoding             : chunked
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : 548f1c51-8041-4aa5-81f0-d5ee45d19cbd
client-request-id             : d75baXXX-XXXX-XXXX-XXXX-XXXX6ec8e1caf
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"East US 2","Slice":"E","Ring":"5","ScaleUnit":"000","RoleInstance":"XXXXXXXXXX"}}
x-ms-resource-unit            : 1
OData-Version                 : 4.0
Cache-Control                 : no-cache
Date                          : Fri, 09 May 2025 17:07:07 GMT

Body:
{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#groups",
  "value": [
    {
      "id": "384d1eb9-72c1-4cfa-86da-77bd19b1fe96",
      "deletedDateTime": null,
      "classification": null,
      "createdDateTime": "2025-05-07T17:24:45Z",
      "createdByAppId": "3c58XXXX-XXXX-XXXX-XXXX-XXXX71ff5d65",
      "organizationId": "4278XXXX-XXXX-XXXX-XXXX-XXXXa5fcf1e",
      "description": "Current",
      "displayName": "AppDevice-Adobe Creative Cloud SDL\r\n",
      "expirationDateTime": null,
      "groupTypes": [],
      "infoCatalogs": [],
      "isAssignableToRole": null,
      "isManagementRestricted": null,
      "mail": null,
      "mailEnabled": false,
      "mailNickname": "voh2lRTH-j",
      "membershipRule": null,
      "membershipRuleProcessingState": null,
      "onPremisesDomainName": null,
      "onPremisesLastSyncDateTime": null,
      "onPremisesNetBiosName": null,
      "onPremisesObjectIdentifier": null,
      "onPremisesSamAccountName": null,
      "onPremisesSecurityIdentifier": null,
      "onPremisesSyncEnabled": null,
      "preferredDataLocation": null,
      "preferredLanguage": null,
      "proxyAddresses": [],
      "renewedDateTime": "2025-05-07T17:24:45Z",
      "resourceBehaviorOptions": [],
      "resourceProvisioningOptions": [],
      "securityEnabled": true,
      "securityIdentifier": "S-1-12-1-XXXXXXX-XXXXXXX-XXXXXXX-XXXXXXX",
      "theme": null,
      "visibility": null,
      "uniqueName": null,
      "extension_XXX_dags@odata.type": "#Collection(String)",
      "extension_XXX_dags": [
        "046"
      ],
      "extension_XXX_groupControl": "<tags>[Redacted GroupControl XML]</tags>",
      "onPremisesProvisioningErrors": [],
      "serviceProvisioningErrors": [],
      "writebackConfiguration": {
        "isEnabled": null,
        "onPremisesGroupType": null
      }
    }
  ]
}

DEBUG: [CmdletEndProcessing]: - Get-MgBetaGroup end processing.
DisplayName                          Id                                   MailNickname Description GroupTypes
-----------                          --                                   ------------ ----------- ----------
AppDevice-Adobe Creative Cloud SD... 384d1eb9-72c1-4cfa-86da-77bd19b1fe96 voh2lRTH-j   Current     {}

Configuration

Name Value

---

PSVersion 5.1.20348.2849
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.20348.2849
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

Other information

This appears to be an issue with how the Graph API handles whitespace in filter conditions. The trailing whitespace characters are not visible in the admin portal, making this issue particularly difficult to diagnose.

The fact that modifying the group name by removing and re-adding the last character (thereby removing the invisible whitespace) resolves the issue confirms that this is a whitespace handling problem in the filter mechanism, not a general failure of the eq operator.

This issue has significant implications for automation scripts that rely on exact group name matching, as they must now implement additional logic to handle invisible whitespace characters.