AADConditionalAccessPolicy - BUG - Malformed Request Application Display Name

[pangjaa]

Description of the issue

Conditional Access Policies currently support Applications via the Portal:

However, when attempting to create a Conditional Access Policy For an Application, DSC throws an error. Looking at the error log, it appears that the Application Display Name is not supported. Replacing Display Name with Application Guid seems to fix this issue.

    HTTP: graph.microsoft.com
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Microsoft Windows 10.0.20348; en-US) PowerShell/5.1.20348.2760 Invoke-MgGraphRequest
    Content-Length: 460
    Content-Type: application/json
    {
        "sessionControls": null,
        "displayName": "Block Application",
        "grantControls": {
            "builtInControls": [
                "block"
            ],
            "operator": "OR"
        },
        "conditions": {
            "clientAppTypes": [
                "all"
            ],
            "signInRiskLevels": [],
            "users": {
                "excludeRoles": [],
                "includeRoles": [],
                "excludeUsers": [],
                "includeUsers": [
                    "All"
                ],
                "includeGroups": [],
                "excludeGroups": []
            },
            "platforms": null,
            "userRiskLevels": [],
            "applications": {
                "includeApplications": [
                    "TestApp123"
                ],
                "excludeApplications": []
            }
        },
        "state": "enabled"
    }

Microsoft 365 DSC Version

1.24.1106.3

Which workloads are affected

Azure Active Directory (Entra ID)

The DSC configuration

AADApplication 'AADApplication-TestApp123' {
    DependsOn               = @(
        '[AADApplication]AADApplication-Microsoft365DSC'
    )
    AvailableToOtherTenants = $False
    DisplayName             = 'TestApp123'
    Description             = 'TestApp123 Description'
    Ensure                  = 'Present'
    # IdentifierUris          = @()
    KnownClientApplications = @()
    IsFallbackPublicClient  = $False
    Owners                  = @(
    )
    PublicClient            = $False
    ReplyURLs               = @()
    ApplicationId           = $ApplicationId
    TenantId                = $TenantId
    CertificateThumbprint   = $Thumbprint
}




AADServicePrincipal 'AADServicePrincipal-TestApp123' {
    DependsOn               = @(
        '[AADApplication]AADApplication-Microsoft365DSC'
    )
    AppId = '<Guid>'
    DisplayName             = 'TestApp123'
    Ensure                  = 'Present'
    ServicePrincipalType    = 'Application'
    ApplicationId           = $ApplicationId
    TenantId                = $TenantId
    CertificateThumbprint   = $Thumbprint
}

    AADConditionalAccessPolicy "AADConditionalAccessPolicy-Block TestApp123" {
        DependsOn                     = @(
            '[AADApplication]AADApplication-Microsoft365DSC'
            '[AADApplication]AADApplication-TestApp123'
            '[AADServicePrincipal]AADServicePrincipal-TestApp123'
        )
        DisplayName                   = 'Block TestApp123';
        State                         = 'enabled'
        IncludeApplications           = @('TestApp123');
        ExcludeApplications           = @()
        IncludeUserActions            = @()
        IncludeUsers                  = @('All')
        ExcludeUsers                  = @()
        IncludeGroups                 = @()
        ExcludeGroups                 = @()
        IncludeRoles                  = @()
        ExcludeRoles                  = @()
        IncludeExternalTenantsMembers = @()
        ExcludeExternalTenantsMembers = @()
        IncludePlatforms              = @()
        ExcludePlatforms              = @()
        IncludeLocations              = @()
        ExcludeLocations              = @()
        DeviceFilterRule              = ''
        UserRiskLevels                = @()
        SignInRiskLevels              = @()
        ClientAppTypes                = @('all');
        GrantControlOperator          = 'OR'
        BuiltInControls               = @('block')
        CloudAppSecurityType          = ''
        CustomAuthenticationFactors   = @()
        SignInFrequencyType           = ''
        PersistentBrowserMode         = ''
        Ensure                        = 'Present'
        ApplicationId                 = $ApplicationId
        TenantId                      = $TenantId
        CertificateThumbprint         = $Thumbprint
    }

Verbose logs showing the problem

{
        "error": {
            "code": "BadRequest",
            "message": "The server could not process the request because it is malformed or incorrect.",
            "innerError": {
                "message": "1054: Invalid applications value: TestApp123.",
                "date": "2024-11-12T17:14:17",
                "request-id": "d877caf0-0320-4239-85c4-48195c2cbd7c",
                "client-request-id": "1f9150be-b56c-4d2f-a89d-2c6807b01586"
            }
        }
    }

Environment Information + PowerShell Version

OsName               : Microsoft Windows Server 2022 Datacenter
OsOperatingSystemSKU : DatacenterServerEdition
OsArchitecture       : 64-bit
WindowsVersion       : 2009
WindowsBuildLabEx    : 20348.1.amd64fre.fe_release.210507-1500
OsLanguage           : en-US
OsMuiLanguages       : {en-US}