IntuneDeviceConfigurationCustomPolicyWindows10: Change permissions for reading to DeviceManagementConfiguration.ReadWrite.All

CHANGELOG.md

@@ -9,11 +9,15 @@
     FIXES [#4283](https://github.com/microsoft/Microsoft365DSC/issues/4283)
 * IntuneDeviceConfigurationCustomPolicyWindows10
   * Fixed an issue where the payload of xml files was not encoded as base64.
+  * Change app and delegated permissions for reading to
+    DeviceManagementConfiguration.ReadWrite.All to cope with
+    getOmaSettingPlainTextValue which is only working if RW is granted
+    FIXES [#4412](https://github.com/microsoft/Microsoft365DSC/issues/4412)
 * IntuneDeviceConfigurationDefenderForEndpointOnboardingPolicyWindows10
-  * Fixed a creation and update issue when the exported policy contains a 
+  * Fixed a creation and update issue when the exported policy contains a
     onboarding blob and the tenant is connected to Defender for Endpoint Service.
 * M365DSCUtil
-  * Fixed an issue where one could not pass empty arrays to the 
+  * Fixed an issue where one could not pass empty arrays to the
     `Compare-PSCustomObjectArrays` function.
 * DEPENDENCIES
   * Updated Microsoft.Graph to version 2.18.0.
@@ -36,7 +40,7 @@
   * Fixed an issue where the update policy setting was not handled properly.
 * IntuneDeviceConfigurationWiredNetworkPolicyWindows10
   * Added functionality for specifying the certificates with a display name since their
-    ids in the blueprint might be from a different source tenant.  
+    ids in the blueprint might be from a different source tenant.
     FIXES [#4582](https://github.com/microsoft/Microsoft365DSC/issues/4582)
 * MISC
   * Added support for AccessTokens in EXO resources.

Modules/Microsoft365DSC/DSCResources/MSFT_IntuneDeviceConfigurationCustomPolicyWindows10/settings.json

@@ -9,7 +9,7 @@
                                                     "name": "Group.Read.All"
                                                 },
                                                 {
-                                                     "name":  "DeviceManagementConfiguration.Read.All"
+                                                     "name":  "DeviceManagementConfiguration.ReadWrite.All"
                                                  }
                                              ],
                                     "update":  [
@@ -24,7 +24,7 @@
                                                         "name": "Group.Read.All"
                                                     },
                                                     {
-                                                       "name":  "DeviceManagementConfiguration.Read.All"
+                                                       "name":  "DeviceManagementConfiguration.ReadWrite.All"
                                                    }
                                                ],
                                       "update":  [

Tests/QA/Microsoft365DSC.SettingsJson.Tests.ps1

@@ -84,6 +84,13 @@ Describe -Name 'Successfully validate all used permissions in Settings.json file
             )
         }
 
+        if ($settings.ResourceName -eq 'IntuneDeviceConfigurationCustomPolicyWindows10')
+        {
+            $allowedPermissions = @(
+                'DeviceManagementConfiguration.ReadWrite.All'
+            )
+        }
+
         foreach ($permission in $settings.permissions.graph.application.read)
         {
             $ObjectGuid = [System.Guid]::empty