Fixes microsoft#3492

NikCharlebois · Jul 28, 2023 · c34b50d · c34b50d
1 parent 0651fe2
commit c34b50d
Show file tree

Hide file tree

Showing 4 changed files with 58 additions and 22 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 # UNRELEASED
 
+* AADAuthorizationPolicy
+  * Added support for the AllowedToCreateTenants &
+    AllowedToReadBitlockerKeysForOwnedDevice properties.
+    FIXES [#3492](https://github.com/microsoft/Microsoft365DSC/issues/3492)
 * AADGroup, AADUser and O365Group
   * Add support to use function endsWith as filter
     FIXES [#3518](https://github.com/microsoft/Microsoft365DSC/issues/3518)
@@ -24,6 +28,7 @@
     FIXES [#3478](https://github.com/microsoft/Microsoft365DSC/issues/3478)
 * DEPENDENCIES
   * Updated Microsoft.Graph.* dependencies to version 2.2.0.
+  * Updated MSCloudLoginAssistant to version 1.0.119.
   * Updated dependency Microsoft.PowerApps.Administration.PowerShell to version 2.0.170.
 
 # 1.23.726.1

diff --git a/...Microsoft365DSC/DSCResources/MSFT_AADAuthorizationPolicy/MSFT_AADAuthorizationPolicy.psm1 b/...Microsoft365DSC/DSCResources/MSFT_AADAuthorizationPolicy/MSFT_AADAuthorizationPolicy.psm1
@@ -46,6 +46,14 @@ function Get-TargetResource
         [System.Boolean]
         $DefaultUserRoleAllowedToCreateSecurityGroups,
 
+        [Parameter()]
+        [System.Boolean]
+        $DefaultUserRoleAllowedToReadBitlockerKeysForOwnedDevice,
+
+        [Parameter()]
+        [System.Boolean]
+        $DefaultUserRoleAllowedToCreateTenants,
+
         [Parameter()]
         [System.Boolean]
         $DefaultUserRoleAllowedToReadOtherUsers,
@@ -143,26 +151,28 @@ function Get-TargetResource
         Write-Verbose -Message 'Get-TargetResource: Found existing authorization policy'
 
