diff --git a/CHANGELOG.md b/CHANGELOG.md index ea91e19d89..7439ee549d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -286,6 +286,8 @@ * Added a few verbose messages * IntuneDeviceManagmentAndroidDeviceOwnerEnrollmentProfile * Initial release. +* IntuneDeviceManagementComplianceManagementPartner + * Initial release * IntuneEndpointDetectionAndResponsePolicyWindows10 * Fixes an issue with `AutoFromConnector` as the Configuration package type. FIXES [#5246](https://github.com/microsoft/Microsoft365DSC/issues/5246) diff --git a/Modules/Microsoft365DSC/DSCResources/MSFT_IntuneDeviceManagementComplianceManagementPartner/MSFT_IntuneDeviceManagementComplianceManagementPartner.psm1 b/Modules/Microsoft365DSC/DSCResources/MSFT_IntuneDeviceManagementComplianceManagementPartner/MSFT_IntuneDeviceManagementComplianceManagementPartner.psm1 new file mode 100644 index 0000000000..d9565ece56 --- /dev/null +++ b/Modules/Microsoft365DSC/DSCResources/MSFT_IntuneDeviceManagementComplianceManagementPartner/MSFT_IntuneDeviceManagementComplianceManagementPartner.psm1 @@ -0,0 +1,850 @@ +function Get-TargetResource +{ + [CmdletBinding()] + [OutputType([System.Collections.Hashtable])] + param + ( + #region resource generator code + [Parameter()] + [Microsoft.Management.Infrastructure.CimInstance[]] + $AndroidEnrollmentAssignments, + + [Parameter()] + [System.Boolean] + $AndroidOnboarded, + + [Parameter(Mandatory = $true)] + [System.String] + $DisplayName, + + [Parameter()] + [Microsoft.Management.Infrastructure.CimInstance[]] + $IosEnrollmentAssignments, + + [Parameter()] + [System.Boolean] + $IosOnboarded, + + [Parameter()] + [Microsoft.Management.Infrastructure.CimInstance[]] + $MacOsEnrollmentAssignments, + + [Parameter()] + [System.Boolean] + $MacOsOnboarded, + + [Parameter()] + [ValidateSet('unknown','unavailable','enabled','terminated','rejected','unresponsive')] + [System.String] + $PartnerState, + + [Parameter()] + [System.String] + $Id, + + #endregion + + [Parameter()] + [System.String] + [ValidateSet('Absent', 'Present')] + $Ensure = 'Present', + + [Parameter()] + [System.Management.Automation.PSCredential] + $Credential, + + [Parameter()] + [System.String] + $ApplicationId, + + [Parameter()] + [System.String] + $TenantId, + + [Parameter()] + [System.Management.Automation.PSCredential] + $ApplicationSecret, + + [Parameter()] + [System.String] + $CertificateThumbprint, + + [Parameter()] + [Switch] + $ManagedIdentity, + + [Parameter()] + [System.String[]] + $AccessTokens + ) + + try + { + $ConnectionMode = New-M365DSCConnection -Workload 'MicrosoftGraph' ` + -InboundParameters $PSBoundParameters + + #Ensure the proper dependencies are installed in the current environment. + Confirm-M365DSCDependencies + + #region Telemetry + $ResourceName = $MyInvocation.MyCommand.ModuleName.Replace('MSFT_', '') + $CommandName = $MyInvocation.MyCommand + $data = Format-M365DSCTelemetryParameters -ResourceName $ResourceName ` + -CommandName $CommandName ` + -Parameters $PSBoundParameters + Add-M365DSCTelemetryEvent -Data $data + #endregion + + $nullResult = $PSBoundParameters + $nullResult.Ensure = 'Absent' + + $getValue = $null + #region resource generator code + $getValue = Get-MgBetaDeviceManagementComplianceManagementPartner ` + -Filter "DisplayName eq '$DisplayName'" ` + -ErrorAction SilentlyContinue <# | Where-Object ` + -FilterScript { + $_.AdditionalProperties.'@odata.type' -eq "#microsoft.graph.ComplianceManagementPartner" + } #> + + #endregion + if ($null -eq $getValue) + { + Write-Verbose -Message "Could not find an Intune Device Management Compliance Management Partner with DisplayName {$DisplayName}." + return $nullResult + } + $Id = $getValue.Id + Write-Verbose -Message "An Intune Device Management Compliance Management Partner with Id {$Id} and DisplayName {$DisplayName} was found" + + #region resource generator code + if ($getValue.androidEnrollmentAssignments.Count -gt 0) + { + $returnAndroidEnrollmentAssignments = @() + $returnAndroidEnrollmentAssignments += ConvertFrom-IntunePolicyAssignment ` + -IncludeDeviceFilter $true ` + -Assignments ($getValue.androidEnrollmentAssignments) + foreach ($assignment in $returnAndroidEnrollmentAssignments) + { + if ($assignment.dataType -match 'groupAssignment' -and $null -eq $assignment.groupDisplayName) + { + Add-M365DSCEvent -Message "AndroidOsEnrollmentAssignments contain groupId $($assignment.groupId) that is an unknown group" ` + -Source $MyInvocation.MyCommand.Source ` + -EntryType Warning ` + -EventId 29 ` + -EventType Warning ` + -TenantId $Global:MSCloudLoginConnectionProfile.Intune.TenantId + + } + } + } + else + { + $returnAndroidEnrollmentAssignments = $null + } + + if ($getValue.iosEnrollmentAssignments.Count -gt 0) + { + $returnIosEnrollmentAssignments = @() + $returnIosEnrollmentAssignments += ConvertFrom-IntunePolicyAssignment ` + -IncludeDeviceFilter $true ` + -Assignments ($getValue.iosEnrollmentAssignments) + foreach ($assignment in $returnAndroidEnrollmentAssignments) + { + if ($assignment.dataType -match 'groupAssignment' -and $null -eq $assignment.groupDisplayName) + { + Add-M365DSCEvent -Message "IosEnrollmentAssignments contain groupId $($assignment.groupId) that is an unknown group" ` + -Source $MyInvocation.MyCommand.Source ` + -EntryType Warning ` + -EventId 29 ` + -EventType Warning ` + -TenantId $TenantId + } + } + } + else + { + $returnIosEnrollmentAssignments = $null + } + + if ($getValue.macOsEnrollmentAssignments.Count -gt 0) + { + $returnMacOsEnrollmentAssignments = @() + $returnMacOsEnrollmentAssignments += ConvertFrom-IntunePolicyAssignment ` + -IncludeDeviceFilter $true ` + -Assignments ($getValue.macOsEnrollmentAssignments) + foreach ($assignment in $returnMacOsEnrollmentAssignments) + { + if ($assignment.dataType -match 'groupAssignment' -and $null -eq $assignment.groupDisplayName) + { + Add-M365DSCEvent -Message "MacOsEnrollmentAssignments contain groupId $($assignment.groupId) that is an unknown group" ` + -Source $MyInvocation.MyCommand.Source ` + -EntryType Warning ` + -EventId 29 ` + -EventType Warning ` + -TenantId $TenantId + } + } + } + else + { + $returnMacOsEnrollmentAssignments = $null + } + #endregion + + #region resource generator code + $enumPartnerState = $null + if ($null -ne $getValue.PartnerState) + { + $enumPartnerState = $getValue.PartnerState.ToString() + } + #endregion + + $results = @{ + #region resource generator code + AndroidEnrollmentAssignments = $returnAndroidEnrollmentAssignments + AndroidOnboarded = $getValue.AndroidOnboarded + DisplayName = $getValue.DisplayName + IosEnrollmentAssignments = $returnIosEnrollmentAssignments + IosOnboarded = $getValue.IosOnboarded + MacOsEnrollmentAssignments = $returnMacOsEnrollmentAssignments + MacOsOnboarded = $getValue.MacOsOnboarded + PartnerState = $enumPartnerState + Id = $getValue.Id + Ensure = 'Present' + Credential = $Credential + ApplicationId = $ApplicationId + TenantId = $TenantId + ApplicationSecret = $ApplicationSecret + CertificateThumbprint = $CertificateThumbprint + ManagedIdentity = $ManagedIdentity.IsPresent + #endregion + } + + return [System.Collections.Hashtable] $results + } + catch + { + New-M365DSCLogEntry -Message 'Error retrieving data:' ` + -Exception $_ ` + -Source $($MyInvocation.MyCommand.Source) ` + -TenantId $TenantId ` + -Credential $Credential + + return $nullResult + } +} + +function Set-TargetResource +{ + [CmdletBinding()] + param + ( + #region resource generator code + [Parameter()] + [Microsoft.Management.Infrastructure.CimInstance[]] + $AndroidEnrollmentAssignments, + + [Parameter()] + [System.Boolean] + $AndroidOnboarded, + + [Parameter(Mandatory = $true)] + [System.String] + $DisplayName, + + [Parameter()] + [Microsoft.Management.Infrastructure.CimInstance[]] + $IosEnrollmentAssignments, + + [Parameter()] + [System.Boolean] + $IosOnboarded, + + [Parameter()] + [Microsoft.Management.Infrastructure.CimInstance[]] + $MacOsEnrollmentAssignments, + + [Parameter()] + [System.Boolean] + $MacOsOnboarded, + + [Parameter()] + [ValidateSet('unknown','unavailable','enabled','terminated','rejected','unresponsive')] + [System.String] + $PartnerState, + + [Parameter()] + [System.String] + $Id, + + #endregion + [Parameter()] + [System.String] + [ValidateSet('Absent', 'Present')] + $Ensure = 'Present', + + [Parameter()] + [System.Management.Automation.PSCredential] + $Credential, + + [Parameter()] + [System.String] + $ApplicationId, + + [Parameter()] + [System.String] + $TenantId, + + [Parameter()] + [System.Management.Automation.PSCredential] + $ApplicationSecret, + + [Parameter()] + [System.String] + $CertificateThumbprint, + + [Parameter()] + [Switch] + $ManagedIdentity, + + [Parameter()] + [System.String[]] + $AccessTokens + ) + + #Ensure the proper dependencies are installed in the current environment. + Confirm-M365DSCDependencies + + #region Telemetry + $ResourceName = $MyInvocation.MyCommand.ModuleName.Replace('MSFT_', '') + $CommandName = $MyInvocation.MyCommand + $data = Format-M365DSCTelemetryParameters -ResourceName $ResourceName ` + -CommandName $CommandName ` + -Parameters $PSBoundParameters + Add-M365DSCTelemetryEvent -Data $data + #endregion + + $currentInstance = Get-TargetResource @PSBoundParameters + + $BoundParameters = Remove-M365DSCAuthenticationParameter -BoundParameters $PSBoundParameters + + if ($Ensure -eq 'Present' -and $currentInstance.Ensure -eq 'Absent') + { + Write-Verbose -Message "Creating an Intune Device Management Compliance Management Partner with DisplayName {$DisplayName}" + + $createParameters = ([Hashtable]$BoundParameters).Clone() + $createParameters = Rename-M365DSCCimInstanceParameter -Properties $createParameters + $createParameters.Remove('Id') | Out-Null + + foreach ($key in ($CreateParameters.clone()).Keys) + { + if ($CreateParameters[$key].getType().Fullname -like '*CimInstance*') + { + $CreateParameters[$key] = Convert-M365DSCDRGComplexTypeToHashtable -ComplexObject $CreateParameters[$key] + } + } + + #Assignments in DSC are flattened and must be re-inflated so each assignment refer to one or more targets + Convert-AssignmentListToTargetList -Parameters $createParameters + + #region resource generator code + $createParameters.Add("@odata.type", "#microsoft.graph.ComplianceManagementPartner") + $policy = New-MgBetaDeviceManagementComplianceManagementPartner -BodyParameter $createParameters + #endregion + } + elseif ($Ensure -eq 'Present' -and $currentInstance.Ensure -eq 'Present') + { + Write-Verbose -Message "Updating the Intune Device Management Compliance Management Partner with Id {$($currentInstance.Id)}" + + $updateParameters = ([Hashtable]$BoundParameters).Clone() + $updateParameters = Rename-M365DSCCimInstanceParameter -Properties $updateParameters + + $updateParameters.Remove('Id') | Out-Null + + foreach ($key in ($UpdateParameters.clone()).Keys) + { + if ($updateParameters[$key].getType().Fullname -like '*CimInstance*') + { + $updateParameters[$key] = Convert-M365DSCDRGComplexTypeToHashtable -ComplexObject $updateParameters[$key] + } + } + + #Assignments in DSC are flattened and must be re-inflated so each assignment refer to one or more targets + Convert-AssignmentListToTargetList -Parameters $updateParameters + + #region resource generator code + $UpdateParameters.Add("@odata.type", "#microsoft.graph.ComplianceManagementPartner") + Update-MgBetaDeviceManagementComplianceManagementPartner ` + -ComplianceManagementPartnerId $currentInstance.Id ` + -BodyParameter $UpdateParameters + #endregion + } + elseif ($Ensure -eq 'Absent' -and $currentInstance.Ensure -eq 'Present') + { + Write-Verbose -Message "Removing the Intune Device Management Compliance Management Partner with Id {$($currentInstance.Id)}" + #region resource generator code + Remove-MgBetaDeviceManagementComplianceManagementPartner -ComplianceManagementPartnerId $currentInstance.Id + #endregion + } +} + +function Test-TargetResource +{ + [CmdletBinding()] + [OutputType([System.Boolean])] + param + ( + #region resource generator code + [Parameter()] + [Microsoft.Management.Infrastructure.CimInstance[]] + $AndroidEnrollmentAssignments, + + [Parameter()] + [System.Boolean] + $AndroidOnboarded, + + [Parameter(Mandatory = $true)] + [System.String] + $DisplayName, + + [Parameter()] + [Microsoft.Management.Infrastructure.CimInstance[]] + $IosEnrollmentAssignments, + + [Parameter()] + [System.Boolean] + $IosOnboarded, + + [Parameter()] + [Microsoft.Management.Infrastructure.CimInstance[]] + $MacOsEnrollmentAssignments, + + [Parameter()] + [System.Boolean] + $MacOsOnboarded, + + [Parameter()] + [ValidateSet('unknown','unavailable','enabled','terminated','rejected','unresponsive')] + [System.String] + $PartnerState, + + [Parameter()] + [System.String] + $Id, + + #endregion + + [Parameter()] + [System.String] + [ValidateSet('Absent', 'Present')] + $Ensure = 'Present', + + [Parameter()] + [System.Management.Automation.PSCredential] + $Credential, + + [Parameter()] + [System.String] + $ApplicationId, + + [Parameter()] + [System.String] + $TenantId, + + [Parameter()] + [System.Management.Automation.PSCredential] + $ApplicationSecret, + + [Parameter()] + [System.String] + $CertificateThumbprint, + + [Parameter()] + [Switch] + $ManagedIdentity, + + [Parameter()] + [System.String[]] + $AccessTokens + ) + + #Ensure the proper dependencies are installed in the current environment. + Confirm-M365DSCDependencies + + #region Telemetry + $ResourceName = $MyInvocation.MyCommand.ModuleName.Replace('MSFT_', '') + $CommandName = $MyInvocation.MyCommand + $data = Format-M365DSCTelemetryParameters -ResourceName $ResourceName ` + -CommandName $CommandName ` + -Parameters $PSBoundParameters + Add-M365DSCTelemetryEvent -Data $data + #endregion + + Write-Verbose -Message "Testing configuration of the Intune Device Management Compliance Management Partner with Id {$Id} and DisplayName {$DisplayName}" + + $CurrentValues = Get-TargetResource @PSBoundParameters + $ValuesToCheck = ([Hashtable]$PSBoundParameters).clone() + + if ($CurrentValues.Ensure -ne $Ensure) + { + Write-Verbose -Message "Test-TargetResource returned $false" + return $false + } + $testResult = $true + + #Compare Cim instances + foreach ($key in $PSBoundParameters.Keys) + { + $source = $PSBoundParameters.