Filter interaction with '+' in string literals

[zwittgens]

Describe the bug

Issue

Passing filters to (at the very least, haven't tested others) Get-MgBetaDeviceAppManagementMobileApp which contain a term filtering on a string containing a '+' followed by a term wrapped in parentheses results in incorrect return results.
Version: 2.35.1

Examples

I have two win32 apps called "PMPC - Notepad++" and "PMPC - Test"

Notepad++
Get-MgBetaDeviceAppManagementMobileApp -Filter "(DisplayName eq 'PMPC - Notepad++') and (isof('microsoft.graph.win32LobApp'))"
Returns no matching apps

Get-MgBetaDeviceAppManagementMobileApp -Filter "(DisplayName eq 'PMPC - Notepad++') and isof('microsoft.graph.win32LobApp')"
Returns the proper app

Notepad++ URL-encoded
Get-MgBetaDeviceAppManagementMobileApp -Filter "(DisplayName eq 'PMPC - Notepad%2B%2B') and (isof('microsoft.graph.win32LobApp'))"
Returns no matching apps

Get-MgBetaDeviceAppManagementMobileApp -Filter "(DisplayName eq 'PMPC - Notepad%2B%2B') and isof('microsoft.graph.win32LobApp')"
Returns the proper app

Test App (no +)
Get-MgBetaDeviceAppManagementMobileApp -Filter "(DisplayName eq 'PMPC - Test') and (isof('microsoft.graph.win32LobApp'))"
Returns the proper app

Get-MgBetaDeviceAppManagementMobileApp -Filter "(DisplayName eq 'PMPC - Test') and isof('microsoft.graph.win32LobApp')"
Returns the proper app

I have tried with other combinations of filter components, including creating more complex nested filters on the right-hand side of the "and" term to see if parentheses begin working when required by syntax, but all attempts result in the same behavior. It appears that the set of parentheses is somehow causing the URI to resolve the plus to a space, while without the parentheses it properly resolves to %2B

Expected behavior

Can filter on string literals containing a '+' without having to worry about the structure of the rest of the filter query.

How to reproduce

1. Create an app/configuration containing a "+' in the DisplayName. ie, Notepad++
2. Use the proper Get- command to filter on that app following the structure
   Get-MgBetaX -Filter "({component 1 containing a '+' string literal}) and ({any other filter component})"

