Merge pull request #3986 from microsoft/Dev

Release 1.23.1129.1
microsoft · Nov 30, 2023 · f412344 · f412344
2 parents 9eee82c + 396f024
commit f412344
Show file tree

Hide file tree

Showing 51 changed files with 1,319 additions and 552 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,70 @@
 # Change log for Microsoft365DSC
 
+# 1.23.1129.1
+
+* AADRoleSetting
+  * Export sorted by DisplayName for better comparison
+  * Enable Filter property to be used on export
+    FIXES [#3919](https://github.com/microsoft/Microsoft365DSC/issues/3919)
+* AADUser
+  * Added the MemberOf Property.
+* IntuneAntivirusPolicyWindows10SettingCatalog
+  * Skipped settingValueTemplateReference and settingInstanceTemplateReference
+    for severethreats, highseveritythreats, moderateseveritythreats,
+    lowseveritythreats as per API requirements observed in the Intune portal.
+    FIXES [#3818](https://github.com/microsoft/Microsoft365DSC/issues/3818)
+    FIXES [#3955](https://github.com/microsoft/Microsoft365DSC/issues/3955)
+* IntuneAccountProtectionLocalAdministratorPasswordSolutionPolicy,
+  IntuneAccountProtectionLocalUserGroupMembershipPolicy,
+  IntuneAccountProtectionPolicy,
+  * Fixes export if Assignments is set on existing policies
+    FIXES [3913](https://github.com/microsoft/Microsoft365DSC/issues/3913)
+  * Add groupDisplayName to Assignments embedded instance
+* IntuneDeviceConfigurationDeliveryOptimizationPolicyWindows10,
+  IntuneDeviceConfigurationHealthMonitoringConfigurationPolicyWindows10,
+  IntuneDeviceConfigurationIdentityProtectionPolicyWindows10,
+  IntuneDeviceConfigurationEndpointProtectionPolicyWindows10,
+  IntuneDeviceEnrollmentStatusPageWindows10,
+  IntuneWindowsAutopilotDeploymentProfileAzureADHybridJoined,
+  IntuneWindowsAutopilotDeploymentProfileAzureADJoined
+  * Removed Id and all authentication parameters from PSBoundParameters in Test-TargetResource
+    FIXES [#3888](https://github.com/microsoft/Microsoft365DSC/issues/3888)
+* IntuneWindowsAutopilotDeploymentProfileAzureADJoined
+  * Modified assigned to use sdk instead of API call and added logic to use groupDisplayName in assignment
+    FIXES [#3921](https://github.com/microsoft/Microsoft365DSC/issues/3921)
+* IntuneDeviceEnrollmentStatusPageWindows10
+  * Fixed assignments using API call
+    FIXES [#3921](https://github.com/microsoft/Microsoft365DSC/issues/3921)
+* IntuneWindowsAutopilotDeploymentProfileAzureADHybridJoined
+  * Modified assigned to use sdk instead of API call and added logic to use groupDisplayName in assignment
+    FIXES [#3892](https://github.com/microsoft/Microsoft365DSC/issues/3892)
+* IntuneWindowsAutopilotDeploymentProfileAzureADJoined
+  * Modified assigned to use sdk instead of API call and added logic to use groupDisplayName in assignment
+    FIXES [#3892](https://github.com/microsoft/Microsoft365DSC/issues/3892)
+* IntuneWindowsUpdateForBusinessRingUpdateProfileWindows10
+  * Modified assigned to use sdk instead of API call and added logic to use groupDisplayName in assignment
+* IntuneDeviceConfigurationPolicyWindows10
+    FIXES [#3921](https://github.com/microsoft/Microsoft365DSC/issues/3921)
+* IntuneDeviceEnrollmentStatusPageWindows10
+  * Fixed assignments using API call
+    FIXES [#3921](https://github.com/microsoft/Microsoft365DSC/issues/3921)
+* TeamsMessagingPolicy
+  * Added support for properties AllowCommunicationComplianceEndUserReporting,
+    AllowFluidCollaborate and AllowSecurityEndUserReporting.
+    FIXES [#3968](https://github.com/microsoft/Microsoft365DSC/issues/3968)
+* TeamsTeam
+  * Fixes incompatible type for ComplianceRecordingApplications, expected string[] but receive object[]
+    FIXES: [#3890](https://github.com/microsoft/Microsoft365DSC/issues/3890)
+* DEPENDENCIES
+  * Updated DSCParser to version 1.4.0.1.
+  * Updated Microsoft.Graph to version 2.10.0.
+  * Updated MSCloudLoginAssistant to version 1.1.0.
+* MISC
+  * M365DSCDRGUtil
+    * Added ConvertFrom-IntunePolicyAssignment and ConvertTo-IntunePolicyAssignment
+      FIXES [#3892](https://github.com/microsoft/Microsoft365DSC/issues/3892)
+  * Support for Multi-Tenancy (Credentials + TenantId).
+
 # 1.23.1122.1
 
