IntuneAppConfigurationPolicy: Test of removal fails

[ricmestre]

Details of the scenario you tried and the problem that is occurring

IntuneAppConfigurationPolicy can be deployed, updated and removed, the tests work for deployment and updating but after removal it complains that the resource is not in desired state. Looking at logs it shows the policy has being present in the tenant where in fact it actually got removed so there's something fishy going on in either Test or Get functions and the Ensure property.

Verbose logs showing the problem

<M365DSCEvent>
    <ConfigurationDrift Source="MSFT_IntuneAppConfigurationPolicy">
        <ParametersNotInDesiredState>
            <Param Name="Ensure"><CurrentValue>Present</CurrentValue><DesiredValue>Absent</DesiredValue></Param>
        </ParametersNotInDesiredState>
    </ConfigurationDrift>
    <DesiredValues>
        <Param Name ="DisplayName">ContosoNew</Param>
        <Param Name ="Description">New Contoso Policy</Param>
        <Param Name ="Ensure">Absent</Param>
        <Param Name ="CertificateThumbprint">REDACTED</Param>
        <Param Name ="Verbose">True</Param>
    </DesiredValues>

Suggested solution to the issue

Make sure that Ensure property is correctly checked.

The DSC configuration that is used to reproduce the issue (as detailed as possible)

Configuration IntuneAppConfigurationPolicy
{
    Param(
        [Parameter(Mandatory)]
        [String]$ApplicationId,
        [Parameter(Mandatory)]
        [String]$CertThumbprint,
        [Parameter(Mandatory)]
        [String]$TenantId
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        IntuneAppConfigurationPolicy 'AppConfigPolicy'
        {
            CustomSettings       = @(
                MSFT_IntuneAppConfigurationPolicyCustomSetting { 
                    name  = 'com.microsoft.intune.mam.managedbrowser.AppProxyRedirection'
                    value = 'false'
                }
                MSFT_IntuneAppConfigurationPolicyCustomSetting { 
                    name  = 'com.microsoft.intune.mam.managedbrowser.AllowTransitionOnBlock'
                    value = 'true'
                }
                MSFT_IntuneAppConfigurationPolicyCustomSetting { 
                    name  = 'com.microsoft.outlook.Contacts.LocalSyncEnabled'
                    value = 'true'
                }
                MSFT_IntuneAppConfigurationPolicyCustomSetting { 
                    name  = 'com.microsoft.outlook.Contacts.LocalSyncEnabled.UserChangeAllowed'
                    value = 'true'
                });
            DisplayName           = 'ContosoNew'
            Description           = 'New Contoso Policy'
            Ensure                = 'Present'
            ApplicationId         = $ApplicationId
            CertificateThumbprint = $CertThumbprint
            TenantId              = $TenantId
        }
    }
}

The operating system the target node is running

OsName : Microsoft Windows 10 Enterprise OsOperatingSystemSKU : EnterpriseEdition OsArchitecture : 64-bit WindowsVersion : 2009 WindowsBuildLabEx : 19041.1.amd64fre.vb_release.191206-1406 OsLanguage : en-US OsMuiLanguages : {en-US}

Version of the DSC module that was used ('dev' if using current dev branch)

1.23.726.1

[ricmestre]

Note, of course the config I used to remove the policy (and test afterwards) has the property Ensure set to Absent and not Present.