$key + $target = $CurrentValues.$key + if ($null -ne $source -and $source.GetType().Name -like '*CimInstance*') + { + $testResult = Compare-M365DSCComplexObject ` + -Source ($source) ` + -Target ($target) + + if (-not $testResult) + { + break + } + + $ValuesToCheck.Remove($key) | Out-Null + } + } + + $ValuesToCheck.Remove('Id') | Out-Null + $ValuesToCheck = Remove-M365DSCAuthenticationParameter -BoundParameters $ValuesToCheck + + Write-Verbose -Message "Current Values: $(Convert-M365DscHashtableToString -Hashtable $CurrentValues)" + Write-Verbose -Message "Target Values: $(Convert-M365DscHashtableToString -Hashtable $ValuesToCheck)" + + if ($testResult) + { + $testResult = Test-M365DSCParameterState -CurrentValues $CurrentValues ` + -Source $($MyInvocation.MyCommand.Source) ` + -DesiredValues $PSBoundParameters ` + -ValuesToCheck $ValuesToCheck.Keys + } + + Write-Verbose -Message "Test-TargetResource returned $testResult" + + return $testResult +} + +function Export-TargetResource +{ + [CmdletBinding()] + [OutputType([System.String])] + param + ( + [Parameter()] + [System.String] + $Filter, + + [Parameter()] + [System.Management.Automation.PSCredential] + $Credential, + + [Parameter()] + [System.String] + $ApplicationId, + + [Parameter()] + [System.String] + $TenantId, + + [Parameter()] + [System.Management.Automation.PSCredential] + $ApplicationSecret, + + [Parameter()] + [System.String] + $CertificateThumbprint, + + [Parameter()] + [Switch] + $ManagedIdentity, + + [Parameter()] + [System.String[]] + $AccessTokens + ) + + $ConnectionMode = New-M365DSCConnection -Workload 'MicrosoftGraph' ` + -InboundParameters $PSBoundParameters + + #Ensure the proper dependencies are installed in the current environment. + Confirm-M365DSCDependencies + + #region Telemetry + $ResourceName = $MyInvocation.MyCommand.ModuleName.Replace('MSFT_', '') + $CommandName = $MyInvocation.MyCommand + $data = Format-M365DSCTelemetryParameters -ResourceName $ResourceName ` + -CommandName $CommandName ` + -Parameters $PSBoundParameters + Add-M365DSCTelemetryEvent -Data $data + #endregion + + try + { + #region resource generator code + [array]$getValue = Get-MgBetaDeviceManagementComplianceManagementPartner ` + -Filter $Filter ` + -All ` + -ErrorAction Stop + #endregion + + $i = 1 + $dscContent = '' + if ($getValue.Length -eq 0) + { + Write-Host $Global:M365DSCEmojiGreenCheckMark + } + else + { + Write-Host "`r`n" -NoNewline + } + foreach ($config in $getValue) + { + $displayedKey = $config.Id + if (-not [String]::IsNullOrEmpty($config.displayName)) + { + $displayedKey = $config.displayName + } + elseif (-not [string]::IsNullOrEmpty($config.name)) + { + $displayedKey = $config.name + } + Write-Host " |---[$i/$($getValue.Count)] $displayedKey" -NoNewline + $params = @{ + Id = $config.Id + DisplayName = $config.DisplayName + Ensure = 'Present' + Credential = $Credential + ApplicationId = $ApplicationId + TenantId = $TenantId + ApplicationSecret = $ApplicationSecret + CertificateThumbprint = $CertificateThumbprint + ManagedIdentity = $ManagedIdentity.IsPresent + AccessTokens = $AccessTokens + } + + $Results = Get-TargetResource @Params + $Results = Update-M365DSCExportAuthenticationResults -ConnectionMode $ConnectionMode ` + -Results $Results + if ($null -ne $Results.AndroidEnrollmentAssignments) + { + $complexTypeStringResult = Get-M365DSCDRGComplexTypeToString ` + -ComplexObject $Results.AndroidEnrollmentAssignments ` + -CIMInstanceName 'IntuneDeviceAndAppManagementAssignmentTarget' + + if (-not [String]::IsNullOrWhiteSpace($complexTypeStringResult)) + { + $Results.AndroidEnrollmentAssignments = $complexTypeStringResult + } + else + { + $Results.Remove('AndroidEnrollmentAssignments') | Out-Null + } + } + if ($null -ne $Results.IosEnrollmentAssignments) + { + $complexTypeStringResult = Get-M365DSCDRGComplexTypeToString ` + -ComplexObject $Results.IosEnrollmentAssignments ` + -CIMInstanceName 'IntuneDeviceAndAppManagementAssignmentTarget' + + if (-not [String]::IsNullOrWhiteSpace($complexTypeStringResult)) + { + $Results.IosEnrollmentAssignments = $complexTypeStringResult + } + else + { + $Results.Remove('IosEnrollmentAssignments') | Out-Null + } + } + if ($null -ne $Results.MacOsEnrollmentAssignments) + { + $complexTypeStringResult = Get-M365DSCDRGComplexTypeToString ` + -ComplexObject $Results.MacOsEnrollmentAssignments ` + -CIMInstanceName 'IntuneDeviceAndAppManagementAssignmentTarget' + + if (-not [String]::IsNullOrWhiteSpace($complexTypeStringResult)) + { + $Results.MacOsEnrollmentAssignments = $complexTypeStringResult + } + else + { + $Results.Remove('MacOsEnrollmentAssignments') | Out-Null + } + } + + $currentDSCBlock = Get-M365DSCExportContentForResource -ResourceName $ResourceName ` + -ConnectionMode $ConnectionMode ` + -ModulePath $PSScriptRoot ` + -Results $Results ` + -Credential $Credential + + $dscContent += $currentDSCBlock + Save-M365DSCPartialExport -Content $currentDSCBlock ` + -FileName $Global:PartialExportFileName + $i++ + Write-Host $Global:M365DSCEmojiGreenCheckMark + } + return $dscContent + } + catch + { + Write-Host $Global:M365DSCEmojiRedX + + New-M365DSCLogEntry -Message 'Error during Export:' ` + -Exception $_ ` + -Source $($MyInvocation.MyCommand.Source) ` + -TenantId $TenantId ` + -Credential $Credential + + return '' + } +} + +function Convert-AssignmentListToTargetList +{ + [CmdletBinding()] + #[OutputType([System.Collections.Hashtable])] + param( + [Parameter(Mandatory)] + [System.Collections.Hashtable]$Parameters + ) + begin + { + $calledBy = $null + } + process + { + #$outputParameters = [hashtable]$InputParameters.Clone() + if ($Parameters.AndroidEnrollmentAssignments.Count -gt 0) + { + $androidEnrollmentAssignmentsHash = ConvertTo-IntunePolicyAssignment -IncludeDeviceFilter $true ` + -Assignments $Parameters.AndroidEnrollmentAssignments #-DataTypeName '@odata.Type' + if ($androidEnrollmentAssignmentsHash.Count -ne $Parameters.AndroidEnrollmentAssignments.Count) + { + if ($null -eq $calledBy) + { + $calledBy = Get-PSCallStack | Select-Object -Skip 1 -First 1 -ExpandProperty InvocationInfo + } + Add-M365DSCEvent -Message "One or more group-assignments in AndroidEnrollmentAssignments refer to unknown groups" ` + -Source $calledBy.MyCommand.Source ` + -EntryType Error ` + -EventId 29 ` + -EventType Error ` + -TenantId $TenantId + } + $collectionsOk = $true + foreach ($assigment in $Parameters.AndroidEnrollmentAssignments) + { + if ($assignment.dataType -match 'Collection' -and $null -eq $assignment.CollectionId) + { + $collectionsOk = $false + } + } + if (-not $collectionsOk) + { + if ($null -eq $calledBy) + { + $calledBy = Get-PSCallStack | Select-Object -Skip 1 -First 1 -ExpandProperty InvocationInfo + } + Add-M365DSCEvent -Message "One or more collection-assignments in AndroidEnrollmentAssignments is missing a CollectionId" ` + -Source $calledBy.MyCommand.Source ` + -EntryType Error ` + -EventId 39 ` + -EventType Error ` + -TenantId $TenantId + + } + $Parameters.AndroidEnrollmentAssignments = $androidEnrollmentAssignmentsHash + } + if ($Parameters.IosEnrollmentAssignments.Count -gt 0) + { + $iosEnrollmentAssignmentsHash = ConvertTo-IntunePolicyAssignment -IncludeDeviceFilter $true ` + -Assignments $Parameters.IosEnrollmentAssignments #-DataTypeName '@odata.Type' + if ($iosEnrollmentAssignmentsHash.Count -ne $Parameters.IosEnrollmentAssignments.Count) + { + if ($null -eq $calledBy) + { + $calledBy = Get-PSCallStack | Select-Object -Skip 1 -First 1 -ExpandProperty InvocationInfo + } + Add-M365DSCEvent -Message "One or more group-assignments in IosEnrollmentAssignments refer to unknown groups" ` + -Source $calledBy.MyCommand.Source ` + -EntryType Error ` + -EventId 39 ` + -EventType Error ` + -TenantId $TenantId + } + $collectionsOk = $true + foreach ($assigment in $Parameters.IosEnrollmentAssignments) + { + if ($assignment.dataType -match 'Collection' -and $null -eq $assignment.CollectionId) + { + $collectionsOk = $false + } + } + if (-not $collectionsOk) + { + if ($null -eq $calledBy) + { + $calledBy = Get-PSCallStack | Select-Object -Skip 1 -First 1 -ExpandProperty InvocationInfo + } + Add-M365DSCEvent -Message "One or more collection-assignments in IosEnrollmentAssignments is missing a CollectionId" ` + -Source $calledBy.MyCommand.Source ` + -EntryType Error ` + -EventId 39 ` + -EventType Error ` + -TenantId $TenantId + + } + $Parameters.IosEnrollmentAssignments = $iosEnrollmentAssignmentsHash + } + if ($Parameters.MacOsEnrollmentAssignments.Count -gt 0) + { + $macOsEnrollmentAssignmentsHash = ConvertTo-IntunePolicyAssignment -IncludeDeviceFilter $true ` + -Assignments $Parameters.MacOsEnrollmentAssignments #-DataTypeName '@odata.Type' + if ($macOsEnrollmentAssignmentsHash.Count -ne $Parameters.MacOsEnrollmentAssignments.Count) + { + if ($null -eq $calledBy) + { + $calledBy = Get-PSCallStack | Select-Object -Skip 1 -First 1 -ExpandProperty InvocationInfo + } + Add-M365DSCEvent -Message "One or more group-assignments in MacOsEnrollmentAssignments refer to unknown groups" ` + -Source $calledBy.MyCommand.Source ` + -EntryType Error ` + -EventId 29 ` + -EventType Error ` + -TenantId $TenantId + } + $collectionsOk = $true + foreach ($assigment in $Parameters.MacOsEnrollmentAssignments) + { + if ($assignment.dataType -match 'Collection' -and $null -eq $assignment.CollectionId) + { + $collectionsOk = $false + } + } + if (-not $collectionsOk) + { + if ($null -eq $calledBy) + { + $calledBy = Get-PSCallStack | Select-Object -Skip 1 -First 1 -ExpandProperty InvocationInfo + } + Add-M365DSCEvent -Message "One or more collection-assignments in MacOsEnrollmentAssignments is missing a CollectionId" ` + -Source $calledBy.MyCommand.Source ` + -EntryType Error ` + -EventId 39 ` + -EventType Error ` + -TenantId $TenantId + + } + $Parameters.MacOsEnrollmentAssignments = $macOsEnrollmentAssignmentsHash + } + } +} + +Export-ModuleMember -Function *-TargetResource diff --git a/Modules/Microsoft365DSC/DSCResources/MSFT_IntuneDeviceManagementComplianceManagementPartner/MSFT_IntuneDeviceManagementComplianceManagementPartner.schema.mof b/Modules/Microsoft365DSC/DSCResources/MSFT_IntuneDeviceManagementComplianceManagementPartner/MSFT_IntuneDeviceManagementComplianceManagementPartner.schema.mof new file mode 100644 index 0000000000..cd26349d16 --- /dev/null +++ b/Modules/Microsoft365DSC/DSCResources/MSFT_IntuneDeviceManagementComplianceManagementPartner/MSFT_IntuneDeviceManagementComplianceManagementPartner.schema.mof @@ -0,0 +1,37 @@ +[ClassVersion("1.0.0")] +class MSFT_IntuneComplianceManagementPartnerAssignment +{ + [Write, Description("Group assignment target."), EmbeddedInstance("MSFT_IntuneDeviceAndAppManagementAssignmentTarget")] String Target; +}; +[ClassVersion("1.0.0")] +class MSFT_IntuneDeviceAndAppManagementAssignmentTarget +{ + [Write, Description("The ID of the filter for the target assignment.")] String DeviceAndAppManagementAssignmentFilterId; + [Write, Description("The type of filter of the target assignment i.e. Exclude or Include. Possible values are: none, include, exclude."), ValueMap{"none","include","exclude"}, Values{"none","include","exclude"}] String DeviceAndAppManagementAssignmentFilterType; + [Write, Description("AAD Group Id.")] String GroupId; + [Write, Description("AAD Group DisplayName.")] String GroupDisplayName; + [Write, Description("The collection Id that is the target of the assignment.")] String CollectionId; + [Write, Description("The type of the entity."), ValueMap{"#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.androidFotaDeploymentAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget","#microsoft.graph.groupAssignmentTarget"}, Values{"#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.androidFotaDeploymentAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget","#microsoft.graph.groupAssignmentTarget"}] String dataType; +}; + +[ClassVersion("1.0.0.0"), FriendlyName("IntuneDeviceManagementComplianceManagementPartner")] +class MSFT_IntuneDeviceManagementComplianceManagementPartner : OMI_BaseResource +{ + [Write, Description("User groups which enroll Android devices through partner."), EmbeddedInstance("MSFT_IntuneDeviceAndAppManagementAssignmentTarget")] String AndroidEnrollmentAssignments[]; + [Write, Description("Partner onboarded for Android devices.")] Boolean AndroidOnboarded; + [Key, Description("Partner display name")] String DisplayName; + [Write, Description("User groups which enroll ios devices through partner."), EmbeddedInstance("MSFT_IntuneDeviceAndAppManagementAssignmentTarget")] String IosEnrollmentAssignments[]; + [Write, Description("Partner onboarded for ios devices.")] Boolean IosOnboarded; + [Write, Description("User groups which enroll Mac devices through partner."), EmbeddedInstance("MSFT_IntuneDeviceAndAppManagementAssignmentTarget")] String MacOsEnrollmentAssignments[]; + [Write, Description("Partner onboarded for Mac devices.")] Boolean MacOsOnboarded; + [Write, Description("Partner state of this tenant. Possible values are: unknown, unavailable, enabled, terminated, rejected, unresponsive."), ValueMap{"unknown","unavailable","enabled","terminated","rejected","unresponsive"}, Values{"unknown","unavailable","enabled","terminated","rejected","unresponsive"}] String PartnerState; + [Write, Description("The unique identifier for an entity. Read-only.")] String Id; + [Write, Description("Present ensures the policy exists, absent ensures it is