Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

IntuneDeviceConfigurationCustomPolicyWindows10: Cannot Deploy Resource to Tenant #3655

Closed
satsuk81 opened this issue Sep 7, 2023 · 3 comments · Fixed by #4059 or #4074
Closed

IntuneDeviceConfigurationCustomPolicyWindows10: Cannot Deploy Resource to Tenant #3655

satsuk81 opened this issue Sep 7, 2023 · 3 comments · Fixed by #4059 or #4074
Labels
Bug Something isn't working Intune

Comments

@satsuk81
Copy link

satsuk81 commented Sep 7, 2023

When running Start-DscConfiguration with a valid exported and generated MOF file, I am getting the following error which relates to IntuneDeviceConfigurationCustomPolicyWindows10.

  • CategoryInfo : InvalidOperation: ({ body = Micros...Configuration }:) [], CimException
  • FullyQualifiedErrorId : NotSupported,Microsoft.Graph.Beta.PowerShell.Cmdlets.NewMgBetaDeviceManagementDeviceConf iguration_Create

Details of the scenario you tried and the problem that is occurring

I have attempted to deploy to multiple tenants and this resource seems to fail where others seem to work correctly.

Verbose logs showing the problem

[NotSupported] : {
"_version": 3,
"Message": "SecretReferenceValueId invalid for create. - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 463a2e03-bca2-444d-a098-362b19c1b87a - Url: https://fef.msub06.manage.microsoft.com/DeviceConfiguration_2308/StatelessDeviceConfigurationFEService/deviceManagement/deviceConfigurations?a pi-version=5023-07-14",
"CustomApiErrorPhrase": "",
"RetryAfter": null,
"ErrorSourceService": "",
"HttpHeaders": "{}"
}

  • CategoryInfo : InvalidOperation: ({ body = Micros...Configuration }:) [], CimException
  • FullyQualifiedErrorId : NotSupported,Microsoft.Graph.Beta.PowerShell.Cmdlets.NewMgBetaDeviceManagementDeviceConf iguration_Create
  • PSComputerName : localhost

The PowerShell DSC resource '[IntuneDeviceConfigurationCustomPolicyWindows10]IntuneDeviceConfigurationCustomPolicyWindows10- CIS Microsoft Intune for Windows 11 Benchmark v1.0.0 - Custom' with SourceInfo 'C:\Users...\Microsoft365DSC\Temp\ACP201890b.onmicrosoft.com.ps1::17::9::IntuneDeviceConfigurationCustomPolicyWindows10' threw one or more non-terminating errors while running the Set-TargetResource functionality. These errors are logged to the ETW channel called Microsoft-Windows-DSC/Operational. Refer to this channel for more details.

  • CategoryInfo : InvalidOperation: (:) [], CimException
  • FullyQualifiedErrorId : NonTerminatingErrorFromProvider
  • PSComputerName : localhost

Cannot process argument transformation on parameter 'BodyParameter'. Cannot convert value "System.Management.Automation.PSBoundParametersDictionary" to type
"Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphDeviceEnrollmentConfiguration". Error: "Specified cast is not valid." + CategoryInfo : InvalidData: (:) [], CimException

  • FullyQualifiedErrorId : ParameterArgumentTransformationError,Update-MgBetaDeviceManagementDeviceEnrollmentConfig uration
  • PSComputerName : localhost

The PowerShell DSC resource '[IntuneDeviceEnrollmentPlatformRestriction]IntuneDeviceEnrollmentPlatformRestriction-All users and all devices' with SourceInfo 'C:\Users...\Microsoft365DSC\Temp\ACP201890b.onmicrosoft.com.ps1::1492::9::IntuneDeviceEnrollmentPlatformRestriction' threw one or more non-terminating errors while running the Set-TargetResource functionality. These errors are logged to the ETW channel called Microsoft-Windows-DSC/Operational. Refer to this channel for more details.

