Azure-docs: Get-AzPolicyState only returns only 1000 results

[iceyokuna]

The problem is "Get-AzPolicyState" is return only 1000 results by default.
So, i use -top parameter to get more data but when i try with "-top 3000", its worked!!.
But when i change value to 5000, it didnot work with error "ResponseTooLarge: The query response exceeded the allowed size"

command
get-azpolicystate -ManagementGroupName "{my tenant id}" -top 5000

Error message
get-azpolicystate : Operation returned an invalid status code 'BadRequest' (ResponseTooLarge: The query response exceeded the allowed size. Please update your query to return fewer results.)
At line:1 char:1

• get-azpolicystate -ManagementGroupName " ...
• CategoryInfo : CloseError: (:) [Get-AzPolicyState], Exception
• FullyQualifiedErrorId : Microsoft.Azure.Commands.PolicyInsights.Cmdlets.GetAzureRmPolicyState

I want to get all of policy state at tenant level - it gonna exceed 5000 results for sure.
Are there anyway to get it because i dont want to loop and get policy state data of each subscription.

Thank you.

[TravisCragg-MSFT]

@iceyokuna can you post a link to the doc you are referring to?

[iceyokuna]

@TravisCragg-MSFT Sure - this document below

https://docs.microsoft.com/en-us/powershell/module/az.monitor/get-azdiagnosticsetting

https://github.com/Azure/azure-powershell/blob/master/src/Monitor/Monitor/help/Get-AzDiagnosticSetting.md

[femsulu]

Related to #26325

@iceyokuna - per related thread, "top -5000" should work.. This must've been a recent change to cap at 3000.

Tried searching the REST API browser to see if there's a equivalent API you can query. Nothing jumped out but check out the options here.

Reaching out to the feature team to get confirmation and see if there's a feasible workaround.
Will share an update as soon as I hear back.

@DCtheGeek - FYI

[iceyokuna]

Ok thank you @femsulu , I will check that.
and looking forward for that.

[DCtheGeek]

Pagination isn't currently supported by these SDKs. I know you said you didn't want to loop through each subscription, but if you are using a Management Group hierarchy, then both the REST API and PowerShell cmdlets support specifying a Management Group. In this case, you could query your top level Management Groups (hopefully a small number) and then combine the results from there to get around the limitation of querying an entire tenant worth of data. Note that the limitation isn't only the number of objects returned (Top), it can also be due to the size of those response object. If the response is too large, it won't be returned (which appears to be the issue you hit). Hope that helps!

[iceyokuna]

That helps, Thanks

However, I requested it at subscription level but its already exceeded the size. So, If I request it at management group level, it gonna be failed for sure.

I understand that the response size is too large.

I also have suggestion, It would be great if Microsoft provide export to CSV feature for the policy compliant.

[DCtheGeek]

I want to get all of policy state at tenant level

Sorry @iceyokuna, I read that to mean you wanted to do it at the tenant. In any case, export via CSV would be a feature request, so we ask that you open a suggestion on Azure Governance UserVoice. Thanks!

[iceyokuna]

Thank you very much and appreciate your support.