removed."), ValueMap{"Present","Absent"}, Values{"Present","Absent"}] string Ensure; + [Write, Description("Credentials of the Admin"), EmbeddedInstance("MSFT_Credential")] string Credential; + [Write, Description("Id of the Azure Active Directory application to authenticate with.")] String ApplicationId; + [Write, Description("Id of the Azure Active Directory tenant used for authentication.")] String TenantId; + [Write, Description("Secret of the Azure Active Directory tenant used for authentication."), EmbeddedInstance("MSFT_Credential")] String ApplicationSecret; + [Write, Description("Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication.")] String CertificateThumbprint; + [Write, Description("Managed ID being used for authentication.")] Boolean ManagedIdentity; + [Write, Description("Access token used for authentication.")] String AccessTokens[]; +}; diff --git a/Modules/Microsoft365DSC/DSCResources/MSFT_IntuneDeviceManagementComplianceManagementPartner/readme.md b/Modules/Microsoft365DSC/DSCResources/MSFT_IntuneDeviceManagementComplianceManagementPartner/readme.md new file mode 100644 index 0000000000..16b90d3c50 --- /dev/null +++ b/Modules/Microsoft365DSC/DSCResources/MSFT_IntuneDeviceManagementComplianceManagementPartner/readme.md @@ -0,0 +1,6 @@ + +# IntuneDeviceManagementComplianceManagementPartner + +## Description + +Intune Device Management Compliance Management Partner diff --git a/Modules/Microsoft365DSC/DSCResources/MSFT_IntuneDeviceManagementComplianceManagementPartner/settings.json b/Modules/Microsoft365DSC/DSCResources/MSFT_IntuneDeviceManagementComplianceManagementPartner/settings.json new file mode 100644 index 0000000000..1675aa1eae --- /dev/null +++ b/Modules/Microsoft365DSC/DSCResources/MSFT_IntuneDeviceManagementComplianceManagementPartner/settings.json @@ -0,0 +1,57 @@ +{ + "resourceName": "IntuneDeviceManagementComplianceManagementPartner", + "description": "This resource configures an Intune Device Management Compliance Management Partner.", + "permissions": { + "graph": { + "delegated": { + "read": [ + { + "name": "DeviceManagementServiceConfig.Read.All" + }, + { + "name": "DeviceManagementConfiguration.Read.All" + }, + { + "name": "Group.Read.All" + } + ], + "update": [ + { + "name": "DeviceManagementServiceConfig.ReadWrite.All" + }, + { + "name": "DeviceManagementConfiguration.ReadWrite.All" + }, + { + "name": "Group.Read.All" + } + ] + }, + "application": { + "read": [ + { + "name": "DeviceManagementServiceConfig.Read.All" + }, + { + "name": "DeviceManagementConfiguration.Read.All" + }, + { + "name": "Group.Read.All" + } + ], + "update": [ + { + "name": "DeviceManagementServiceConfig.ReadWrite.All" + }, + { + "name": "DeviceManagementConfiguration.ReadWrite.All" + }, + { + "name": "Group.Read.All" + } + ] + } + } +} + +} diff --git a/Modules/Microsoft365DSC/Examples/Resources/IntuneDeviceManagementComplianceManagementPartner/1-Create.ps1 b/Modules/Microsoft365DSC/Examples/Resources/IntuneDeviceManagementComplianceManagementPartner/1-Create.ps1 new file mode 100644 index 0000000000..00b634cab3 --- /dev/null +++ b/Modules/Microsoft365DSC/Examples/Resources/IntuneDeviceManagementComplianceManagementPartner/1-Create.ps1 @@ -0,0 +1,56 @@ +<# +This example creates a new Device Management Compliance Management Partner. +#> + +Configuration Example +{ + param( + [Parameter()] + [System.String] + $ApplicationId, + + [Parameter()] + [System.String] + $TenantId, + + [Parameter()] + [System.String] + $CertificateThumbprint + ) + Import-DscResource -ModuleName Microsoft365DSC + + node localhost + { + IntuneDeviceManagementComplianceManagementPartner '6b43c039-c1d0-4a9f-aab9-48c5531acbd6' + { + AndroidEnrollmentAssignments = @( + MSFT_IntuneDeviceAndAppManagementAssignmentTarget{ + GroupDisplayName = 'All devices' + dataType = "#microsoft.graph.allDevicesAssignmentTarget" + } + ) + AndroidOnboarded = $True + DisplayName = "3rdPartyPartnerAndroidManagement" + IosEnrollmentAssignments = @( + MSFT_IntuneDeviceAndAppManagementAssignmentTarget{ + GroupDisplayName = 'SomeGroup' + dataType = "#microsoft.graph.groupAssignmentTarget" + } + ) + IosOnboarded = $True + MacOsEnrollmentAssignments = @( + MSFT_IntuneDeviceAndAppManagementAssignmentTarget{ + DeviceAndAppManagementAssignmentFilterId = "FakeStringValue" + CollectionId = 'SomeCollectionId' + dataType = "#microsoft.graph.configurationManagerCollectionAssignmentTarget" + DeviceAndAppManagementAssignmentFilterType = "none" + } + ) + PartnerState = "enabled" + Ensure = "Present" + ApplicationId = $ApplicationId + TenantId = $TenantId + CertificateThumbprint = $CertificateThumbprint; + } + } +} diff --git a/Modules/Microsoft365DSC/Examples/Resources/IntuneDeviceManagementComplianceManagementPartner/2-Update.ps1 b/Modules/Microsoft365DSC/Examples/Resources/IntuneDeviceManagementComplianceManagementPartner/2-Update.ps1 new file mode 100644 index 0000000000..0f88411d79 --- /dev/null +++ b/Modules/Microsoft365DSC/Examples/Resources/IntuneDeviceManagementComplianceManagementPartner/2-Update.ps1 @@ -0,0 +1,41 @@ +<# +This example updates an existing Device Management Compliance Management Partner. +#> + +Configuration Example +{ + param( + [Parameter()] + [System.String] + $ApplicationId, + + [Parameter()] + [System.String] + $TenantId, + + [Parameter()] + [System.String] + $CertificateThumbprint + ) + Import-DscResource -ModuleName Microsoft365DSC + + node localhost + { + IntuneDeviceManagementComplianceManagementPartner '6b43c039-c1d0-4a9f-aab9-48c5531acbd6' + { + IosEnrollmentAssignments = @( + MSFT_IntuneDeviceAndAppManagementAssignmentTarget{ + GroupDisplayName = 'All devices' + dataType = "#microsoft.graph.allDevicesAssignmentTarget" + } + ) + IosOnboarded = $True + DisplayName = "3rdPartyPartnerIosManagement" + PartnerState = "enabled" + Ensure = "Present" + ApplicationId = $ApplicationId + TenantId = $TenantId + CertificateThumbprint = $CertificateThumbprint; + } + } +} diff --git a/Modules/Microsoft365DSC/Examples/Resources/IntuneDeviceManagementComplianceManagementPartner/3-Remove.ps1 b/Modules/Microsoft365DSC/Examples/Resources/IntuneDeviceManagementComplianceManagementPartner/3-Remove.ps1 new file mode 100644 index 0000000000..ba2a4a65b7 --- /dev/null +++ b/Modules/Microsoft365DSC/Examples/Resources/IntuneDeviceManagementComplianceManagementPartner/3-Remove.ps1 @@ -0,0 +1,33 @@ +<# +This example removes a Device Management Compliance Management Partner. +#> + +Configuration Example +{ + param( + [Parameter()] + [System.String] + $ApplicationId, + + [Parameter()] + [System.String] + $TenantId, + + [Parameter()] + [System.String] + $CertificateThumbprint + ) + Import-DscResource -ModuleName Microsoft365DSC + + node localhost + { + IntuneDeviceManagementComplianceManagementPartner '6b43c039-c1d0-4a9f-aab9-48c5531acbd6' + { + DisplayName = "3rdPartyPartnerAndroidManagement" + Ensure = "Absent" + ApplicationId = $ApplicationId + TenantId = $TenantId + CertificateThumbprint = $CertificateThumbprint; + } + } +} diff --git a/Modules/Microsoft365DSC/Modules/M365DSCDRGUtil.psm1 b/Modules/Microsoft365DSC/Modules/M365DSCDRGUtil.psm1 index 2ba46fb602..824a761ee9 100644 --- a/Modules/Microsoft365DSC/Modules/M365DSCDRGUtil.psm1 +++ b/Modules/Microsoft365DSC/Modules/M365DSCDRGUtil.psm1 @@ -86,7 +86,6 @@ function Rename-M365DSCCimInstanceParameter { $hashProperties = Get-M365DSCDRGComplexTypeToHashtable -ComplexObject $result $keys = ($hashProperties.clone()).keys - foreach ($key in $keys) { $keyName = $key.substring(0, 1).tolower() + $key.substring(1, $key.length - 1) @@ -864,9 +863,14 @@ function ConvertFrom-IntunePolicyAssignment [Parameter(Mandatory = $true)] [Array] $Assignments, + [Parameter()] [System.Boolean] - $IncludeDeviceFilter = $true + $IncludeDeviceFilter = $true<#, + + [Parameter()] + [System.string] + $DataTypeName = 'dataType'#> ) $assignmentResult = @() @@ -900,12 +904,17 @@ function ConvertFrom-IntunePolicyAssignment $collectionId = $assignment.Target.AdditionalProperties.collectionId } - $hashAssignment.Add('dataType',$dataType) + $hashAssignment.Add('dataType', $dataType) if (-not [string]::IsNullOrEmpty($groupId)) { $hashAssignment.Add('groupId', $groupId) - $group = Get-MgGroup -GroupId ($groupId) -ErrorAction SilentlyContinue + try { + $group = Get-MgGroup -GroupId $groupId -ErrorAction Stop + } + catch { + write-verbose "ConvertFrom-IntunePolicyAssignment: Error in Get-MgGroup: $($_.exception.message)" + } if ($null -ne $group) { $groupDisplayName = $group.DisplayName @@ -956,9 +965,12 @@ function ConvertTo-IntunePolicyAssignment [Parameter()] [System.Boolean] - $IncludeDeviceFilter = $true - ) + $IncludeDeviceFilter = $true<#, + [Parameter()] + [System.String] + $DataTypeName = 'dataType'#> + ) if ($null -eq $Assignments) { return ,@() @@ -967,7 +979,7 @@ function ConvertTo-IntunePolicyAssignment $assignmentResult = @() foreach ($assignment in $Assignments) { - $target = @{"@odata.type" = $assignment.dataType} + $target = @{"@odata.type" = $assignment['dataType']} if ($IncludeDeviceFilter) { if ($null -ne $assignment.DeviceAndAppManagementAssignmentFilterType) @@ -982,12 +994,29 @@ function ConvertTo-IntunePolicyAssignment } elseif ($assignment.dataType -like '*GroupAssignmentTarget') { - $group = Get-MgGroup -GroupId ($assignment.groupId) -ErrorAction SilentlyContinue + if ($assignment.groupId) + { + try { + $group = Get-MgGroup -GroupId ($assignment.groupId) -ErrorAction SilentlyContinue + } + catch { + write-verbose "ConvertTo-IntunePolicyAssignment: Error in Get-MgGroup (GroupId '$($assignment.groupId)'): $($_.exception.message)" + } + } + else + { + $group = $null + } if ($null -eq $group) { if ($assignment.groupDisplayName) { - $group = Get-MgGroup -Filter "DisplayName eq '$($assignment.groupDisplayName)'" -ErrorAction SilentlyContinue + try { + $group = Get-MgGroup -Filter "DisplayName eq '$($assignment.groupDisplayName)'" -ErrorAction Stop + } + catch { + write-verbose "ConvertTo-IntunePolicyAssignment: Error in Get-MgGroup (DisplayName '$($assignment.groupDisplayName)'): $($_.exception.message)" -ForegroundColor Yellow + } if ($null -eq $group) { $message = "Skipping assignment for the group with DisplayName {$($assignment.groupDisplayName)} as it could not be found in the directory.`r`n" diff --git a/Tests/Unit/Microsoft365DSC/Microsoft365DSC.IntuneDeviceManagementComplianceManagementPartner.Tests.ps1 b/Tests/Unit/Microsoft365DSC/Microsoft365DSC.IntuneDeviceManagementComplianceManagementPartner.Tests.ps1 new file mode 100644 index 0000000000..c84791758f --- /dev/null +++ b/Tests/Unit/Microsoft365DSC/Microsoft365DSC.IntuneDeviceManagementComplianceManagementPartner.Tests.ps1 @@ -0,0 +1,435 @@ +[CmdletBinding()] +param( +) +$M365DSCTestFolder = Join-Path -Path $PSScriptRoot ` + -ChildPath '..\..\Unit' ` + -Resolve +$CmdletModule = (Join-Path -Path $M365DSCTestFolder ` + -ChildPath '\Stubs\Microsoft365.psm1' ` + -Resolve) +$GenericStubPath = (Join-Path -Path $M365DSCTestFolder ` + -ChildPath '\Stubs\Generic.psm1' ` + -Resolve) +Import-Module -Name (Join-Path -Path $M365DSCTestFolder ` + -ChildPath '\UnitTestHelper.psm1' ` + -Resolve) + +$Global:DscHelper = New-M365DscUnitTestHelper -StubModule $CmdletModule ` + -DscResource "IntuneDeviceManagementComplianceManagementPartner" -GenericStubModule $GenericStubPath +Describe -Name $Global:DscHelper.DescribeHeader -Fixture { + InModuleScope -ModuleName $Global:DscHelper.ModuleName -ScriptBlock { + Invoke-Command -ScriptBlock $Global:DscHelper.InitializeScript -NoNewScope + BeforeAll { + + $secpasswd = ConvertTo-SecureString (New-Guid | Out-String) -AsPlainText -Force + $Credential = New-Object System.Management.Automation.PSCredential ('tenantadmin@mydomain.com', $secpasswd) + + Mock -CommandName Confirm-M365DSCDependencies -MockWith { + } + + Mock -CommandName Get-PSSession -MockWith { + } + + Mock -CommandName Remove-PSSession -MockWith { + } + + Mock -CommandName Update-MgBetaDeviceManagementComplianceManagementPartner -MockWith { + } + + Mock -CommandName New-MgBetaDeviceManagementComplianceManagementPartner -MockWith { + } + + Mock -CommandName Remove-MgBetaDeviceManagementComplianceManagementPartner -MockWith { + } + + Mock -CommandName New-M365DSCConnection -MockWith { + return "Credentials" + } + + # Mock Write-Host to hide output during the tests + Mock -CommandName Write-Host -MockWith { + } + $Script:exportedInstances =$null + $Script:ExportMode = $false + } + # Test contexts + Context -Name "The IntuneDeviceManagementComplianceManagementPartner should exist but it DOES NOT" -Fixture { + BeforeAll { + $testParams = @{ + AndroidEnrollmentAssignments = [CimInstance[]]@( + (New-CimInstance -ClassName MSFT_IntunedeviceAndAppManagementAssignmentTarget -Property @{ + dataType = "#microsoft.graph.configurationManagerCollectionAssignmentTarget" + CollectionId = "FakeStringValue" + } -ClientOnly) + ) + AndroidOnboarded = $True + DisplayName = "FakeStringValue" + Id = "FakeStringValue" + IosEnrollmentAssignments = [CimInstance[]]@( + (New-CimInstance -ClassName MSFT_IntunedeviceAndAppManagementAssignmentTarget -Property @{ + dataType = "#microsoft.graph.allDevicesAssignmentTarget" + GroupDisplayName = "All devices" + } -ClientOnly) + ) + IosOnboarded = $True + MacOsEnrollmentAssignments = [CimInstance[]]@( + (New-CimInstance -ClassName MSFT_IntunedeviceAndAppManagementAssignmentTarget -Property @{ + dataType = "#microsoft.graph.allDevicesAssignmentTarget" + GroupDisplayName = "All devices" + } -ClientOnly) + ) + MacOsOnboarded = $True + PartnerState = "unknown" + Ensure = "Present" + Credential = $Credential; + } + + Mock -CommandName Get-MgBetaDeviceManagementComplianceManagementPartner -MockWith { + return $null + } + + Mock -CommandName Get-MgGroup -MockWith { + return @{ + DisplayName = "FakeStringValue" + Id = "FakeIdValue" + SecurityEnabled = $true + } + } + } + It 