  • CategoryInfo : InvalidOperation: (:) [], CimException
  • FullyQualifiedErrorId : NonTerminatingErrorFromProvider
  • PSComputerName : localhost

The SendConfigurationApply function did not succeed.
+ CategoryInfo : NotSpecified: (root/Microsoft/...gurationManager:String) [], CimException
+ FullyQualifiedErrorId : MI RESULT 1
+ PSComputerName : localhost

Suggested solution to the issue

The DSC configuration that is used to reproduce the issue (as detailed as possible)

IntuneDeviceConfigurationCustomPolicyWindows10 "IntuneDeviceConfigurationCustomPolicyWindows10- CIS Microsoft Intune for Windows 11 Benchmark v1.0.0 - Custom"
        {
            ApplicationId         = $ConfigurationData.NonNodeData.ApplicationId;
            Assignments           = @(
                MSFT_DeviceManagementConfigurationPolicyAssignments{
                    deviceAndAppManagementAssignmentFilterType = 'none'
                    dataType = '#microsoft.graph.allDevicesAssignmentTarget'
                });
            CertificateThumbprint = $ConfigurationData.NonNodeData.CertificateThumbprint;
            DisplayName           = " CIS Microsoft Intune for Windows 11 Benchmark v1.0.0 - Custom";
            Ensure                = "Present";
            Id                    = "114ec7ab-e4f2-4fd7-a3f2-0a1373395430";
            OmaSettings           = @(
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/DeviceLock/MinimumPasswordAge'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'MinimumPasswordAge'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/UserRights/DenyLocalLogOn'
                    SecretReferenceValueId = '6d75adbc-f4a0-426c-8897-db4fa24db282_114ec7ab-e4f2-4fd7-a3f2-0a1373395430_92939978-230a-49bf-8cdc-ba71a02964a6'
                    Value = '****'
                    odataType = '#microsoft.graph.omaSettingString'
                    IsEncrypted = $True
                    DisplayName = 'Deny log on locally'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'EnableSecuritySignature'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'Lsa:UseMachineId'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplications'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'OnlyElevateUIAccessApplications'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'SwitchToTheSecureDesktopWhenPromptingForElevation'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/AccountLogon_AuditCredentialValidation'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 3
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditCredentialValidation'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/AccountManagement_AuditApplicationGroupManagement'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 3
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditApplicationGroupManagement'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/AccountManagement_AuditSecurityGroupManagement'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditSecurityGroupManagement'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/AccountManagement_AuditUserAccountManagement'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 3
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditUserAccountManagement'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/DetailedTracking_AuditPNPActivity'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditPNPActivity'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/DetailedTracking_AuditProcessCreation'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditProcessCreation'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditAccountLockout'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 2
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditAccountLockout'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditGroupMembership'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditGroupMembership'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditLogoff'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditLogoff'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditLogon'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 3
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditLogon'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 3
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditOtherLogonLogoffEvents'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/AccountLogonLogoff_AuditSpecialLogon'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditSpecialLogon'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditDetailedFileShare'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 2
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditDetailedFileShare'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditFileShare'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 3
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditFileShare'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditOtherObjectAccessEvents'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 3
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditOtherObjectAccessEvents'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditRemovableStorage'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 3
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditRemovableStorage'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/PolicyChange_AuditPolicyChange'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditPolicyChange'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/PolicyChange_AuditAuthenticationPolicyChange'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditAuthenticationPolicyChange'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/PolicyChange_AuditAuthorizationPolicyChange'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditAuthorizationPolicyChange'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 3
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditMPSSVCRuleLevelPolicyChange'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/PolicyChange_AuditOtherPolicyChangeEvents'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 2
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditOtherPolicyChangeEvents'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/PrivilegeUse_AuditSensitivePrivilegeUse'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 3
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditSensitivePrivilegeUse'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/System_AuditIPsecDriver'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 3
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditIPsecDriver'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/System_AuditOtherSystemEvents'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 3
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditOtherSystemEvents'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/System_AuditSecurityStateChange'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 3
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditSecurityStateChange'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/System_AuditSecuritySystemExtension'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditSecuritySystemExtension'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Audit/System_AuditSystemIntegrity'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 3
