Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix for issue #5566 intune app configuration policy #5673

Open
wants to merge 17 commits into
base: Dev
Choose a base branch
from
+406 −20
Open

Fix for issue #5566 intune app configuration policy #5673

Show file tree
Hide file tree
Changes from 13 commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
4445875
Partial fix for issue #5566 IntuneAppConfigurationPolicy
dannyKBjj Jan 26, 2025
a0a82fe
Partial fix for #5566 IntuneAppConfigurationPolicy module
dannyKBjj Jan 26, 2025
ebcbddd
Add MgBetaDeviceAppManagementTargetedManagedAppConfigurationApps to e…
dannyKBjj Jan 27, 2025
202e56c
Fixed 'Update', removed read only properties
dannyKBjj Jan 29, 2025
186247b
Requested changes implemented.
dannyKBjj Jan 29, 2025
556b50b
Requested formatting changes made.
dannyKBjj Jan 29, 2025
abf808e
requested change made
dannyKBjj Feb 17, 2025
8c9663c
Merge branch 'Dev' into Fix-for-issue-#5566---IntuneAppConfigurationP…
dannyKBjj Feb 17, 2025
ff3187a
Backed out requested changes that seemed to break module
dannyKBjj Feb 17, 2025
3581b14
Merge branch 'Fix-for-issue-#5566---IntuneAppConfigurationPolicy' of …
dannyKBjj Feb 17, 2025
a5c4a33
pulled origin recommitting
dannyKBjj Feb 17, 2025
68e278e
backed out requested changes as they appear to break things.
dannyKBjj Feb 17, 2025
e59b582
Merge remote-tracking branch 'upstream/Dev' into Fix-for-issue-#5566-…
dannyKBjj Feb 17, 2025
a3f9cb6
Updated Export-DSCResource
dannyKBjj Feb 17, 2025
6b6d798
Merge remote-tracking branch 'upstream/Dev' into Fix-for-issue-#5566-…
dannyKBjj Feb 27, 2025
64da2c0
Updated from Dev Updated changelog.md
dannyKBjj Feb 27, 2025
9954979
Merge branch 'Dev' into Fix-for-issue-#5566---IntuneAppConfigurationP…
dannyKBjj Mar 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,6 +159,8 @@
* IntuneAppConfigurationPolicy
* Fixes an issue with fetching a policy that does not exist.
FIXES [#5666](https://github.com/microsoft/Microsoft365DSC/issues/5666)
* Adds support for testing drift in Apps settings.
FIXES [#5566](https://github.com/microsoft/Microsoft365DSC/issues/5566)
* IntuneApplicationControlPolicyWindows10
* Fixes an issue with fetching a policy that does not exist.
* IntuneAppProtectionPolicyAndroid
Expand Down
279 changes: 260 additions & 19 deletions ...DSC/DSCResources/MSFT_IntuneAppConfigurationPolicy/MSFT_IntuneAppConfigurationPolicy.psm1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,25 @@ function Get-TargetResource
[System.String]
$Description,

[Parameter()]
[System.String[]]
$RoleScopeTagIds,

[Parameter()]
[System.String]
[ValidateSet('unspecified','unmanaged','mdm','androidEnterprise','androidEnterpriseDedicatedDevicesWithAzureAdSharedMode','androidOpenSourceProjectUserAssociated','androidOpenSourceProjectUserless','unknownFutureValue')]
$TargetedAppManagementLevels,

[Parameter()]
[Microsoft.Management.Infrastructure.CimInstance[]]
$Apps,

[Parameter()]
[System.String]
[ValidateSet(
'selectedPublicApps','allCoreMicrosoftApps','allMicrosoftApps','allApps')]
$AppGroupType,

[Parameter()]
[Microsoft.Management.Infrastructure.CimInstance[]]
$CustomSettings,
Expand Down Expand Up @@ -85,7 +104,7 @@ function Get-TargetResource
$configPolicy = $null
if (-not [string]::IsNullOrEmpty($Id))
{
$configPolicy = Get-MgBetaDeviceAppManagementTargetedManagedAppConfiguration -TargetedManagedAppConfigurationId $Id `
$configPolicy = Get-MgBetaDeviceAppManagementTargetedManagedAppConfiguration -TargetedManagedAppConfigurationId $Id -ExpandProperty 'Apps' `
-ErrorAction SilentlyContinue
}

