Org365Settings: Issue with ToDo permissions or URL?

[1Dimitri]

Description of the issue

I'm reading and updating various properties of the Org365Settings resource.
My Application has the permission OrgSettings-ToDo.ReadWrite,All as specified in https://github.com/microsoft/Microsoft365DSC/blob/Dev/Modules/Microsoft365DSC/DSCResources/MSFT_O365OrgSettings/settings.json

However a Verbose trace shows that the GraphAPI is complaining about permissions;
But from https://learn.microsoft.com/en-us/graph/api/admintodo-get?view=graph-rest-beta&tabs=http it seems that the REST API is not todo/Settings but todo

Could you have a look?

Microsoft 365 DSC Version

1.26.128.1

Which workloads are affected

Office 365 Admin

The DSC configuration

# Generated with Microsoft365DSC version 1.26.128.1
# For additional information on how to use Microsoft365DSC, please visit https://aka.ms/M365DSC
param (
)

Configuration M365TenantConfig
{
    param (
    )

    $OrganizationName = $ConfigurationData.NonNodeData.OrganizationName

    Import-DscResource -ModuleName 'Microsoft365DSC' -ModuleVersion '1.26.128.1'

    Node localhost
    {
        O365OrgSettings "O365OrgSettings"
        {
            AdminCenterReportDisplayConcealedNames                = $True;
            AllowPlannerCopilot                                   = $True;
            ApplicationId                                         = $ConfigurationData.NonNodeData.ApplicationId;
            AppsAndServicesIsAppAndServicesTrialEnabled           = $False;
            AppsAndServicesIsOfficeStoreEnabled                   = $False;
            CertificateThumbprint                                 = $ConfigurationData.NonNodeData.CertificateThumbprint;
            DynamicsCustomerVoiceIsInOrgFormsPhishingScanEnabled  = $True;
            DynamicsCustomerVoiceIsRecordIdentityByDefaultEnabled = $True;
            DynamicsCustomerVoiceIsRestrictedSurveyAccessEnabled  = $False;
            FormsIsBingImageSearchEnabled                         = $False;
            FormsIsExternalSendFormEnabled                        = $False;
            FormsIsExternalShareCollaborationEnabled              = $False;
            FormsIsExternalShareResultEnabled                     = $False;
            FormsIsExternalShareTemplateEnabled                   = $False;
            FormsIsInOrgFormsPhishingScanEnabled                  = $True;
            FormsIsRecordIdentityByDefaultEnabled                 = $True;
            InstallationOptionsAppsForMac                         = @();
            InstallationOptionsAppsForWindows                     = @();
            InstallationOptionsUpdateChannel                      = "current";
            IsSingleInstance                                      = "Yes";
            M365WebEnableUsersToOpenFilesFrom3PStorage            = $False;
            PlannerAllowCalendarSharing                           = $True;
            TenantId                                              = $OrganizationName;
            VivaInsightsDigestEmail                               = $True;
            VivaInsightsOutlookAddInAndInlineSuggestions          = $True;
            VivaInsightsScheduleSendSuggestions                   = $True;
            VivaInsightsWebExperience                             = $True;

            #
            CortanaEnabled = $False;
            ToDoIsExternalJoinEnabled	= $True ;
            ToDoIsExternalShareEnabled = $True ;	
            ToDoIsPushNotificationEnabled	= $True;
            
        }
    }
}

M365TenantConfig -ConfigurationData .\ConfigurationData.psd1

Verbose logs showing the problem

https://graph.microsoft.com/beta/admin/reportSettings with 0-byte payload
VERBOSE: [XXXXX]:                            [[O365OrgSettings]O365OrgSettings] received 121-byte
response of content type application/json
VERBOSE: [XXXXX]:                            [[O365OrgSettings]O365OrgSettings] GET
https://graph.microsoft.com/beta/admin/microsoft365Apps/installationOptions with 0-byte payload
VERBOSE: [XXXXX]:                            [[O365OrgSettings]O365OrgSettings] received 358-byte
response of content type application/json
VERBOSE: [XXXXX]:                            [[O365OrgSettings]O365OrgSettings] GET
https://graph.microsoft.com/beta/admin/forms/settings with 0-byte payload
VERBOSE: [XXXXX]:                            [[O365OrgSettings]O365OrgSettings] received 348-byte
response of content type application/json
VERBOSE: [XXXXX]:                            [[O365OrgSettings]O365OrgSettings] GET
https://graph.microsoft.com/beta/admin/dynamics/customerVoice with 0-byte payload
VERBOSE: [XXXXX]:                            [[O365OrgSettings]O365OrgSettings] received 211-byte
response of content type application/json
VERBOSE: [XXXXX]:                            [[O365OrgSettings]O365OrgSettings] GET
https://graph.microsoft.com/beta/admin/appsAndServices/settings with 0-byte payload
VERBOSE: [XXXXX]:                            [[O365OrgSettings]O365OrgSettings] received 160-byte
response of content type application/json
VERBOSE: [XXXXX]:                            [[O365OrgSettings]O365OrgSettings] GET
https://graph.microsoft.com/beta/admin/todo/settings with 0-byte payload
VERBOSE: [XXXXX]:                            [[O365OrgSettings]O365OrgSettings] received 201-byte
response of content type application/json
VERBOSE: [XXXXX]:                            [[O365OrgSettings]O365OrgSettings] Not able to retrieve
ToDo settings. Please ensure correct permissions have been granted.