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AuditSystemIntegrity'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Privacy/AllowInputPersonalization'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowInputPersonalization'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/System/AllowFontProviders'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowFontProviders'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Wifi/AllowAutoConnectToWiFiSenseHotspots'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowAutoConnectToWiFiSenseHotspots'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Notifications/DisallowCloudNotification'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'DisallowCloudNotification'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/DeviceGuard/EnableVirtualizationBasedSecurity'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'EnableVirtualizationBasedSecurity'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/DeviceGuard/RequirePlatformSecurityFeatures'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 3
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'RequirePlatformSecurityFeatures'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/DeviceGuard/LsaCfgFlags'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'LsaCfgFlags'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/DeviceGuard/ConfigureSystemGuardLaunch'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'ConfigureSystemGuardLaunch'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/DmaGuard/DeviceEnumerationPolicy'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'DeviceEnumerationPolicy'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Privacy/AllowCrossDeviceClipboard'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowCrossDeviceClipboard'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Privacy/UploadUserActivities'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'UploadUserActivities'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Privacy/DisableAdvertisingID'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'DisableAdvertisingID'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/ApplicationManagement/AllowSharedUserAppData'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowSharedUserAppData'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/ApplicationManagement/BlockNonAdminUserInstall'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'BlockNonAdminUserInstall'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Experience/AllowWindowsConsumerFeatures'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowWindowsConsumerFeatures'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/System/AllowTelemetry'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowTelemetry'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/System/DisableEnterpriseAuthProxy'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'DisableEnterpriseAuthProxyy'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Experience/DoNotShowFeedbackNotifications'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'DoNotShowFeedbackNotifications'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/System/AllowBuildPreview'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowBuildPreview'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/System/AllowLocation'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowLocation'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Messaging/AllowMessageSync'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowMessageSync'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Defender/PUAProtection'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'PUAProtection'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/System/DisableOneDriveFileSync'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'DisableOneDriveFileSync'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Search/AllowCloudSearch'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowCloudSearch'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Experience/AllowCortana'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowCortana'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Search/AllowIndexingEncryptedStoresOrItems'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowIndexingEncryptedStoresOrItems'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Search/AllowSearchToUseLocation'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowSearchToUseLocation'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Licensing/DisallowKMSClientOnlineAVSValidation'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'DisallowKMSClientOnlineAVSValidation'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/ApplicationManagement/DisableStoreOriginatedApps'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'DisableStoreOriginatedApps'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/ApplicationManagement/RequirePrivateStoreOnly'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'RequirePrivateStoreOnly'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowSmartScreen'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverride'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'PreventSmartScreenPromptOverride'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/ApplicationManagement/AllowGameDVR'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowGameDVR'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowSuggestedAppsInWindowsInkWorkspace'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/WindowsInkWorkspace/AllowWindowsInkWorkspace'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowWindowsInkWorkspace'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/ApplicationManagement/MSIAllowUserControlOverInstall'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'MSIAllowUserControlOverInstall'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'MSIAlwaysInstallWithElevatedPrivileges'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'DisallowExploitProtectionOverride'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Update/AllowAutoUpdate'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 4
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowAutoUpdate'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Update/ScheduledInstallDay'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'ScheduledInstallDay'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Update/SetDisablePauseUXAccess'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'SetDisablePauseUXAccess'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Update/ManagePreviewBuilds'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'ManagePreviewBuilds'
                }
                MSFT_MicrosoftGraphomaSetting{
                    Description = 'Disabled'
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/Update/PauseQualityUpdates'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 0
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'PauseQualityUpdates'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './User/Vendor/MSFT/Policy/Config/Experience/AllowThirdPartySuggestionsInWindowsSpotlight'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowThirdPartySuggestionsInWindowsSpotlight'
                }
                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './User/Vendor/MSFT/Policy/Config/Experience/AllowTailoredExperiencesWithDiagnosticData'
                    odataType = '#microsoft.graph.omaSettingInteger'
                    Value = 1
                    IsReadOnly = $False
                    IsEncrypted = $False
                    DisplayName = 'AllowTailoredExperiencesWithDiagnosticData'
                });
            SupportsScopeTags     = $True;
            TenantId              = $OrganizationName;
        }

