AADAdministrativeUnit - New parameter

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 # UNRELEASED
 
+* AADAdministrativeUnit
+  * Added support for property IsMemberManagementRestricted.
 * AADApplication
   * Added AppRoles
   * Added AuthenticationBehavior

Modules/Microsoft365DSC/DSCResources/MSFT_AADAdministrativeUnit/MSFT_AADAdministrativeUnit.psm1

@@ -22,6 +22,10 @@ function Get-TargetResource
         [System.String]
         $Visibility,
 
+        [Parameter()]
+        [System.Boolean]
+        $IsMemberManagementRestricted,
+
         [Parameter()]
         [validateset('Assigned', 'Dynamic')]
         [System.String]
@@ -143,18 +147,19 @@ function Get-TargetResource
         Write-Verbose -Message "An Azure AD Administrative Unit with Id {$Id} and DisplayName {$DisplayName} was found."
         $results = @{
             #region resource generator code
-            Description           = $getValue.Description
-            DisplayName           = $getValue.DisplayName
-            Visibility            = $getValue.Visibility
-            Id                    = $getValue.Id
-            Ensure                = 'Present'
-            Credential            = $Credential
-            ApplicationId         = $ApplicationId
-            TenantId              = $TenantId
-            ApplicationSecret     = $ApplicationSecret
-            CertificateThumbprint = $CertificateThumbprint
-            Managedidentity       = $ManagedIdentity.IsPresent
-            AccessTokens          = $AccessTokens
+            Description                  = $getValue.Description
+            DisplayName                  = $getValue.DisplayName
+            Visibility                   = $getValue.Visibility
+            IsMemberManagementRestricted = $getValue.IsMemberManagementRestricted
+            Id                           = $getValue.Id
+            Ensure                       = 'Present'
+            Credential                   = $Credential
+            ApplicationId                = $ApplicationId
+            TenantId                     = $TenantId
+            ApplicationSecret            = $ApplicationSecret
+            CertificateThumbprint        = $CertificateThumbprint
+            Managedidentity              = $ManagedIdentity.IsPresent
+            AccessTokens                 = $AccessTokens
             #endregion
         }
 
@@ -293,6 +298,10 @@ function Set-TargetResource
         [System.String]
         $Visibility,
 
+        [Parameter()]
+        [System.Boolean]
+        $IsMemberManagementRestricted,
+
         [Parameter()]
         [validateset('Assigned', 'Dynamic')]
         [System.String]
@@ -352,7 +361,7 @@ function Set-TargetResource
     try
     {
         $ConnectionMode = New-M365DSCConnection -Workload 'MicrosoftGraph' `
-            -InboundParameters $PSBoundParameters `
+            -InboundParameters $PSBoundParameters
     }
     catch
     {
@@ -547,11 +556,7 @@ function Set-TargetResource
         #region resource generator code
         Write-Verbose -Message "Creating new Administrative Unit with: $(Convert-M365DscHashtableToString -Hashtable $CreateParameters)"
 
-        $jsonParams = ConvertTo-Json $CreateParameters
-
-        # TODO - Replace by cmdlet call which has an issue in 2.11.1
-        $url = $Global:MSCloudLoginConnectionProfile.MicrosoftGraph.ResourceUrl + 'beta/administrativeUnits'
-        $policy = Invoke-MgGraphRequest -Method POST -Uri $url -Body $jsonParams
+        $policy = New-MgBetaDirectoryAdministrativeUnit @CreateParameters
 
         if ($MembershipType -ne 'Dynamic')
         {
@@ -599,12 +604,8 @@ function Set-TargetResource
         $UpdateParameters.Remove('ScopedRoleMembers') | Out-Null
 
         #region resource generator code
-        $jsonParams = ConvertTo-Json $UpdateParameters
-        $url = $Global:MSCloudLoginConnectionProfile.MicrosoftGraph.ResourceUrl + "beta/administrativeUnits/$($currentInstance.Id)"
-        Invoke-MgGraphRequest -Method PATCH -Uri $url -Body $jsonParams
-        <#Update-MgBetaDirectoryAdministrativeUnit @UpdateParameters `
-            -AdministrativeUnitId $currentInstance.Id #>
-
+        Update-MgBetaDirectoryAdministrativeUnit @UpdateParameters `
+            -AdministrativeUnitId $currentInstance.Id
         #endregion
 
         if ($MembershipType -ne 'Dynamic')
@@ -818,6 +819,10 @@ function Test-TargetResource
         [System.String]
         $Visibility,
 
+        [Parameter()]
+        [System.Boolean]
+        $IsMemberManagementRestricted,
+
         [Parameter()]
         [validateset('Assigned', 'Dynamic')]
         [System.String]

Modules/Microsoft365DSC/DSCResources/MSFT_AADAdministrativeUnit/MSFT_AADAdministrativeUnit.schema.mof

@@ -18,6 +18,7 @@ class MSFT_AADAdministrativeUnit : OMI_BaseResource
     [Write, Description("Object-Id of the Administrative Unit")] String Id;
     [Write, Description("Description of the Administrative Unit")] String Description;
     [Write, Description("Visibility of the Administrative Unit. Specify HiddenMembership if members of the AU are hidden")] String Visibility;
+    [Write, Description("Indicates whether the management rights on resources in the administrative units should be restricted to ONLY the administrators scoped on the administrative unit object.")] Boolean IsMemberManagementRestricted;
     [Write, Description("Specify membership type. Possible values are Assigned and Dynamic. Note that the functionality is currently in preview.")] String MembershipType;
     [Write, Description("Specify membership rule. Requires that MembershipType is set to Dynamic. Note that the functionality is currently in preview.")] String MembershipRule;
     [Write, Description("Specify dynamic membership-rule processing-state. Valid values are 'On' and 'Paused'. Requires that MembershipType is set to Dynamic. Note that the functionality is currently in preview.")] String MembershipRuleProcessingState;

Modules/Microsoft365DSC/Examples/Resources/AADAdministrativeUnit/1-Create.ps1

@@ -29,6 +29,7 @@ Configuration Example
             MembershipRule                = "(user.country -eq `"Canada`")"
             MembershipRuleProcessingState = 'On'
             MembershipType                = 'Dynamic'
+            IsMemberManagementRestricted  = $False;
             ScopedRoleMembers             = @(
                 MSFT_MicrosoftGraphScopedRoleMembership
                 {

Modules/Microsoft365DSC/Examples/Resources/AADAdministrativeUnit/2-Update.ps1

@@ -30,6 +30,7 @@ Configuration Example
             MembershipRule                = "(user.country -eq `"US`")" # Updated Property
             MembershipRuleProcessingState = 'On'
             MembershipType                = 'Dynamic'
+            IsMemberManagementRestricted  = $False
             ScopedRoleMembers             = @(
                 MSFT_MicrosoftGraphScopedRoleMembership
                 {

Tests/Unit/Microsoft365DSC/Microsoft365DSC.AADAdministrativeUnit.Tests.ps1

@@ -115,7 +115,7 @@ Describe -Name $Global:DscHelper.DescribeHeader -Fixture {
             }
             It 'Should Create the AU from the Set method' {
                 Set-TargetResource @testParams
-                Should -Invoke -CommandName Invoke-MgGraphRequest -Exactly 1
+                Should -Invoke -CommandName New-MgBetaDirectoryAdministrativeUnit -Exactly 1
             }
         }