Tenant Config Compilation Error.

[pradeepmnrecit]

Description of the issue

Dear Team ,

While i compile the configuration file , i am getting the attached error.
Kindly advice.
Thanks
Pradeep

Microsoft 365 DSC Version

1.23.1122.1 1.23.1122.1

Which workloads are affected

Teams

The DSC configuration

No response

Verbose logs showing the problem

No response

Environment Information + PowerShell Version

No response

[malauter]

You have two resources with the same name (TeamsChannel-test) in your config. Please remove or rename one of them. The resource identifier must be unique.

[pradeepmnrecit]

Hi Malauter and Andi

Kindly help and guide with below error

==============================

PS C:\NEWDSC> .\M365TenantConfig.ps1

Test-ConflictingResources : A conflict was detected between resources '[TeamsTeam]TeamsTeam-WPO - ESWD
(C:\NEWDSC\M365TenantConfig.ps1::44815::9::TeamsTeam)' and '[TeamsTeam]TeamsTeam-WPO - ESWD-2
(C:\NEWDSC\M365TenantConfig.ps1::56831::9::TeamsTeam)' in node 'localhost'. Resources have identical key properties
but there are differences in the following non-key properties: 'MailNickName;GroupID;Owner'. Values
'ES-SESPM;2473271a-e13d-4110-a7a7-af66ebd053aa;ram.Hin@abc.org' don't match values
'WPI-ESWD;99fb6e7a-2e5f-49df-a95b-9e3522ae6473;suni.Hari@abc.org'. Please update these property values so that they
are identical in both cases.
At line:289 char:9

•     Test-ConflictingResources $keywordName $canonicalizedValue $k ...
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [Write-Error], InvalidOperationException
  • FullyQualifiedErrorId : ConflictingDuplicateResource,Test-ConflictingResources
    Test-ConflictingResources : A conflict was detected between resources '[TeamsTeam]TeamsTeam-OXG – Office of Micro
    Supervisors (C:\NEWDSC\M365TenantConfig.ps1::57883::9::TeamsTeam)' and '[TeamsTeam]TeamsTeam-OXG – Office of
    Micro Supervisors-2 (C:\NEWDSC\M365TenantConfig.ps1::60934::9::TeamsTeam)' in node 'localhost'. Resources have
    identical key properties but there are differences in the following non-key properties: 'MailNickName;GroupID'. Values
    'OIGOfficeofManagementSupervisors;a42a567e-5426-4b95-9bd5-14a757c13f5a' don't match values
    'OIGOfficeofManagementSupervisors445;c652c74c-2996-41f6-ab3a-831edecb4e85'. Please update these property values so
    that they are identical in both cases.
    At line:289 char:9

•     Test-ConflictingResources $keywordName $canonicalizedValue $k ...
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [Write-Error], InvalidOperationException
  • FullyQualifiedErrorId : ConflictingDuplicateResource,Test-ConflictingResources
    Compilation errors occurred while processing configuration 'M365TenantConfig'. Please review the errors reported in
    error stream and modify your configuration code appropriately.
    At
    C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\PSDesiredStateConfiguration.psm1:3917
    char:5

• throw $ErrorRecord
  

• ~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (M365TenantConfig:String) [], InvalidOperationException
  • FullyQualifiedErrorId : FailToProcessConfiguration
    What is [teams teams] in the above error, appreciate your response.
    I have copied the error code.
    Thanks
    Pradeep

[malauter]

Could you please share the corresponding DSC configuration?
The error message sounds like you have two resources with the same display name (this is the key property for a Teams team).

[pradeepmnrecit]

Hi Malauter

Is it ok using the above to help me out.
Thanks
Pradeep

[pradeepmnrecit]

M365TenantConfig.zip
HI Malauter
Please find the above newly attached error code and also the dsc configuration file, Kindly guide.
Thanks
Pradeep

[malauter]

The attached config looks good, I cannot detect the conflicts from the error message. But the M365 DSC version used to generate the config is old, could you please try to update M365 DSC and all dependencies to the current version by running this:

Update-M365DSCModule

After that, please recreate the config and try again.

[pradeepmnrecit]

Hi Malater,

I have updated the modules and its dependencies. Now I am getting an attached error, Kindly advice.

Thanks
Pradeep

[malauter]

The TeamsUser resource has no Certificate parameter, it is called CertificateThumbprint. Please have a look at the documentation: https://microsoft365dsc.com/resources/teams/TeamsUser/

[pradeepmnrecit]

Dear Malauter

I didn't get your point, you mean my DSC configuration has a mistake, if you rephrase that it will be great.
Thanks
Pradeep

[pradeepmnrecit]

Hi Malauter

I have attached one of theams user details as well , we are not using Certificate Parameter in this ps1 file.

[malauter]

The error message says "Certificate not found". Is the mentioned thumbprint correct and is the certificate in the cert store accessible for DSC?
Maybe you can try with credentials instead of cert based authentication first (just for testing).

[pradeepmnrecit]

Hi Malauter
Actually, we have only SP-based authentication supported at the moment. How can i verify my DSC can be accessible via certificate?

IS the below command is helpful!. Please advise.

Connect-MicrosoftTeams -CertificateThumbprint "A937EEF7DA9xxxxxxxxxxx" -ApplicationId "6db23af4-c4ea-4811-xxx-710e97c1f303" -TenantId xxx.onmicrosoft.com

Appreciate your response.!

[malauter]

Is your Connect-MicrosoftTeams command working? It is using another CertificateThumbprint than mentioned in the error message

[pradeepmnrecit]

Hi Malauter

The above is just a masked thumprint and App ID , Using the above command i can able to connect.

