AADRoleSetting: "-Filter" parameter doesn't work when using Export-M365DSCConfiguration

[Kierow]

Description of the issue

Hello,

If you try to export only some roles using the Export-M365DSCConfiguration (AADRoleSetting + a Filter), the filter is not taken into account and all roles will be exported.

The issue seems coming from the MSFT_AADRoleSetting DSCResource and more particularly from the Export-TargetResource function. In fact, the parameter $Filter is not used in the below Cmdlet :
[array]$roles = Get-MgRoleManagementDirectoryRoleDefinition -ErrorAction Stop

Maybe a solution would be to simply replace the above command with (there might be better solutions):
[array]$roles = Get-MgRoleManagementDirectoryRoleDefinition -Filter $Filter -ErrorAction Stop

This is my first issue so don't hesitate if you have any questions, I'm not familiar with the process.. :)

Microsoft 365 DSC Version

1.23.1115.1

Which workloads are affected

Azure Active Directory

The DSC configuration

Example:
$Component = "AADRoleSetting"
$Filters   = @{ AADRoleSetting = "DisplayName eq 'Global Administrator'" }
Export-M365DSCConfiguration  -Components $Component `
                             -TenantId              $TenantId `
                             -ApplicationId         $ApplicationId `
                             -CertificateThumbprint $CertificateThumbprint `
                             -Filters               $Filters              
--> This command should return only the Global Administrator role but it will export all roles (as the filter is not used...)

Verbose logs showing the problem

No response

Environment Information + PowerShell Version

No response

[andikrueger]

Thanks for reporting. This is indeed not fully implemented.

The following code does not respect the filter.

Microsoft365DSC/Modules/Microsoft365DSC/DSCResources/MSFT_AADRoleSetting/MSFT_AADRoleSetting.psm1

Line 1382 in 433af4d

[array] $Script:exportedInstances = Get-MgBetaRoleManagementDirectoryRoleDefinition -ErrorAction Stop

[andikrueger]

And there is already a PR with a fix: #3920