Expand All @@ -95,7 +114,7 @@ function Get-TargetResource

try
{
$configPolicy = Get-MgBetaDeviceAppManagementTargetedManagedAppConfiguration -All -Filter "displayName eq '$DisplayName'" `
$configPolicy = Get-MgBetaDeviceAppManagementTargetedManagedAppConfiguration -All -Filter "displayName eq '$DisplayName'" -ExpandProperty 'Apps' `
-ErrorAction Stop
}
catch
Expand All @@ -120,19 +139,59 @@ function Get-TargetResource
}

Write-Verbose -Message "Found App Configuration Policy with Id {$($configPolicy.Id)} and DisplayName {$($configPolicy.DisplayName)}"
#get the full app details and replace what was retrieved using Get-MgBetaDeviceAppManagementTargetedManagedAppConfiguration
if ($null -ne $configPolicy.Apps)
{
$AppConfiguration = Get-MgBetaDeviceAppManagementTargetedManagedAppConfigurationApp -TargetedManagedAppConfigurationId $configPolicy.Id
$complexAppsArray = @()
foreach($currentValue in $AppConfiguration){
if ($null -ne $currentValue)
{
if ($null -ne $currentValue.mobileAppIdentifier.AdditionalProperties.bundleId)
{
$complexMobileAppIdentifier = @{
bundleID = $currentValue.mobileAppIdentifier.AdditionalProperties.bundleId
}
}

if ($null -ne $currentValue.mobileAppIdentifier.AdditionalProperties.packageId)
{
$complexMobileAppIdentifier = @{
packageId = $currentValue.mobileAppIdentifier.AdditionalProperties.packageId
}
}

if ($null -ne $currentValue.mobileAppIdentifier.AdditionalProperties.windowsAppId)
{
$complexMobileAppIdentifier = @{
windowsAppId = $currentValue.mobileAppIdentifier.AdditionalProperties.windowsAppId
}
}
$complexAppsHash = @{}
$complexAppsHash.Add('id', $currentValue.Id)
$complexAppsHash.Add('mobileAppIdentifier', $complexMobileAppIdentifier)
$complexAppsArray += $complexAppsHash
}
}
}

$returnHashtable = @{
Id = $configPolicy.Id
DisplayName = $configPolicy.DisplayName
Description = $configPolicy.Description
CustomSettings = $configPolicy.customSettings
Ensure = 'Present'
Credential = $Credential
ApplicationId = $ApplicationId
TenantId = $TenantId
ApplicationSecret = $ApplicationSecret
CertificateThumbprint = $CertificateThumbprint
Managedidentity = $ManagedIdentity.IsPresent
AccessTokens = $AccessTokens
Id = $configPolicy.Id
DisplayName = $configPolicy.DisplayName
Description = $configPolicy.Description
CustomSettings = $configPolicy.customSettings
Ensure = 'Present'
Credential = $Credential
ApplicationId = $ApplicationId
TenantId = $TenantId
ApplicationSecret = $ApplicationSecret
CertificateThumbprint = $CertificateThumbprint
Managedidentity = $ManagedIdentity.IsPresent
AccessTokens = $AccessTokens
RoleScopeTagIds = $configPolicy.RoleScopeTagIds
TargetedAppManagementLevels = [String]$configPolicy.TargetedAppManagementLevels
AppGroupType = [String]$configPolicy.AppGroupType
Apps = $complexAppsArray
}

$returnAssignments = @()
Expand Down Expand Up @@ -177,6 +236,25 @@ function Set-TargetResource
[System.String]
$Description,

[Parameter()]
[System.String[]]
$RoleScopeTagIds,

[Parameter()]
[System.String]
[ValidateSet('unspecified','unmanaged','mdm','androidEnterprise','androidEnterpriseDedicatedDevicesWithAzureAdSharedMode','androidOpenSourceProjectUserAssociated','androidOpenSourceProjectUserless','unknownFutureValue')]
$TargetedAppManagementLevels,

[Parameter()]
[Microsoft.Management.Infrastructure.CimInstance[]]
$Apps,

[Parameter()]
[System.String]
[ValidateSet(
'selectedPublicApps','allCoreMicrosoftApps','allMicrosoftApps','allApps')]
$AppGroupType,