 * SPOSharingSettings

diff --git a/Modules/Microsoft365DSC/DSCResources/MSFT_AADAttributeSet/MSFT_AADAttributeSet.psm1 b/Modules/Microsoft365DSC/DSCResources/MSFT_AADAttributeSet/MSFT_AADAttributeSet.psm1
@@ -363,13 +363,19 @@ function Export-TargetResource
     }
     catch
     {
-        Write-Host $Global:M365DSCEmojiRedX
-
-        New-M365DSCLogEntry -Message 'Error during Export:' `
+        if ($_.ErrorDetails.Message -like "*Insufficient privileges*")
+        {
+            Write-Host "`r`n    $($Global:M365DSCEmojiYellowCircle) Insufficient permissions or license to export Attribute Sets."
+        }
+        else
+        {
+            Write-Host $Global:M365DSCEmojiRedX
+            New-M365DSCLogEntry -Message 'Error during Export:' `
             -Exception $_ `
             -Source $($MyInvocation.MyCommand.Source) `
             -TenantId $TenantId `
             -Credential $Credential
+        }
 
         return ''
     }

diff --git a/Modules/Microsoft365DSC/DSCResources/MSFT_AADAttributeSet/settings.json b/Modules/Microsoft365DSC/DSCResources/MSFT_AADAttributeSet/settings.json
@@ -3,10 +3,10 @@
     "description": "Represents a group of related custom security attribute definitions.",
     "roles": {
         "read": [
-            "Security Reader"
+            "Attribute Definition Reader"
         ],
         "update": [
-            "Authentication Policy Administrator"
+            "Attribute Definition Administrator"
         ]
     },
     "permissions": {

diff --git a/Modules/Microsoft365DSC/DSCResources/MSFT_AADGroup/Readme.md b/Modules/Microsoft365DSC/DSCResources/MSFT_AADGroup/Readme.md
@@ -3,3 +3,5 @@
 ## Description
 
 This resource configures an Azure Active Directory group. IMPORTANT: It does not support mail enabled security groups or mail enabled groups that are not unified or dynamic groups.
+
+If using with AADUser, be aware that if AADUser->MemberOf is being specified and the referenced group is configured with AADGroup->Member then a conflict may arise if the two don't match. It is usually best to choose only one of them. See AADUser
diff --git a/...ources/MSFT_AADRoleEligibilityScheduleRequest/MSFT_AADRoleEligibilityScheduleRequest.psm1 b/...ources/MSFT_AADRoleEligibilityScheduleRequest/MSFT_AADRoleEligibilityScheduleRequest.psm1
@@ -188,6 +188,14 @@
         }
         if ($null -eq $schedule -or $null -eq $request)
         {
+            if ($null -eq $schedule)
+            {
+                Write-Verbose -Message "Could not retrieve the schedule for {$($request.PrincipalId)} & RoleDefinitionId {$RoleDefinitionId}"
+            }
+            if ($null -eq $request)
+            {
+                Write-Verbose -Message "Could not request the schedule for {$RoleDefinition}"
+            }
             return $nullResult
         }
 