Environment Information + PowerShell Version

OsName               : Microsoft Windows Server 2022 Datacenter
OsOperatingSystemSKU : DatacenterServerEdition
OsArchitecture       : 64-bit
WindowsVersion       : 2009
WindowsBuildLabEx    : 20348.1.amd64fre.fe_release.210507-1500
OsLanguage           : en-US
OsMuiLanguages       : {en-US}


Name                           Value
----                           -----
PSVersion                      5.1.20348.4294
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.20348.4294
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

[FabienTschanz]

That's a bit strange. I am successfully able to connect and get / update the values without issues and the following scopes:

Application.ReadWrite.All
ExternalConnection.ReadWrite.All
Group.ReadWrite.All
Organization.Read.All
OrgSettings-AppsAndServices.ReadWrite.All
OrgSettings-DynamicsVoice.ReadWrite.All
OrgSettings-Forms.ReadWrite.All
OrgSettings-Microsoft365Install.ReadWrite.All
OrgSettings-Todo.ReadWrite.All
PeopleSettings.ReadWrite.All
ReportSettings.ReadWrite.All
Tasks.ReadWrite.All

I used the following code snippets:

❯ Invoke-MgGraphRequest -Uri "/beta/admin/todo/settings"

Name                           Value
----                           -----
isExternalShareEnabled         False
isExternalJoinEnabled          True
isPushNotificationEnabled      True
@odata.context                 https://graph.microsoft.com/beta/$metadata#admin/todo/settings

❯ $a = @{isExternalShareEnabled = $false; isExternalJoinEnabled = $true; isPushNotificationEnabled = $true}
❯ Invoke-mgGraphRequest -Uri "/beta/admin/todo/settings" -Method PATCH -Body $a

What happens if you connect manually with your app registration (I assume you use one)?

[1Dimitri]

Indeed, I'm getting 500 Internal Server Error.

Connect-M365Tenant -Workload MicrosoftGraph @creds
$url = (Get-MSCloudLoginConnectionProfile -Workload MicrosoftGraph).ResourceUrl + 'beta/admin/todo/settings'
$results = Invoke-MgGraphRequest -Method GET -Uri $url -ErrorAction Stop

Invoke-MgGraphRequest : GET https://graph.microsoft.com/beta/admin/todo/settings
HTTP/1.1 500 Internal Server Error
Transfer-Encoding: chunked
Vary: Accept-Encoding

By contrast

$url = (Get-MSCloudLoginConnectionProfile -Workload MicrosoftGraph).ResourceUrl + 'beta/admin/microsoft365Apps/installationOptions'
$results = Invoke-MgGraphRequest -Method GET -Uri $url -ErrorAction Stop
 $results

Name                           Value
----                           -----
@odata.context                 https://graph.microsoft.com/beta/$metadata#admin/microsoft365Apps/instal...
appsForMac                     {isSkypeForBusinessEnabled, isMicrosoft365AppsEnabled}
updateChannel                  current
appsForWindows                 {isVisioEnabled, isSkypeForBusinessEnabled, isProjectEnabled, isMicrosof...

I will open a ticket using the Unified Support contract

[1Dimitri]

The engineer in charge of the ticket has the same behavior as I do, so he'll try to reach out internally.

[FabienTschanz]

Thanks for the update.

[NikCharlebois]

Can you confirm you have Tasks.Read.All Graph permission granted?

[1Dimitri]

No, Tasks.ReadWrite.All, but not the Tasks.Read.All permissions,

I'll add it since I'm under the 400 limit for a service principal.
For the test yesterday with the engineer, The Graph Explorer only requests ToDo* Settings BTW.

[1Dimitri]

VERBOSE: [XXXX]:                            [[O365OrgSettings]O365OrgSettings] PATCH
https://graph.microsoft.com/beta/admin/todo/settings with 93-byte payload
VERBOSE: [XXXX]:                            [[O365OrgSettings]O365OrgSettings] received 201-byte
response of content type application/json
VERBOSE: [XXXX]:                            [[O365OrgSettings]O365OrgSettings] Error: Response status
 code does not indicate success: InternalServerError (Internal Server Error).