[Parameter()]
[Microsoft.Management.Infrastructure.CimInstance[]]
$CustomSettings,
Expand Down Expand Up @@ -250,6 +328,46 @@ function Set-TargetResource
[System.Object[]]$customSettingsValue = ConvertTo-M365DSCIntuneAppConfigurationPolicyCustomSettings -Settings $CustomSettings
$creationParams.Add('customSettings', $customSettingsValue)
}

if ($null -ne $Apps)
{
$appsArray = @()
foreach($app in $Apps){
if ($null -ne $app.mobileAppIdentifier.bundleID)
{
$mobileAppIdentifierHashtable = @{
'@odata.type' = "#microsoft.graph.iosMobileAppIdentifier"
'bundleId' = $app.mobileAppIdentifier.bundleId
}
}

if ($null -ne $app.mobileAppIdentifier.packageID)
{
$mobileAppIdentifierHashtable = @{
'@odata.type' = "#microsoft.graph.androidMobileAppIdentifier"
'packageId' = $app.mobileAppIdentifier.packageId
}
}

if ($null -ne $app.mobileAppIdentifier.windowsAppID)
{
$mobileAppIdentifierHashtable = @{
'@odata.type' = "#microsoft.graph.windowsAppIdentifier"
'windowsAppId' = $app.mobileAppIdentifier.windowsAppId
}
}

$appHashtable = @{
'id' = $App.Id
'mobileAppIdentifier' = $mobileAppIdentifierHashtable
}

$appsArray += $appHashtable

}
$creationParams.Add('apps', $appsArray)
}

$policy = New-MgBetaDeviceAppManagementTargetedManagedAppConfiguration @creationParams

#region Assignments
Expand All @@ -266,7 +384,7 @@ function Set-TargetResource
elseif ($Ensure -eq 'Present' -and $currentconfigPolicy.Ensure -eq 'Present')
{
Write-Verbose -Message "Updating Intune App Configuration Policy {$DisplayName}"

#apps handled separately as not supported by Update-MgBetaDeviceAppManagementTargetedManagedAppConfiguration
$updateParams = @{
targetedManagedAppConfigurationId = $currentconfigPolicy.Id
displayName = $DisplayName
Expand All @@ -277,6 +395,51 @@ function Set-TargetResource
$customSettingsValue = ConvertTo-M365DSCIntuneAppConfigurationPolicyCustomSettings -Settings $CustomSettings
$updateParams.Add('customSettings', $customSettingsValue)
}

if ($null -ne $Apps)
{
$appsArray = @()
foreach ($app in $Apps)
{
if ($null -ne $app.mobileAppIdentifier.bundleID)
{
$mobileAppIdentifierHashtable = @{
'@odata.type' = "#microsoft.graph.iosMobileAppIdentifier"
bundleId = $app.mobileAppIdentifier.bundleID
}
}

if ($null -ne $app.mobileAppIdentifier.packageID)
{
$mobileAppIdentifierHashtable = @{
'@odata.type' = "#microsoft.graph.androidMobileAppIdentifier"
packageId = $app.mobileAppIdentifier.packageId
}
}

if ($null -ne $app.mobileAppIdentifier.windowsAppID)
{
$mobileAppIdentifierHashtable = @{
'@odata.type' = "#microsoft.graph.windowsAppIdentifier"
windowsAppId = $app.mobileAppIdentifier.windowsAppId
}
}

$appsArray += @{
'mobileAppIdentifier' = $mobileAppIdentifierHashtable
}
}

$appsBody = @{
appGroupType = $AppGroupType
apps = $appsArray
}

Write-Verbose -Message "Updating Apps for Intune App Configuration Policy {$DisplayName}"
$Uri = (Get-MSCloudLoginConnectionProfile -Workload MicrosoftGraph).ResourceUrl + "beta/deviceAppManagement/targetedManagedAppConfigurations('$($currentconfigPolicy.Id)')/targetApps"
Invoke-MgGraphRequest -Method POST -Uri $Uri -Body $($appsBody | ConvertTo-Json -Depth 10) -Verbose
}

Update-MgBetaDeviceAppManagementTargetedManagedAppConfiguration @updateParams

$assignmentsHash = ConvertTo-IntunePolicyAssignment -IncludeDeviceFilter:$true -Assignments $Assignments
Expand Down Expand Up @@ -309,6 +472,25 @@ function Test-TargetResource
[System.String]
$Description,

[Parameter()]
[System.String[]]
$RoleScopeTagIds,

[Parameter()]
[System.String]
[ValidateSet('unspecified','unmanaged','mdm','androidEnterprise','androidEnterpriseDedicatedDevicesWithAzureAdSharedMode','androidOpenSourceProjectUserAssociated','androidOpenSourceProjectUserless','unknownFutureValue')]
$TargetedAppManagementLevels,