@@ -211,6 +219,7 @@
 
         if ($null -eq $PrincipalInstance)
         {
+            Write-Verbose -Message "Couldn't retrieve Principal {$($request.PrincipalId)}"
             return $nullResult
         }
 
@@ -298,7 +307,7 @@
     }
     catch
     {
-        Write-Verbose "Verbose: $($_.ErrorDetails.Message)"
+        Write-Verbose "Error: $($_.ErrorDetails.Message)"
         New-M365DSCLogEntry -Message 'Error retrieving data:' `
             -Exception $_ `
             -Source $($MyInvocation.MyCommand.Source) `
@@ -814,15 +823,20 @@ function Export-TargetResource
     }
     catch
     {
-        Write-Verbose -Message "Exception: $($_.Exception.Message)"
-
-        Write-Host $Global:M365DSCEmojiRedX
-
-        New-M365DSCLogEntry -Message 'Error during Export:' `
-            -Exception $_ `
-            -Source $($MyInvocation.MyCommand.Source) `
-            -TenantId $TenantId `
-            -Credential $Credential
+        if ($_.ErrorDetails.Message -like "*The tenant needs an AAD Premium*")
+        {
+            Write-Host "`r`n    $($Global:M365DSCEmojiYellowCircle) Tenant does not meet license requirement to extract this component."
+        }
+        else
+        {
+            Write-Verbose -Message "Exception: $($_.Exception.Message)"
+            Write-Host $Global:M365DSCEmojiRedX
+            New-M365DSCLogEntry -Message 'Error during Export:' `
+                -Exception $_ `
+                -Source $($MyInvocation.MyCommand.Source) `
+                -TenantId $TenantId `
+                -Credential $Credential
+        }
 
         return ''
     }

diff --git a/Modules/Microsoft365DSC/DSCResources/MSFT_AADRoleSetting/MSFT_AADRoleSetting.psm1 b/Modules/Microsoft365DSC/DSCResources/MSFT_AADRoleSetting/MSFT_AADRoleSetting.psm1
@@ -1283,6 +1283,7 @@ function Test-TargetResource
         [Switch]
         $ManagedIdentity
     )
+    $Script:ExportMode = $false
 
     #Ensure the proper dependencies are installed in the current environment.
     Confirm-M365DSCDependencies
@@ -1379,7 +1380,7 @@ function Export-TargetResource
     try
     {
         $Script:ExportMode = $true
-        [array] $Script:exportedInstances = Get-MgBetaRoleManagementDirectoryRoleDefinition -ErrorAction Stop
+        [array] $Script:exportedInstances = Get-MgBetaRoleManagementDirectoryRoleDefinition -Filter $Filter -Sort DisplayName -ErrorAction Stop
         $i = 1
         $dscContent = ''
         Write-Host "`r`n" -NoNewline

diff --git a/Modules/Microsoft365DSC/DSCResources/MSFT_AADUser/MSFT_AADUser.psm1 b/Modules/Microsoft365DSC/DSCResources/MSFT_AADUser/MSFT_AADUser.psm1
@@ -28,6 +28,10 @@ function Get-TargetResource
         [System.String[]]
         $LicenseAssignment,
 
+        [Parameter()]
+        [System.String[]]
+        $MemberOf,
+
         [Parameter()]
         [System.Management.Automation.PSCredential]
         $Password,
@@ -150,6 +154,7 @@ function Get-TargetResource
         LastName              = $null
         UsageLocation         = $null
         LicenseAssignment     = $null
+        MemberOf              = $null
         Password              = $null
         Credential            = $Credential
         ApplicationId         = $ApplicationId
@@ -187,6 +192,9 @@ function Get-TargetResource
             $currentLicenseAssignment += $sku.SkuPartNumber
         }
 