SDK Version

2.35.1

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output

Click to expand log

``` COMMAND THAT DOESN'T WORK PS C:\Windows\System32> Get-MgBetaDeviceAppManagementMobileApp -Filter "(DisplayName eq 'PMPC - Notepad++') and (isof('microsoft.graph.win32LobApp'))" -debug DEBUG: [CmdletBeginProcessing]: - Get-MgBetaDeviceAppManagementMobileApp begin processing with parameterSet 'List'. DEBUG: [Authentication]: - AuthType: 'Delegated', TokenCredentialType: 'InteractiveBrowser', ContextScope: 'CurrentUser', AppName: 'Microsoft Graph Command Line Tools'. DEBUG: [Authentication]: - Scopes: [DeviceManagementApps.Read.All, Domain.Read.All, email, openid, profile, User.Read]. DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/beta/deviceAppManagement/mobileApps?$filter=%28DisplayName eq %27PMPC - Notepad %27%29 and %28isof%28%27microsoft.graph.win32LobApp%27%29%29

Headers:
FeatureFlag : 00000003
Cache-Control : no-store, no-cache
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.19045; en-US),PowerShell/7.5.4
SdkVersion : graph-powershell-beta/2.35.1
client-request-id : x
Accept-Encoding : gzip,deflate,br

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : x
client-request-id : x
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"East US 2","Slice":"E","Ring":"5","ScaleUnit":"006","RoleInstance":"x"}}
odata-version : 4.0
Date : Mon, 09 Feb 2026 22:36:15 GMT

Body:
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceAppManagement/mobileApps",
"@odata.count": 0,
"value": []
}

DEBUG: [CmdletEndProcessing]: - Get-MgBetaDeviceAppManagementMobileApp end processing.

COMMAND THAT WORKS
PS C:\Windows\System32> Get-MgBetaDeviceAppManagementMobileApp -Filter "(DisplayName eq 'PMPC - Notepad++') and isof('microsoft.graph.win32LobApp')" -debug
DEBUG: [CmdletBeginProcessing]: - Get-MgBetaDeviceAppManagementMobileApp begin processing with parameterSet 'List'.
DEBUG: [Authentication]: - AuthType: 'Delegated', TokenCredentialType: 'InteractiveBrowser', ContextScope: 'CurrentUser', AppName: 'Microsoft Graph Command Line Tools'.
DEBUG: [Authentication]: - Scopes: [DeviceManagementApps.Read.All, Domain.Read.All, email, openid, profile, User.Read].
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/beta/deviceAppManagement/mobileApps?$filter=%28DisplayName eq %27PMPC - Notepad%2B%2B%27%29 and isof%28%27microsoft.graph.win32LobApp%27%29

Headers:
FeatureFlag : 00000003
Cache-Control : no-store, no-cache
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.19045; en-US),PowerShell/7.5.4
SdkVersion : graph-powershell-beta/2.35.1
client-request-id : x
Accept-Encoding : gzip,deflate,br

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : x
client-request-id : x
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Canada East","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"x"}}
odata-version : 4.0
Date : Mon, 09 Feb 2026 22:40:53 GMT

Body:
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceAppManagement/mobileApps",
"@odata.count": 0,
"value": [
{
"@odata.type": "#microsoft.graph.win32LobApp",
"id": "x",
"displayName": "PMPC - Notepad++",
"description": "test app for https://github.com//issues/3522",
"publisher": "test",
"largeIcon": null,
"createdDateTime": "2026-02-09T22:12:19Z",
"lastModifiedDateTime": "2026-02-09T22:12:19Z",
"isFeatured": false,
"privacyInformationUrl": "",
"informationUrl": null,
"owner": "",
"developer": "",
"notes": "",
"uploadState": 1,
"publishingState": "published",
"isAssigned": false,
"roleScopeTagIds": [],
"dependentAppCount": 0,
"supersedingAppCount": 0,
"supersededAppCount": 0,
"committedContentVersion": "1",
"fileName": "test.intunewin",
"size": 163206208,
"installCommandLine": "Write-Host "Test"",
"uninstallCommandLine": "Write-Host "Test"",
"applicableArchitectures": "x86,x64",
"allowedArchitectures": null,
"minimumFreeDiskSpaceInMB": null,
"minimumMemoryInMB": null,
"minimumNumberOfProcessors": null,
"minimumCpuSpeedInMHz": null,
"msiInformation": null,
"setupFilePath": "Obsidian.exe",
"minimumSupportedWindowsRelease": "Windows11_24H2",
"displayVersion": "",
"allowAvailableUninstall": true,
"activeInstallScript": null,
"activeUninstallScript": null,
"minimumSupportedOperatingSystem": {
"v8_0": false,
"v8_1": false,
"v10_0": false,
"v10_1607": false,
"v10_1703": false,
"v10_1709": false,
"v10_1803": false,
"v10_1809": false,
"v10_1903": false,
"v10_1909": false,
"v10_2004": false,
"v10_2H20": false,
"v10_21H1": false
},
"detectionRules": [
{
"@odata.type": "#microsoft.graph.win32LobAppFileSystemDetection",
"path": "C:\",
"fileOrFolderName": "Program Files",
"check32BitOn64System": false,
"detectionType": "exists",
"operator": "notConfigured",
"detectionValue": null
}
],
"requirementRules": [],
"rules": [
{
"@odata.type": "#microsoft.graph.win32LobAppFileSystemRule",
"ruleType": "detection",
"path": "C:\",
"fileOrFolderName": "Program Files",
"check32BitOn64System": false,
"operationType": "exists",
"operator": "notConfigured",
"comparisonValue": null
}
],
"installExperience": {
"runAsAccount": "system",
"maxRunTimeInMinutes": 60,
"deviceRestartBehavior": "allow"
},
"returnCodes": [
{
"returnCode": 0,
"type": "success"
},
{
"returnCode": 1707,
"type": "success"
},
{
"returnCode": 3010,
"type": "softReboot"
},
{
"returnCode": 1641,
"type": "hardReboot"
},
{
"returnCode": 1618,
"type": "retry"
}
]
}
]
}

DEBUG: [CmdletEndProcessing]: - Get-MgBetaDeviceAppManagementMobileApp end processing.
Id CreatedDateTime DependentAppCount Description

---

x 2/9/2026 10:12:19 PM 0 test app for https://github.com/microsoftg…

</details>

### Configuration
powershell 7.5.4 core, windows 10.0.26100

### Other information
Of note in the debug output is the difference in absolute URIs that get evaluated

[MIchaelMainer]

Can you run the commands with --debug and share the sanitized results in the Debug output section above?

[zwittgens]

Debug output added. Forgive my atrocious formatting, it seems whitespace gets squashed when rendering it, which messes with the debug output in a way that matters (since pluses in string literals are being erroneously evaluated to spaces under certain conditions). Below I've pulled out the commands run and the absolute URI they generate

Get-MgBetaDeviceAppManagementMobileApp -Filter "(DisplayName eq 'PMPC - Notepad++') and (isof('microsoft.graph.win32LobApp'))"
https://graph.microsoft.com/beta/deviceAppManagement/mobileApps?$filter=%28DisplayName eq %27PMPC - Notepad  %27%29 and %28isof%28%27microsoft.graph.win32LobApp%27%29%29
(there should be two spaces between "Notepad" and "%27" here)

Get-MgBetaDeviceAppManagementMobileApp -Filter "(DisplayName eq 'PMPC - Notepad++') and isof('microsoft.graph.win32LobApp')"
https://graph.microsoft.com/beta/deviceAppManagement/mobileApps?$filter=%28DisplayName eq %27PMPC - Notepad%2B%2B%27%29 and isof%28%27microsoft.graph.win32LobApp%27%29