Fix national/sovereign cloud exports hitting commercial Graph endpoint (#117)

[eduardarbona (earbona23)]

Problem

On a national/sovereign cloud tenant (GCC-High / USGov, USGovDoD, China, ...) Export-Entra fails with:

401 Unauthorized
{"error":{"code":"InvalidAuthenticationToken","message":"InvalidCloudInstance", ...}}
POST https://graph.microsoft.com/v1.0/$batch

even though Connect-EntraExporter/Connect-MgGraph -Environment 'USGov' authenticated correctly. Rolling back to 2.0.7 works. (Fixes #117)

Root cause

src/internal/Invoke-GraphBatchRequest.ps1 hardcodes the base Graph URI:

$uri = "https://graph.microsoft.com"
$requestUri = "$uri/$graphVersion/`$batch"

That absolute URI is handed to Invoke-MgRestMethod, which targets it verbatim instead of resolving against the connected environment's Graph host. So every batch request (and the whole export, since 3.x batches everything) goes to the commercial cloud regardless of the environment you connected to — the token is valid, but for the wrong cloud instance → InvalidCloudInstance. The paginated @odata.nextLink host stripping on line ~332 was hardcoded to the same commercial host.

Fix

Resolve the Graph endpoint from the currently connected environment and use it for both the $batch URI and the nextLink host stripping:

$mgContext = Get-MgContext
if ($mgContext -and $mgContext.Environment) {
    $graphEndpoint = (Get-MgEnvironment -Name $mgContext.Environment -ErrorAction SilentlyContinue).GraphEndpoint
}
if (-not $graphEndpoint) { $graphEndpoint = "https://graph.microsoft.com" }

This defers the endpoint list to the Graph SDK's own environment table (Get-MgEnvironment), so USGov → graph.microsoft.us, USGovDoD → dod-graph.microsoft.us, China → microsoftgraph.chinacloudapi.cn, and any future sovereign cloud the SDK adds all work with no further changes. Commercial cloud behavior is unchanged, and an unresolvable environment falls back to the commercial endpoint.

Only Microsoft.Graph.Authentication cmdlets already required by the module are used (Get-MgContext, Get-MgEnvironment) — no new dependency.

Verification

• Parser.ParseFile — no syntax errors.

• PSScriptAnalyzer — no new findings on the changed lines (only pre-existing repo-wide alias/Write-Host warnings remain).

• Functional test dot-sourcing the function with mocked Get-MgContext/Get-MgEnvironment/Invoke-MgRestMethod, asserting the resulting $batch URI per environment:

  Environment	Resolved $batch URI
  USGov	https://graph.microsoft.us/v1.0/$batch
  USGovDoD	https://dod-graph.microsoft.us/v1.0/$batch
  China	https://microsoftgraph.chinacloudapi.cn/v1.0/$batch
  Global	https://graph.microsoft.com/v1.0/$batch
  (unresolvable)	https://graph.microsoft.com/v1.0/$batch (fallback)

Related: #118 (updating Connect-EntraExporter's sovereign cloud handling) is addressed separately.

[eduardarbona (earbona23)]

Sam Erde (@SamErde) Merill Fernando (@merill) — this fixes the endpoint issue filed in #117: Connect-EntraExporter builds the Graph base URL from the commercial cloud regardless of the environment passed, so sovereign/national tenants export against graph.microsoft.com instead of their own endpoint.

The change is small and the companion docs PR is #123, which covers #118. Both are green and merge cleanly. Whenever there's a window for triage, I'm around to adjust anything.