+        # return membership of static groups only
+        [array]$currentMemberOf = (Get-MgUserMemberOfAsGroup -UserId $UserPrincipalName -All | Where-Object -FilterScript {$_.GroupTypes -notcontains 'DynamicMembership'}).DisplayName
+
         $userPasswordPolicyInfo = $user | Select-Object UserprincipalName, @{
             N = 'PasswordNeverExpires'; E = { $_.PasswordPolicies -contains 'DisablePasswordExpiration' }
         }
@@ -216,6 +224,7 @@ function Get-TargetResource
             LastName              = $user.Surname
             UsageLocation         = $user.UsageLocation
             LicenseAssignment     = $currentLicenseAssignment
+            MemberOf              = $currentMemberOf
             Password              = $Password
             City                  = $user.City
             Country               = $user.Country
@@ -283,6 +292,10 @@ function Set-TargetResource
         [System.String[]]
         $LicenseAssignment,
 
+        [Parameter()]
+        [System.String[]]
+        $MemberOf,
+
         [Parameter()]
         [System.Management.Automation.PSCredential]
         $Password,
@@ -559,6 +572,79 @@ function Set-TargetResource
         }
         #endregion
 
+        #region Update MemberOf groups - if specified
+        if ($null -ne $MemberOf)
+        {
+            if ($null -eq $user.MemberOf)
+            {
+                # user is not currently a member of any groups, add user to groups listed in MemberOf
+                foreach ($memberOfGroup in $MemberOf)
+                {
+                    $group = Get-MgGroup -Filter "DisplayName eq '$memberOfGroup'" -Property Id, GroupTypes
+                    if ($null -eq $group)
+                    {
+                        New-M365DSCLogEntry -Message 'Error updating data:' `
+                        -Exception "Attempting to add a user to a group that doesn't exist" `
+                        -Source $($MyInvocation.MyCommand.Source) `
+                        -TenantId $TenantId `
+                        -Credential $Credential
+
+                        throw "Group '$memberOfGroup' does not exist in tenant"
+                    }
+                    if ($group.GroupTypes -contains 'DynamicMembership')
+                    {
+                        New-M365DSCLogEntry -Message 'Error updating data:' `
+                        -Exception "Attempting to add a user to a dynamic group" `
+                        -Source $($MyInvocation.MyCommand.Source) `
+                        -TenantId $TenantId `
+                        -Credential $Credential
+
+                        throw "Cannot add user $UserPrincipalName to group '$memberOfGroup' because it is a dynamic group"
+                    }
+                    New-MgGroupMember -GroupId $group.Id -DirectoryObjectId $user.Id
+                }
+            }
+            else
+            {
+                # user is a member of some groups, ensure that user is only a member of groups listed in MemberOf
+                Compare-Object -ReferenceObject $MemberOf -DifferenceObject $user.MemberOf | ForEach-Object {
+                    $group = Get-MgGroup -Filter "DisplayName eq '$($_.InputObject)" -Property Id, GroupTypes
+                    if ($_.SideIndicator -eq '<=')
+                    {
+                        # Group in MemberOf not present in groups that user is a member of, add user to group
+                        if ($null -eq $group)
+                        {
+                            New-M365DSCLogEntry -Message 'Error updating data:' `
+                            -Exception "Attempting to add a user to a group that doesn't exist" `
+                            -Source $($MyInvocation.MyCommand.Source) `
+                            -TenantId $TenantId `
+                            -Credential $Credential
+
+                            throw "Group '$($_.InputObject)' does not exist in tenant"
+                        }
+                        if ($group.GroupTypes -contains 'DynamicMembership')
+                        {
+                            New-M365DSCLogEntry -Message 'Error updating data:' `
+                            -Exception "Attempting to add a user to a dynamic group" `
+                            -Source $($MyInvocation.MyCommand.Source) `
+                            -TenantId $TenantId `
+                            -Credential $Credential
+
+                            throw "Cannot add user $UserPrincipalName to group '$($_.InputObject)' because it is a dynamic group"
+                        }
+                        New-MgGroupMember -GroupId $group.Id -DirectoryObjectId $user.Id
+                    }
+                    else
+                    {
+                        # Group that user is a member of is not present in MemberOf, remove user from group
+                        # (no need to test for dynamic groups as they are ignored in Get-TargetResource)
+                        Remove-MgGroupMemberByRef -GroupId $group.Id -DirectoryObjectId $user.Id
+                    }
+                }
+            }
+        }
+        #endregion
+
         #region Roles
         if ($null -ne $Roles)
         {
@@ -633,6 +719,10 @@ function Test-TargetResource
         [System.String[]]
         $LicenseAssignment,
 
