Issues exporting with several resources in Intune that have embedded instances

[ricmestre]

Details of the scenario you tried and the problem that is occurring

Exporting a blueprint from my production tenant with latest version of M365Dsc results in several resources having a problem with embedded instances and if the array has more than one object where it adds a comma in-between them whereas with earlier versions this problem was not present (can't recall which version I tested that worked with it), the problem is that this is not happening with all of them so there's no pattern here, but it could also be happening with other resources that I'm currently not using and I don't mention below.

From the resources I have and that I could test these are currently the ones that I've seen affected/not affected:

Affected (with MSFT_DeviceManagementConfigurationPolicyAssignments):

IntuneApplicationControlPolicyWindows10
IntuneDeviceConfigurationDeliveryOptimizationPolicyWindows10
IntuneDeviceConfigurationEndpointProtectionPolicyWindows10
IntuneDeviceConfigurationHealthMonitoringConfigurationPolicyWindows10
IntuneDeviceConfigurationIdentityProtectionPolicyWindows10
IntuneWindowsUpdateForBusinessFeatureUpdateProfileWindows10
IntuneWindowsUpdateForBusinessRingUpdateProfileWindows10

Affected (with MSFT_MicrosoftGraphwindowsInformationProtectionApp):
IntuneWindowsInformationProtectionPolicyWindows10MdmEnrolled

Not affected (with MSFT_DeviceManagementConfigurationPolicyAssignments):

IntuneASRRulesPolicyWindows10
IntuneDeviceCompliancePolicyAndroidDeviceOwner
IntuneDeviceCompliancePolicyiOs
IntuneDeviceCompliancePolicyWindows10
IntuneDeviceConfigurationAdministrativeTemplatePolicyWindows10
IntuneDeviceConfigurationPolicyiOS
IntuneDeviceConfigurationPolicyWindows10

Verbose logs showing the problem

        IntuneApplicationControlPolicyWindows10 "IntuneApplicationControlPolicyWindows10-REDACTED"
        {
            ApplicationId                    = $ConfigurationData.NonNodeData.ApplicationId;
            AppLockerApplicationControl      = "auditComponentsStoreAppsAndSmartlocker";
            Assignments                      = @(
                MSFT_DeviceManagementConfigurationPolicyAssignments{
                    deviceAndAppManagementAssignmentFilterType = 'none'
                    dataType = '#microsoft.graph.groupAssignmentTarget'
                    groupId = 'REDACTED'
                }
, # <- this comma should not be present here
                MSFT_DeviceManagementConfigurationPolicyAssignments{
                    deviceAndAppManagementAssignmentFilterType = 'none'
                    dataType = '#microsoft.graph.exclusionGroupAssignmentTarget'
                    groupId = 'REDACTED'
                }
            );
            CertificateThumbprint            = $ConfigurationData.NonNodeData.CertificateThumbprint;
            DisplayName                      = "REDACTED";
            Ensure                           = "Present";
            SmartScreenBlockOverrideForFiles = $False;
            SmartScreenEnableInShell         = $True;
            TenantId                         = $OrganizationName;
        }

Suggested solution to the issue

N/A

The DSC configuration that is used to reproduce the issue (as detailed as possible)

N/A

The operating system the target node is running

OsName : Microsoft Windows 10 Enterprise
OsOperatingSystemSKU : EnterpriseEdition
OsArchitecture : 64-bit
WindowsVersion : 2009
WindowsBuildLabEx : 19041.1.amd64fre.vb_release.191206-1406
OsLanguage : en-US
OsMuiLanguages : {en-US}

Version of the DSC module that was used ('dev' if using current dev branch)

1.23.517.1

[ricmestre]

Most likely I never saw this issue before because on my dev tenants I never used any of the affected resources I mentioned above, and also didn't in my production tenant before testing it today.

[andikrueger]

@William-Francillette Could you have a look at it?

[William-Francillette]

Sure will do - it's an issue with Convert-DSCStringParamToVariable not rendering the CIMArray properly
I normally add those in the export to replace the invalid character
I will add the last line to all the mentioned resources

            $currentDSCBlock = $currentDSCBlock.replace("    ,`r`n" , "    `r`n" )
            $currentDSCBlock = $currentDSCBlock.replace("`r`n;`r`n" , "`r`n" )
            $currentDSCBlock = $currentDSCBlock.replace("`r`n,`r`n" , "`r`n" )

Best would be to fix the function but this may take a bit longer

[andikrueger]

Could you add this 'Cleanup' as a function to the utility module discussed in #3309 ?

[William-Francillette]

Sure good idea - leave it with me

[ricmestre]

Is there any news about this? At least for the affected resources, not so much about the new utility module with the fix included?

[William-Francillette]

@ricmestre, the main PR will take longer but I will look at fixing the resources you mentioned tonight independently

• IntuneApplicationControlPolicyWindows10
• IntuneDeviceConfigurationDeliveryOptimizationPolicyWindows10
• IntuneDeviceConfigurationEndpointProtectionPolicyWindows10
• IntuneDeviceConfigurationHealthMonitoringConfigurationPolicyWindows10
• IntuneDeviceConfigurationIdentityProtectionPolicyWindows10
• IntuneWindowsUpdateForBusinessFeatureUpdateProfileWindows10
• IntuneWindowsUpdateForBusinessRingUpdateProfileWindows10