'Should return Values from the Get method' { + (Get-TargetResource @testParams).Ensure | Should -Be 'Absent' + } + It 'Should return false from the Test method' { + Test-TargetResource @testParams | Should -Be $false + } + It 'Should Create the Management Partner instance from the Set method' { + Set-TargetResource @testParams + Should -Invoke -CommandName New-MgBetaDeviceManagementComplianceManagementPartner -Exactly 1 + } + } + + Context -Name "The IntuneDeviceManagementComplianceManagementPartner exists but it SHOULD NOT" -Fixture { + BeforeAll { + $testParams = @{ + AndroidEnrollmentAssignments = [CimInstance[]]@( + (New-CimInstance -ClassName MSFT_IntunedeviceAndAppManagementAssignmentTarget -Property @{ + dataType = "#microsoft.graph.allDevicesAssignmentTarget" + GroupDisplayName = 'All devices' + } -ClientOnly) + ) + AndroidOnboarded = $True + DisplayName = "FakeStringValue" + Id = "FakeStringValue" + IosEnrollmentAssignments = [CimInstance[]]@( + (New-CimInstance -ClassName MSFT_IntunedeviceAndAppManagementAssignmentTarget -Property @{ + dataType = "#microsoft.graph.allDevicesAssignmentTarget" + GroupDisplayName = "All devices" + } -ClientOnly) + ) + IosOnboarded = $True + MacOsEnrollmentAssignments = [CimInstance[]]@( + (New-CimInstance -ClassName MSFT_IntunedeviceAndAppManagementAssignmentTarget -Property @{ + dataType = "#microsoft.graph.configurationManagerCollectionAssignmentTarget" + CollectionId = "FakeStringValue" + DeviceAndAppManagementAssignmentFilterId = "FakeStringValue" + DeviceAndAppManagementAssignmentFilterType = "none" + } -ClientOnly) + ) + MacOsOnboarded = $True + PartnerState = "unknown" + Ensure = 'Absent' + Credential = $Credential; + } + + Mock -CommandName Get-MgBetaDeviceManagementComplianceManagementPartner -MockWith { + return @{ + AdditionalProperties = @{ + '@odata.type' = "#microsoft.graph.ComplianceManagementPartner" + } + AndroidEnrollmentAssignments = @( + @{ + Target = @{ + '@odata.type' = "#microsoft.graph.allDevicesAssignmentTarget" + } + } + ) + AndroidOnboarded = $True + DisplayName = "FakeStringValue" + Id = "FakeStringValue" + IosEnrollmentAssignments = @( + @{ + Target = @{ + '@odata.type' = "#microsoft.graph.allDevicesAssignmentTarget" + } + } + ) + IosOnboarded = $True + LastHeartbeatDateTime = "2023-01-01T00:00:00.0000000+01:00" + MacOsEnrollmentAssignments = @( + @{ + Target = @{ + '@odata.type' = "#microsoft.graph.configurationManagerCollectionAssignmentTarget" + collectionId = "FakeStringValue" + } + } + ) + MacOsOnboarded = $True + PartnerState = "unknown" + + } + } + + Mock -CommandName Get-MgGroup -MockWith { + return @{ + DisplayName = "FakeStringValue" + Id = "FakeIdValue" + SecurityEnabled = $true + } + } + } + + It 'Should return Values from the Get method' { + (Get-TargetResource @testParams).Ensure | Should -Be 'Present' + } + + It 'Should return true from the Test method' { + Test-TargetResource @testParams | Should -Be $false + } + + It 'Should Remove the Management Partner instance from the Set method' { + Set-TargetResource @testParams + Should -Invoke -CommandName Remove-MgBetaDeviceManagementComplianceManagementPartner -Exactly 1 + } + } + + Context -Name "The IntuneDeviceManagementComplianceManagementPartner Exists and Values are already in the desired state" -Fixture { + BeforeAll { + $testParams = @{ + AndroidEnrollmentAssignments = [CimInstance[]]@( + (New-CimInstance -ClassName MSFT_IntunedeviceAndAppManagementAssignmentTarget -Property @{ + dataType = "#microsoft.graph.allDevicesAssignmentTarget" + GroupDisplayName = "All devices" + } -ClientOnly) + ) + AndroidOnboarded = $True + DisplayName = "FakeStringValue" + Id = "FakeStringValue" + IosEnrollmentAssignments = [CimInstance[]]@( + (New-CimInstance -ClassName MSFT_IntunedeviceAndAppManagementAssignmentTarget -Property @{ + GroupDisplayName = "All devices" + dataType = "#microsoft.graph.allDevicesAssignmentTarget" + } -ClientOnly) + ) + IosOnboarded = $True + MacOsEnrollmentAssignments = [CimInstance[]]@( + (New-CimInstance -ClassName MSFT_IntunedeviceAndAppManagementAssignmentTarget -Property @{ + dataType = "#microsoft.graph.configurationManagerCollectionAssignmentTarget" + CollectionId = "FakeStringValue" + } -ClientOnly) + ) + MacOsOnboarded = $True + PartnerState = "unknown" + Ensure = 'Present' + Credential = $Credential; + } + + Mock -CommandName Get-MgBetaDeviceManagementComplianceManagementPartner -MockWith { + return @{ + AdditionalProperties = @{ + '@odata.type' = "#microsoft.graph.ComplianceManagementPartner" + } + AndroidEnrollmentAssignments = @( + @{ + Target = @{ + '@odata.type' = "#microsoft.graph.allDevicesAssignmentTarget" + } + } + ) + AndroidOnboarded = $True + DisplayName = "FakeStringValue" + Id = "FakeStringValue" + IosEnrollmentAssignments = @( + @{ + Target = @{ + '@odata.type' = "#microsoft.graph.allDevicesAssignmentTarget" + } + } + ) + IosOnboarded = $True + LastHeartbeatDateTime = "2023-01-01T00:00:00.0000000+01:00" + MacOsEnrollmentAssignments = @( + @{ + Target = @{ + '@odata.type' = "#microsoft.graph.configurationManagerCollectionAssignmentTarget" + collectionId = "FakeStringValue" + } + } + ) + MacOsOnboarded = $True + PartnerState = "unknown" + + } + } + + Mock -CommandName Get-MgGroup -MockWith { + return @{ + DisplayName = "FakeStringValue" + Id = "FakeIdValue" + SecurityEnabled = $true + } + } + } + + + It 'Should return true from the Test method' { + Test-TargetResource @testParams | Should -Be $true + } + } + + Context -Name "The IntuneDeviceManagementComplianceManagementPartner exists and values are NOT in the desired state" -Fixture { + BeforeAll { + $testParams = @{ + AndroidEnrollmentAssignments = [CimInstance[]]@( + (New-CimInstance -ClassName MSFT_IntunedeviceAndAppManagementAssignmentTarget -Property @{ + dataType = "#microsoft.graph.allDevicesAssignmentTarget" + GroupDisplayName = "All devices" + } -ClientOnly) + ) + AndroidOnboarded = $True + DisplayName = "FakeStringValue" + Id = "FakeStringValue" + IosEnrollmentAssignments = [CimInstance[]]@( + (New-CimInstance -ClassName MSFT_IntunedeviceAndAppManagementAssignmentTarget -Property @{ + dataType = "#microsoft.graph.allDevicesAssignmentTarget" + GroupDisplayName = "All devices" + } -ClientOnly) + ) + IosOnboarded = $True + MacOsEnrollmentAssignments = [CimInstance[]]@( + (New-CimInstance -ClassName MSFT_IntunedeviceAndAppManagementAssignmentTarget -Property @{ + dataType = "#microsoft.graph.allDevicesAssignmentTarget" + GroupDisplayName = "All devices" + } -ClientOnly) + ) + MacOsOnboarded = $True + PartnerState = "unknown" + Ensure = 'Present' + Credential = $Credential; + } + + Mock -CommandName Get-MgBetaDeviceManagementComplianceManagementPartner -MockWith { + return @{ + AndroidEnrollmentAssignments = @( + @{ + Target = @{ + '@odata.type' = "#microsoft.graph.allDevicesAssignmentTarget" + } + } + ) + DisplayName = "FakeStringValue" + Id = "FakeStringValue" + IosEnrollmentAssignments = @( + @{ + Target = @{ + '@odata.type' = "#microsoft.graph.allDevicesAssignmentTarget" + } + } + ) + LastHeartbeatDateTime = "2023-01-01T00:00:00.0000000+01:00" + MacOsEnrollmentAssignments = @( + @{ + Target = @{ + '@odata.type' = "#microsoft.graph.allDevicesAssignmentTarget" + } + } + ) + PartnerState = "unknown" + } + } + + Mock -CommandName Get-MgGroup -MockWith { + return @{ + DisplayName = "FakeStringValue" + Id = "FakeIdValue" + SecurityEnabled = $true + } + } + } + + It 'Should return Values from the Get method' { + (Get-TargetResource @testParams).Ensure | Should -Be 'Present' + } + + It 'Should return false from the Test method' { + Test-TargetResource @testParams | Should -Be $false + } + + It 'Should update the Management Partner instance from the Set method' { + Set-TargetResource @testParams + Should -Invoke -CommandName Update-MgBetaDeviceManagementComplianceManagementPartner -Exactly 1 + } + } + + Context -Name 'ReverseDSC Tests' -Fixture { + BeforeAll { + $Global:CurrentModeIsExport = $true + $Global:PartialExportFileName = "$(New-Guid).partial.ps1" + $testParams = @{ + Credential = $Credential + } + + Mock -CommandName Get-MgBetaDeviceManagementComplianceManagementPartner -MockWith { + return @{ + AdditionalProperties = @{ + '@odata.type' = "#microsoft.graph.ComplianceManagementPartner" + } + AndroidEnrollmentAssignments = @( + @{ + Target = @{ + '@odata.type' = "#microsoft.graph.allDevicesAssignmentTarget" + } + } + ) + AndroidOnboarded = $True + DisplayName = "FakeStringValue" + Id = "FakeStringValue" + IosEnrollmentAssignments = @( + @{ + Target = @{ + '@odata.type' = "#microsoft.graph.allDevicesAssignmentTarget" + } + } + ) + IosOnboarded = $True + LastHeartbeatDateTime = "2023-01-01T00:00:00.0000000+01:00" + MacOsEnrollmentAssignments = @( + @{ + Target = @{ + '@odata.type' = "#microsoft.graph.allDevicesAssignmentTarget" + } + } + ) + MacOsOnboarded = $True + PartnerState = "unknown" + + } + } + + Mock -CommandName Get-MgGroup -MockWith { + return @{ + DisplayName = "FakeStringValue" + Id = "FakeIdValue" + SecurityEnabled = $true + } + } + } + It 'Should Reverse Engineer resource from the Export method' { + $result = Export-TargetResource @testParams + $result | Should -Not -BeNullOrEmpty + } + } + #> + } +} + +Invoke-Command -ScriptBlock $Global:DscHelper.CleanupScript -NoNewScope diff --git a/Tests/Unit/Stubs/Microsoft365.psm1 b/Tests/Unit/Stubs/Microsoft365.psm1 index e29324881e..c339d6d4c2 100644 --- a/Tests/Unit/Stubs/Microsoft365.psm1 +++ b/Tests/Unit/Stubs/Microsoft365.psm1 @@ -102530,6 +102530,268 @@ function Update-MgBetaDeviceManagementApplePushNotificationCertificate $HttpPipelineAppend ) } + +function Get-MgBetaDeviceManagementComplianceManagementPartner +{ + [Cmdletbinding()] + param( + [Parameter()] + [string]$ComplianceManagementPartnerId, + + [Parameter()] + [object]$InputObject, + + [Parameter()] + [string[]]$ExpandProperty, + + [Parameter()] + [string[]]$Property, + + [Parameter()] + [string]$Filter, + + [Parameter()] + [string]$Search, + + [Parameter()] + [int]$Skip, + + [Parameter()] + [string[]]$Sort, + + [Parameter()] + [int]$Top, + + [Parameter()] + [string]$ResponseHeadersVariable, + + [Parameter()] + [switch]$Break, + + [Parameter()] + [System.Collections.IDictionary]$Headers, + + [Parameter()] + [PSObject]$HttpPipelineAppend, + + [Parameter()] + [PSObject]$HttpPipelinePrepend, + + [Parameter()] + [uri]$Proxy, + + [Parameter()] + [pscredential]$ProxyCredential, + + [Parameter()] + [switch]$ProxyUseDefaultCredentials, + + [Parameter()] + [int]$PageSize, + + [Parameter()] + [switch]$All, + + [Parameter()] + [string]$CountVariable + ) +} + +function New-MgBetaDeviceManagementComplianceManagementPartner +{ + [Cmdletbinding()] + param( + [Parameter()] + [object]$BodyParameter, + + [Parameter()] + [string]$ResponseHeadersVariable, + + [Parameter()] + [hashtable]$AdditionalProperties, + + [Parameter()] + [object[]]$AndroidEnrollmentAssignments, + + [Parameter()] + [switch]$AndroidOnboarded, + + [Parameter()] + [string]$DisplayName, + + [Parameter()] + [string]$Id, + + [Parameter()] + [object[]]$IosEnrollmentAssignments, + + [Parameter()] + [switch]$IosOnboarded, + + [Parameter()] + [datetime]$LastHeartbeatDateTime, + + [Parameter()] + [object[]]$MacOSEnrollmentAssignments, + + [Parameter()] + [switch]$MacOSOnboarded, + + [Parameter()] + [object]$PartnerState, + + [Parameter()] + [switch]$Break, + + [Parameter()] + [System.Collections.IDictionary]$Headers, + + [Parameter()] + [PSObject]$HttpPipelineAppend, + + [Parameter()] + [PSObject]$HttpPipelinePrepend, + + [Parameter()] + [uri]$Proxy, + + [Parameter()] + [pscredential]$ProxyCredential, + + [Parameter()] + [switch]$ProxyUseDefaultCredentials, + + [Parameter()] + [switch]$Confirm, + + [Parameter()] + [switch]$WhatIf + ) +} +function Update-MgBetaDeviceManagementComplianceManagementPartner +{ + [Cmdletbinding()] + param( + [Parameter()] + [string]$ComplianceManagementPartnerId, + + [Parameter()] + [object]$InputObject, + + [Parameter()] + [object]$BodyParameter, + + [Parameter()] + [string]$ResponseHeadersVariable, + + [Parameter()] + [hashtable]$AdditionalProperties, + + [Parameter()] + [object[]]$AndroidEnrollmentAssignments, + + [Parameter()] + [switch]$AndroidOnboarded, + + [Parameter()] + [string]$DisplayName, + + [Parameter()] + [string]$Id, + + [Parameter()] + [object[]]$IosEnrollmentAssignments, + + [Parameter()] + [switch]$IosOnboarded, + + [Parameter()] + [datetime]$LastHeartbeatDateTime, + + [Parameter()] + [object[]]$MacOSEnrollmentAssignments, + + [Parameter()] + [switch]$MacOSOnboarded, + + [Parameter()] + [object]$PartnerState, + + [Parameter()] + [switch]$Break, + + [Parameter()] + [System.Collections.IDictionary]$Headers, + + [Parameter()] + [PSObject]$HttpPipelineAppend, + + [Parameter()] + [PSObject]$HttpPipelinePrepend, + + [Parameter()] + [uri]$Proxy, + + [Parameter()] + [pscredential]$ProxyCredential, + + [Parameter()] + [switch]$ProxyUseDefaultCredentials, + + [Parameter()] + [switch]$WhatIf, + + [Parameter()] + [switch]$Confirm + ) +} +function Remove-MgBetaDeviceManagementComplianceManagementPartner +{ + [Cmdletbinding()] + param( + [Parameter()] + [string]$ComplianceManagementPartnerId, + + [Parameter()] + [object]$InputObject, + + [Parameter()] + [string]$IfMatch, + + [Parameter()] + [string]$ResponseHeadersVariable, + + [Parameter()] + [switch]$Break, + + [Parameter()] + [System.Collections.IDictionary]$Headers, + + [Parameter()] + [PSObject]$HttpPipelineAppend, + + [Parameter()] + [PSObject]$HttpPipelinePrepend, + + [Parameter()] + [switch]$PassThru, + + [Parameter()] + [uri]$Proxy, + + [Parameter()] + [pscredential]$ProxyCredential, + + [Parameter()] + [switch]$ProxyUseDefaultCredentials, + + [Parameter()] + [switch]$Confirm, + + [Parameter()] + [switch]$WhatIf + ) +} #endregion #region Microsoft.Graph.Authentication function Update-MgBetaNetworkAccessFilteringPolicyRule