+        [Parameter()]
+        [System.String[]]
+        $MemberOf,
+
         [Parameter()]
         [System.Management.Automation.PSCredential]
         $Password,

diff --git a/Modules/Microsoft365DSC/DSCResources/MSFT_AADUser/MSFT_AADUser.schema.mof b/Modules/Microsoft365DSC/DSCResources/MSFT_AADUser/MSFT_AADUser.schema.mof
@@ -13,6 +13,7 @@ class MSFT_AADUser : OMI_BaseResource
     [Write, Description("The Country name of the user")] String Country;
     [Write, Description("The Department name of the user")] String Department;
     [Write, Description("The Fax Number of the user")] String Fax;
+    [Write, Description("The Groups that the user is a direct member of")] String MemberOf[];
     [Write, Description("The Mobile Phone Number of the user")] String MobilePhone;
     [Write, Description("The Office Name of the user")] String Office;
     [Write, Description("Specifies whether the user password expires periodically. Default value is false")] Boolean PasswordNeverExpires;

diff --git a/Modules/Microsoft365DSC/DSCResources/MSFT_AADUser/readme.md b/Modules/Microsoft365DSC/DSCResources/MSFT_AADUser/readme.md
@@ -2,4 +2,6 @@
 
 ## Description
 
-This resource allows users to create Azure AD Users and assign them licenses.
+This resource allows users to create Azure AD Users and assign them licenses, roles and/or groups.
+
+If using with AADGroup, be aware that if AADUser->MemberOf is being specified and the referenced group is configured with AADGroup->Member then a conflict may arise if the two don't match. It is usually best to choose only one of them. See AADGroup
diff --git a/Modules/Microsoft365DSC/DSCResources/MSFT_AADUser/settings.json b/Modules/Microsoft365DSC/DSCResources/MSFT_AADUser/settings.json
@@ -16,6 +16,12 @@
                     },
                     {
                         "name": "User.Read.All"
+                    },
+                    {
+                        "name": "Group.Read.All"
+                    },
+                    {
+                        "name": "GroupMember.Read.All"
                     }
                 ],
                 "update": [
@@ -31,9 +37,22 @@
                     {
                         "name": "User.Read.All"
                     },
+                    {
+                        "name": "Group.Read.All"
+                    },
+                    {
+                        "name": "GroupMember.Read.All"
+                    },
                     {
                         "name": "User.ReadWrite.All"
+                    },
+                    {
+                        "name": "Group.ReadWrite.All"
+                    },
+                    {
+                        "name": "GroupMember.ReadWrite.All"
                     }
+
                 ]
             },
             "application": {

diff --git a/...dSolutionPolicy/MSFT_IntuneAccountProtectionLocalAdministratorPasswordSolutionPolicy.psm1 b/...dSolutionPolicy/MSFT_IntuneAccountProtectionLocalAdministratorPasswordSolutionPolicy.psm1
@@ -752,7 +752,7 @@ function Export-TargetResource
 
                 if ($Results.Assignments)
                 {
-                    $complexTypeStringResult = Get-M365DSCDRGComplexTypeToString -ComplexObject ([Array]$Results.Assignments) -CIMInstanceName DeviceManagementConfigurationPolicyAssignments
+                    $complexTypeStringResult = Get-M365DSCDRGComplexTypeToString -ComplexObject ([Array]$Results.Assignments) -CIMInstanceName IntuneAccountProtectionLocalAdministratorPasswordSolutionPolicyAssignments
                     if ($complexTypeStringResult)
                     {
                         $Results.Assignments = $complexTypeStringResult