The operating system the target node is running

OsName : Microsoft Windows 11 Enterprise
OsOperatingSystemSKU : EnterpriseEdition
OsArchitecture : 64-bit
WindowsVersion : 2009
WindowsBuildLabEx : 22000.1.amd64fre.co_release.210604-1628
OsLanguage : en-US
OsMuiLanguages : {en-US, en-GB}

Version of the DSC module that was used ('dev' if using current dev branch)

1.23.830.1
@satsuk81
Copy link
Author

satsuk81 commented Sep 7, 2023

Issue relates to this single OMA-URI Setting:

                MSFT_MicrosoftGraphomaSetting{
                    OmaUri = './Device/Vendor/MSFT/Policy/Config/UserRights/DenyLocalLogOn'
                    SecretReferenceValueId = '6d75adbc-f4a0-426c-8897-db4fa24db282_114ec7ab-e4f2-4fd7-a3f2-0a1373395430_92939978-230a-49bf-8cdc-ba71a02964a6'
                    Value = '****'
                    odataType = '#microsoft.graph.omaSettingString'
                    IsEncrypted = $True
                    DisplayName = 'Deny log on locally'
                }

@andikrueger andikrueger added Bug Something isn't working Intune labels Sep 11, 2023
@JelleBroekhuijsen
Copy link

I am seeing this behavior with several other settings:

MSFT_MicrosoftGraphomaSetting{
   OmaUri = './Vendor/MSFT/Policy/Config/ApplicationDefaults/DefaultAssociationsConfiguration'
   SecretReferenceValueId = '162adda1-92ff-4d4d-bef5-5e9cd87fefcf_f1fa203f-27bb-42dc-974f-a2ded0b5dfc6_7ff2e7a0-7726-45a0-9282-355e950dbdc5'
   Value = '****'
   odataType = '#microsoft.graph.omaSettingString'
   IsEncrypted = $True
   DisplayName = 'Application Defaults'
}
MSFT_MicrosoftGraphomaSetting{
    Description = 'GMS001-%SERIAL%'
    OmaUri = './Device/Vendor/MSFT/Accounts/Domain/ComputerName'
    SecretReferenceValueId = '162adda1-92ff-4d4d-bef5-5e9cd87fefcf_d327dfe4-ddb5-46a4-8010-33492c7809b4_6d911eba-59a1-4850-a067-053805eddcfa'
    Value = '****'
    odataType = '#microsoft.graph.omaSettingString'
    IsEncrypted = $True
    DisplayName = 'Device Rename'
}

I managed to work around this issue by removing the SecretReferenceValueId-properties and manually inserting the Value for these settings.

@ricmestre
Copy link
Contributor

@andikrueger Forgot this issue was raised, in my solution for crypted entries I decrypt the values and reinsert them back into the blueprint then remove SecretReferenceValueId and IsEncrypted parameters. Having this directly in M365DSC probably would be better? Otherwise people will trip into this problem which needs manual intervention.

Of course in order to decrypt the values then you need to connect to the tenant from where the values where encrypted in the first place, you cannot decrypt them into a target tenant in cloning scenario.

@ricmestre ricmestre mentioned this issue Dec 16, 2023
Merged
@NikCharlebois NikCharlebois mentioned this issue Dec 20, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug Something isn't working Intune
Projects
None yet
Milestone
No milestone
4 participants
@andikrueger @JelleBroekhuijsen @satsuk81 @ricmestre