Skip to content

Fix Get-TargetResource for AADGroup resource #6797

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ajkenah wants to merge 2 commits into
base: Dev
Choose a base branch
from
+26 −23
Open

Fix Get-TargetResource for AADGroup resource #6797

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fdfb334
Update AADGroup to resolve issue #6796
Jan 9, 2026
d5399d9
Update changelog
Jan 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
# Change log for Microsoft365DSC

# UNRELEASED

* AADGroup
* Fixed an issue where Get-DscConfiguration would fail.
FIXES [#6796](https://github.com/microsoft/Microsoft365DSC/issues/6796)
* AADAuthenticationMethodPolicy
* Fixed an issue where empty arrays were not exported.
FIXES [#6759](https://github.com/microsoft/Microsoft365DSC/issues/6759)
Expand Down Expand Up @@ -95,7 +97,7 @@
FIXES [#6584](https://github.com/microsoft/Microsoft365DSC/issues/6584)
* Removed verbose output from `Get-TargetResource`.
* Updated the error behavior to always throw inside `Get-TargetResource`.

# 1.25.1203.2

* DEPENDENCIES
Expand Down
43 changes: 22 additions & 21 deletions Modules/Microsoft365DSC/DSCResources/MSFT_AADGroup/MSFT_AADGroup.psm1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,12 +114,11 @@ function Get-TargetResource
$AccessTokens
)

Write-Verbose -Message "Getting configuration of AzureAD Group with DisplayName {$DisplayName}"

try
{
if (-not $Script:exportedInstance -or $Script:exportedInstance.DisplayName -ne $DisplayName)
{
Write-Verbose -Message 'Getting configuration of AzureAD Group'
$null = New-M365DSCConnection -Workload 'MicrosoftGraph' `
-InboundParameters $PSBoundParameters

Expand All @@ -137,12 +136,12 @@ function Get-TargetResource

$nullReturn = $PSBoundParameters
$nullReturn.Ensure = 'Absent'
$nullReturn.Owners = @()
$nullReturn.Members = @()
$nullReturn.GroupAsMembers = @()
$nullReturn.MemberOf = @()
$nullReturn.AssignedToRole = @()
$nullReturn.AssignedLicenses = @()
$nullReturn.Owners = [System.String[]]@()
$nullReturn.Members = [System.String[]]@()
$nullReturn.GroupAsMembers = [System.String[]]@()
$nullReturn.MemberOf = [System.String[]]@()
$nullReturn.AssignedToRole = [System.String[]]@()
$nullReturn.AssignedLicenses = [CimInstance[]]@()

if ($PSBoundParameters.ContainsKey('Id'))
{
Expand Down Expand Up @@ -223,7 +222,6 @@ function Get-TargetResource
}
}

$MembersValues = $null
$result = @{}
if ($Group.MembershipRuleProcessingState -ne 'On')
{
Expand Down Expand Up @@ -283,8 +281,8 @@ function Get-TargetResource
}
}
}
$result.Add('Members', $MembersValues)
$result.Add('GroupAsMembers', $GroupAsMembersValues)
$result.Add('Members', [System.String[]]$MembersValues)
$result.Add('GroupAsMembers', [System.String[]]$GroupAsMembersValues)
}

# MemberOf
Expand Down Expand Up @@ -341,7 +339,7 @@ function Get-TargetResource
$assignedLicensesRequest = ($batchResponse | Where-Object -FilterScript { $_.id -eq 'Licenses' }).body
if ($assignedLicensesRequest.value.Length -gt 0)
{
[Array]$assignedLicensesValues = Get-M365DSCAzureADGroupLicenses -AssignedLicenses $assignedLicensesRequest.value
[CimInstance[]]$assignedLicensesValues = Get-M365DSCAzureADGroupLicenses -AssignedLicenses $assignedLicensesRequest.value
}

# GroupLifecyclePolicies
Expand All @@ -352,30 +350,33 @@ function Get-TargetResource
$policySettings = @{
DisplayName = $Group.DisplayName
Id = $Group.Id
Owners = $OwnersValues
MemberOf = $MemberOfValues
Owners = [System.String[]]$OwnersValues
MemberOf = [System.String[]]$MemberOfValues
Description = $Group.Description
GroupTypes = [System.String[]]$Group.GroupTypes
GroupTypes = [System.String[]]($Group.GroupTypes)
MembershipRule = $Group.MembershipRule
MembershipRuleProcessingState = $Group.MembershipRuleProcessingState
SecurityEnabled = $Group.SecurityEnabled
MailEnabled = $Group.MailEnabled
IsAssignableToRole = $false -or $Group.IsAssignableToRole
AssignedToRole = $AssignedToRoleValues
AssignedToRole = [System.String[]]$AssignedToRoleValues
MailNickname = $Group.MailNickname
Visibility = $Group.Visibility
AssignedLicenses = $assignedLicensesValues
Ensure = 'Present'
ApplicationId = $ApplicationId
TenantId = $TenantId
CertificateThumbprint = $CertificateThumbprint
ApplicationSecret = $ApplicationSecret
Credential = $Credential
ManagedIdentity = $ManagedIdentity.IsPresent
AccessTokens = $AccessTokens
AccessTokens = [System.String[]]$AccessTokens
}

$result += $policySettings
If ( $assignedLicensesValues )
{
$result.Add("AssignedLicenses", [CimInstance[]]$assignedLicensesValues)
}
if ($result.MailEnabled)
{
$result.Add("GroupLifecyclePolicySelectedEnabled", $isGroupLifecyclePoliciesEnabled)
Expand All @@ -391,7 +392,7 @@ function Get-TargetResource
-TenantId $TenantId `
-Credential $Credential

throw
throw $_
}
}

Expand Down Expand Up @@ -1407,10 +1408,10 @@ function Get-M365DSCAzureADGroupLicenses
$disabledPlansValues += $foundItem.ServicePlanName
}
$currentLicense = @{
DisabledPlans = $disabledPlansValues
DisabledPlans = [String[]]$disabledPlansValues
SkuId = $skuPartNumber.SkuPartNumber -replace [char]0xFEFF
}
$returnValue += $currentLicense
$returnValue += New-CimInstance -ClassName MSFT_AADGroupLicense -Namespace root/Microsoft/Windows/DesiredStateConfiguration -Property $currentLicense -ClientOnly
Copy link
Collaborator

@NikCharlebois NikCharlebois Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The return of the Get-TargetResource should not return objects of types CIMInstance. What is the issue we're trying to fix with this change?

Copy link
Collaborator

@FabienTschanz FabienTschanz Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When using Get-DscConfiguration via the LCM, double-nested properties are not serialized and omitted by the LCM if they are a hashtable. This is an issue when users are relying on the functionality. The same thing like here was already applied to the IntuneSettingCatalogCustomPolicy with #6780.

Copy link
Contributor Author

@ajkenah ajkenah Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @NikCharlebois.
Apologies for my late response, I was on holiday with my family.
As mentioned by Fabien, the LCM cannot convert nested hash tables into the required CIM object, causing it to error when using the Get-DscConfiguration on an imported MOF.

This is a known issue with the LCM, and the standard approach is to either use classes or create the correctly structured CIMInstance object before presenting it back to the LCM.

As the Graph API evolves, this issue will surely show up again with other resources, so it's probably worth considering at the project level, instead of just the resource level like I've done here.

Options include:

  1. Use classes.
  2. Require nested resources to be properly structured as a CIMInstance.
  3. Remove support for the LCM; or
  4. Leave it as is. Apparently, I seem to be the only one that uses the Get-DscConfiguration command anyway.

}

return $returnValue
Expand Down