Thanks
Pradeep

[pradeepmnrecit]

HI Malatur

After the Module upgrade when i list module the below out shows 3 modules of Microsoft365DCS , Kindly advice .Appreciate your response.

Thanks
Pradeep

[andikrueger]

Please run Uninstall-M365DSCOutDatedDependencies. This will try to uninstall outdated M365 versions and dependencies.

[pradeepmnrecit]

Hi Andi

Does it solve certificate issue.

Thanks
Pradeep

[andikrueger]

No, it won't. It's just answering your previous answer about the multiple M365DSC Module folders.

[pradeepmnrecit]

Dear Andi

Thanks, Can you please address the above-mentioned certificate issue, because its so confusing ie, we can able to connect with teams with the below command.
Connect-MicrosoftTeams -CertificateThumbprint "A937EEF7DA9xxxxxxxxxxx" -ApplicationId "6db23af4-c4ea-4811-xxx-710e97c1f303" -TenantId xxx.onmicrosoft.com

Appreciate your response.!
Thanks
Pradeep

[pradeepmnrecit]

Dear Malatur and Andy

Please find the connect-microsoftteams output.

[andikrueger]

Could you please share in which location the certificate is stored. For DSC to be able to access the certificate, it needs to be placed in the computer store.

[pradeepmnrecit]

Thanks a lot, Andy. I will check the advised option and revert.

Thanks
Pradeep

[pradeepmnrecit]

Currently its in personal Store of Current user.

[pradeepmnrecit]

Hi Andy

Now i have placed in Computer store and see

[pradeepmnrecit]

Hi Andy

Kindly find the new Error ,Please advise on this.

[pradeepmnrecit]

Hi Malatur and Andy

Can you please advise on the above error please.
Thanks
Pradeep

[pradeepmnrecit]

Hi Malatur and Andy

Kindly help me on this above error, your advise will be always helpful.
Thanks
Pradeep

[pradeepmnrecit]

Hi Team

Kindly advise, please.

[pradeepmnrecit]

Dear Malatur

Appreciate it helpful to answer my query, please.

Thanks
Pradeep

[pradeepmnrecit]

Hi Team

Appreciate your response.

[malauter]

I recommend to doublecheck if...

• the certificate is placed in the right store
• it is accessible for DSC
• the thumbprint is correct
• the certificate is configured in the app registration correctly

I assume this is an issue with your certificate or your tenant configuration.

[pradeepmnrecit]

Dear Malauter,

Thank you for your assistance. The issue has been resolved. The problem stemmed from the certificate not being imported properly into the store. By using the CLI to import the certificate, everything now works as intended. Below is the command I used:

powershell
Copy code
$mypwd = Get-Credential -UserName 'Enter password below' -Message 'Enter password below'

$params = @{
FilePath = 'C:\mypfx.pfx'
CertStoreLocation = 'Cert:\LocalMachine\My'
Password = $mypwd.Password
}

Import-PfxCertificate @params

Repeat the process for the current user store

$params.CertStoreLocation = 'Cert:\CurrentUser\My'
Import-PfxCertificate @params

However, I have encountered another issue related to the service principal-based authentication(i assume). When generating the M365TenantConfig.ps1 file, it seems that significant portions of the expected policies are missing. Specifically, policies such as TeamsAppPermissionPolicy, TeamsAppSetupPolicy, TeamsAudioConferencingPolicy, and others (approximately 90% of the policies) are absent. The generated file only includes TeamsChannel, TeamsTeam, and TeamsUser configurations.

Could there be limitations associated with using service principal-based authentication that result in these omissions? Any insights or advice you can offer regarding this matter would be greatly appreciated

[andikrueger]

There’s a known limitation with some of the teams cmdLet not supporting app creds. See #4258 , #4018, #3394

[pradeepmnrecit]

Hi Andy
Thanks.
Can i get a list of teams Cmdlet that are not working on SP-based authentication, please?.

Thanks
Pradeep

[pradeepmnrecit]

Hi Andy
Can i get a list of teams Cmdlet that are not working on SP-based authentication, please.

Thanks
Pradeep

[andikrueger]

It looks like there is a drift between the documentation and the implementation. This would be the official documentation: https://learn.microsoft.com/en-us/microsoftteams/teams-powershell-application-authentication

[pradeepmnrecit]

Hi Andi

I'm a little confused. Are you saying there are still limitations in Service Principle -based authentication, particularly with some of the Teams cmdlets? Or are you suggesting that it's possible to address these limitations by making changes to the settings below as per your article from MSFT.

Register the application in Microsoft Entra ID.
Assign API permissions to the application.
For *-Cs cmdlets - the Microsoft Graph API permission needed is Organization.Read.All.

My current API graph permission is below.

Appreciate if you can give me a clear picture on this.
Thanks
Pradeep

[pradeepmnrecit]

Dear Andy

Appreciate your thoughts on the above.
Thanks
Pradeep

[andikrueger]

This is currently a limitation within the MS Teams PowerShell Module. Within the configuration you can set the authentication method per resource. This is a work around for this kind of issue. We need to wait for an update of the Teams module.

[pradeepmnrecit]

Can you give one example how to add this in the configuration,.

[andikrueger]

For each resource, there are various authentication parameters like Credentials, AppplicationID, ... Please assign the appropriate ones.

 ResourceName 'TestResource'
        {
          ...
            Ensure                        = 'Present'
            Credential                    = $Credscredential
        }

 DifferentName 'TestAppResource'
        {
          ...
            Ensure                        = 'Present'
            ApplicationID             = '123-123-123-123'
            TenantID                     = 'tenant.onmicrosoft.com'
            ApplicationSecret       = 'Secret'
           .....
        }

[FabienTschanz]

@pradeepmnrecit Closing this issue as a workaround was presented. If it's not answered, feel free to reopen it.