[Parameter()]
[Microsoft.Management.Infrastructure.CimInstance[]]
$Apps,

[Parameter()]
[System.String]
[ValidateSet(
'selectedPublicApps','allCoreMicrosoftApps','allMicrosoftApps','allApps')]
$AppGroupType,

[Parameter()]
[Microsoft.Management.Infrastructure.CimInstance[]]
$CustomSettings,
Expand Down Expand Up @@ -376,6 +558,12 @@ function Test-TargetResource

Write-Verbose -Message "Current Values: $(Convert-M365DscHashtableToString -Hashtable $CurrentValues)"
Write-Verbose -Message "Target Values: $(Convert-M365DscHashtableToString -Hashtable $PSBoundParameters)"

if ($CurrentValues.Ensure -ne $Ensure)
{
Write-Verbose -Message "Test-TargetResource returned $false"
return $false
}
$testResult = $true

#Compare Cim instances
Expand Down Expand Up @@ -472,7 +660,7 @@ function Export-TargetResource
$complexFunctions = Get-ComplexFunctionsFromFilterQuery -FilterQuery $Filter
$Filter = Remove-ComplexFunctionsFromFilterQuery -FilterQuery $Filter
}
[array]$configPolicies = Get-MgBetaDeviceAppManagementTargetedManagedAppConfiguration -All:$true -Filter $Filter -ErrorAction Stop
[array]$configPolicies = Get-MgBetaDeviceAppManagementTargetedManagedAppConfiguration -ExpandProperty 'Apps' -All:$true -Filter $Filter -ErrorAction Stop
$configPolicies = Find-GraphDataUsingComplexFunctions -ComplexFunctions $complexFunctions -Policies $configPolicies

$i = 1
Expand Down Expand Up @@ -519,6 +707,34 @@ function Export-TargetResource
$Results.CustomSettings = Get-M365DSCIntuneAppConfigurationPolicyCustomSettingsAsString -Settings $Results.CustomSettings
}

if ($Results.Apps)
{
$complexTypeMapping = @(
@{
Name = 'Apps'
CimInstanceName = 'managedMobileApp'
}
@{
Name = 'mobileAppIdentifier'
CimInstanceName = 'AppIdentifier'
isRequired = $true
}
)

$complexTypeStringResult = Get-M365DSCDRGComplexTypeToString `
-ComplexObject $Results.Apps `
-CIMInstanceName managedMobileApp `
-ComplexTypeMapping $complexTypeMapping
if ($complexTypeStringResult)
{
$Results.Apps = $complexTypeStringResult
}
else
{
$Results.Remove('Apps') | Out-Null
}
}

if ($Results.Assignments)
{
$complexTypeStringResult = Get-M365DSCDRGComplexTypeToString -ComplexObject ([Array]$Results.Assignments) -CIMInstanceName DeviceManagementConfigurationPolicyAssignments
Expand All @@ -533,13 +749,38 @@ function Export-TargetResource
}
}


$Results = Update-M365DSCExportAuthenticationResults -ConnectionMode $ConnectionMode `
-Results $Results
$currentDSCBlock = Get-M365DSCExportContentForResource -ResourceName $ResourceName `
-ConnectionMode $ConnectionMode `
-ModulePath $PSScriptRoot `
-Results $Results `
-Credential $Credential `
-NoEscape @('CustomSettings', 'Assignments')
-Credential $Credential

if ($null -ne $Results.CustomSettings)
{
$currentDSCBlock = Convert-DSCStringParamToVariable -DSCBlock $currentDSCBlock -ParameterName 'CustomSettings'
}

if ($Results.Assignments)
{
$isCIMArray = $false
if ($Results.Assignments.getType().Fullname -like '*[[\]]')
{
$isCIMArray = $true
}
$currentDSCBlock = Convert-DSCStringParamToVariable -DSCBlock $currentDSCBlock -ParameterName 'Assignments' -IsCIMArray:$isCIMArray
}

if ($Results.Apps)
{
$isCIMArray = $false
if ($Results.Apps.getType().Fullname -like '*[[\]]')
{
$isCIMArray = $true
}
$currentDSCBlock = Convert-DSCStringParamToVariable -DSCBlock $currentDSCBlock -ParameterName 'Apps' -IsCIMArray:$isCIMArray
}

$dscContent += $currentDSCBlock
Save-M365DSCPartialExport -Content $currentDSCBlock `
Expand Down
Loading
Loading