From 2cdf05a777b3ce14dbe4da1331155a2d5256f2bf Mon Sep 17 00:00:00 2001
From: Ted Kolovos <107076927+tkol2022@users.noreply.github.com>
Date: Wed, 6 Nov 2024 18:17:35 -0500
Subject: [PATCH] improve performance query to get count of users without
 advanced auditing enabled

---
 .../ScubaGear/Modules/Providers/ExportDefenderProvider.psm1   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/PowerShell/ScubaGear/Modules/Providers/ExportDefenderProvider.psm1 b/PowerShell/ScubaGear/Modules/Providers/ExportDefenderProvider.psm1
index dd0fc6da00..7a6a0ffa68 100644
--- a/PowerShell/ScubaGear/Modules/Providers/ExportDefenderProvider.psm1
+++ b/PowerShell/ScubaGear/Modules/Providers/ExportDefenderProvider.psm1
@@ -143,13 +143,13 @@ function Export-DefenderProvider {
         $DLPLicense = ConvertTo-Json $false
     }
 
-    # Run commands to get count of users with Advanced auditing enabled
+    # Get count of users without Advanced auditing enabled
     # GUID below is service plan ID for M365_ADVANCED_AUDITING as defined
     # on Microsoft Licensing Reference shown here:
     # https://learn.microsoft.com/en-us/entra/identity/users/licensing-service-plan-reference
     $UserParameters = @{ConsistencyLevel = 'eventual'
                         Count = 'UsersWithoutAdvancedAuditCount'
-                        All = $true
+                        Top = 1
                         Filter = "not assignedPlans/any(a:a/servicePlanId eq 2f442157-a11c-46b9-ae5b-6e39ff4e5849 and a/capabilityStatus eq 'Enabled')"
                        }