IntuneEndpointDetectionAndResponsePolicyWindows10: Cannot be used to create policies

[ricmestre]

Description of the issue

In order to try out this resource I created one manually through Intune admin portal, I then was able to export it (see blueprint below) and then tried to update the policy through M365DSC by changing samplesharing and the name of the policy itself which actually worked.

What doesn't work is actually creating new ones, this is because the blueprint contains Assignments, as soon as I tried to create a new policy it fails with "[]: The request is invalid" and event viewer log points exactly to the problem being caused by updating Assignments, this is most likely also caused by Graph API having changed how to make assignments in the policies as mentioned by @William-Francillette in #3892. At the moment I cannot verify this is the case so I'm raising a new issue, if it's caused by the same problem then this can be closed as duplicate but please mention that in the parent issue that IntuneEndpointDetectionAndResponsePolicyWindows10 doesn't work also.

Error updating data:

{ Response status code does not indicate success: BadRequest (Bad Request). } \ at Update-DeviceConfigurationPolicyAssignment, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.1108.3\modules\M365DSCDRGUtil.psm1: line 1164
 \ at Set-TargetResource, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.1108.3\DscResources\MSFT_IntuneEndpointDetectionAndResponsePolicyWindows10\MSFT_IntuneEndpointDetectionAndResponsePolicyWindows10.psm1: line 305

Removing Assignments from the blueprint doesn't help, in that case it fails with the following:

Cannot bind argument to parameter 'ComplexObject' because it is null.
+ CategoryInfo          : InvalidData: (:) [], CimException
+ FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Convert-M365DSCDRGComplexTypeToHashtable
+ PSComputerName        : localhost

Microsoft 365 DSC Version

1.23.1108.3

Which workloads are affected

other

The DSC configuration

# Generated with Microsoft365DSC version 1.23.1108.3
# For additional information on how to use Microsoft365DSC, please visit https://aka.ms/M365DSC
param (
    [parameter()]
    [System.Management.Automation.PSCredential]
    $Credential
)

Configuration IntuneEndpointDetectionAndResponsePolicyWindows10
{
    param (
        [parameter()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    if ($null -eq $Credential)
    {
        <# Credentials #>
        $Credscredential = Get-Credential -Message "Credentials"

    }
    else
    {
        $CredsCredential = $Credential
    }

    $OrganizationName = $CredsCredential.UserName.Split('@')[1]

    Import-DscResource -ModuleName 'Microsoft365DSC' -ModuleVersion '1.23.1108.3'

    Node localhost
    {
        IntuneEndpointDetectionAndResponsePolicyWindows10 "IntuneEndpointDetectionAndResponsePolicyWindows10-IntuneEndpointDetectionAndResponsePolicyWindows10_1"
        {
            Assignments          = @(
                MSFT_DeviceManagementConfigurationPolicyAssignments{
                    deviceAndAppManagementAssignmentFilterType = 'none'
                    dataType = '#microsoft.graph.exclusionGroupAssignmentTarget'
                    groupId = '053dc89a-be83-411a-bad3-909904b7239e'
                }
                MSFT_DeviceManagementConfigurationPolicyAssignments{
                    deviceAndAppManagementAssignmentFilterType = 'none'
                    dataType = '#microsoft.graph.groupAssignmentTarget'
                    groupId = 'b0b8fd3f-af2a-453b-be57-80182d599f02'
                }
            );
            Credential           = $Credscredential;
            Description          = "IntuneEndpointDetectionAndResponsePolicyWindows10_1";
            DisplayName          = "IntuneEndpointDetectionAndResponsePolicyWindows10_1";
            Ensure               = "Present";
            Identity             = "eb157512-bf82-4773-ab6e-28c95e43c126";
            samplesharing        = "1";
        }
    }
}

IntuneEndpointDetectionAndResponsePolicyWindows10 -ConfigurationData .\ConfigurationData.psd1 -Credential $Credential

Verbose logs showing the problem

No response

Environment Information + PowerShell Version

No response

[ricmestre]

@William-Francillette Hi, this one seems to be related to #3892 and #3921, but at least on this one it looks like it fails to create the policy even if I remove the Assignments property from the blueprint or directly from the MOF and it still fails at Update-DeviceConfigurationPolicyAssignment. Should I close this issue and report it under #3921 ?

Error updating data:

{ Response status code does not indicate success: BadRequest (Bad Request). } \ at Update-DeviceConfigurationPolicyAssignment, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.1122.1\modules\M365DSCDRGUtil.psm1: line 1164
 \ at Set-TargetResource, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.1122.1\DscResources\MSFT_IntuneEndpointDetectionAndResponsePolicyWindows10\MSFT_IntuneEndpointDetectionAndResponsePolicyWindows10.psm1: line 305

[William-Francillette]

Nope keep it there I'll have a look