         $result = @{
-            IsSingleInstance                                  = 'Yes'
-            DisplayName                                       = $Policy.DisplayName
-            Description                                       = $Policy.Description
-            AllowedToSignUpEmailBasedSubscriptions            = $Policy.AllowedToSignUpEmailBasedSubscriptions
-            AllowedToUseSSPR                                  = $Policy.AllowedToUseSSPR
-            AllowEmailVerifiedUsersToJoinOrganization         = $Policy.AllowEmailVerifiedUsersToJoinOrganization
-            AllowInvitesFrom                                  = $Policy.AllowInvitesFrom
-            BlockMsolPowerShell                               = $Policy.BlockMsolPowerShell
-            DefaultUserRoleAllowedToCreateApps                = $Policy.DefaultUserRolePermissions.AllowedToCreateApps
-            DefaultUserRoleAllowedToCreateSecurityGroups      = $Policy.DefaultUserRolePermissions.AllowedToCreateSecurityGroups
-            DefaultUserRoleAllowedToReadOtherUsers            = $Policy.DefaultUserRolePermissions.AllowedToReadOtherUsers
-            PermissionGrantPolicyIdsAssignedToDefaultUserRole = $Policy.DefaultUserRolePermissions.PermissionGrantPoliciesAssigned
-            GuestUserRole                                     = Get-GuestUserRoleNameFromId -GuestUserRoleId $Policy.GuestUserRoleId
-            Ensure                                            = 'Present'
-            Credential                                        = $Credential
-            ApplicationSecret                                 = $ApplicationSecret
-            ApplicationId                                     = $ApplicationId
-            TenantId                                          = $TenantId
-            CertificateThumbprint                             = $CertificateThumbprint
-            Managedidentity                                   = $ManagedIdentity.IsPresent
+            IsSingleInstance                                        = 'Yes'
+            DisplayName                                             = $Policy.DisplayName
+            Description                                             = $Policy.Description
+            AllowedToSignUpEmailBasedSubscriptions                  = $Policy.AllowedToSignUpEmailBasedSubscriptions
+            AllowedToUseSSPR                                        = $Policy.AllowedToUseSSPR
+            AllowEmailVerifiedUsersToJoinOrganization               = $Policy.AllowEmailVerifiedUsersToJoinOrganization
+            AllowInvitesFrom                                        = $Policy.AllowInvitesFrom
+            BlockMsolPowerShell                                     = $Policy.BlockMsolPowerShell
+            DefaultUserRoleAllowedToCreateApps                      = $Policy.DefaultUserRolePermissions.AllowedToCreateApps
+            DefaultUserRoleAllowedToCreateSecurityGroups            = $Policy.DefaultUserRolePermissions.AllowedToCreateSecurityGroups
+            DefaultUserRoleAllowedToReadOtherUsers                  = $Policy.DefaultUserRolePermissions.AllowedToReadOtherUsers
+            DefaultUserRoleAllowedToReadBitlockerKeysForOwnedDevice = $Policy.DefaultUserRolePermissions.AllowedToReadBitlockerKeysForOwnedDevice
+            DefaultUserRoleAllowedToCreateTenants                   = $Policy.DefaultUserRolePermissions.AllowedToCreateTenants
+            PermissionGrantPolicyIdsAssignedToDefaultUserRole       = $Policy.DefaultUserRolePermissions.PermissionGrantPoliciesAssigned
+            GuestUserRole                                           = Get-GuestUserRoleNameFromId -GuestUserRoleId $Policy.GuestUserRoleId
+            Ensure                                                  = 'Present'
+            Credential                                              = $Credential
+            ApplicationSecret                                       = $ApplicationSecret
+            ApplicationId                                           = $ApplicationId
+            TenantId                                                = $TenantId
+            CertificateThumbprint                                   = $CertificateThumbprint
+            Managedidentity                                         = $ManagedIdentity.IsPresent
         }
 
         Write-Verbose -Message "Get-TargetResource Result: `n $(Convert-M365DscHashtableToString -Hashtable $result)"
@@ -217,6 +227,14 @@ function Set-TargetResource
         [System.Boolean]
         $DefaultUserRoleAllowedToCreateSecurityGroups,
 
+        [Parameter()]
+        [System.Boolean]
+        $DefaultUserRoleAllowedToReadBitlockerKeysForOwnedDevice,
+
+        [Parameter()]
+        [System.Boolean]
+        $DefaultUserRoleAllowedToCreateTenants,
+
         [Parameter()]
         [System.Boolean]
         $DefaultUserRoleAllowedToReadOtherUsers,
@@ -289,7 +307,9 @@ function Set-TargetResource
     $currentParameters.Remove('ManagedIdentity') | Out-Null
 
     Write-Verbose -Message 'Set-Targetresource: Authorization Policy Ensure Present'
-    $UpdateParameters = @{}
+    $UpdateParameters = @{
+        AuthorizationPolicyId = 'authorizationPolicy'
+    }
     # update policy with supplied parameters that are different from existing policy
 
     # prepare object for default user role permissions
@@ -361,6 +381,7 @@ function Set-TargetResource
             -Credential $Credential
 
         Write-Verbose -Message "Set-Targetresource: Failed change policy $DisplayName"
+        Write-Verbose -Message $_
     }
     Write-Verbose -Message "Set-Targetresource: finished processing Policy $Displayname"
 }
@@ -413,6 +434,14 @@ function Test-TargetResource
         [System.Boolean]
         $DefaultUserRoleAllowedToCreateSecurityGroups,
 
+        [Parameter()]
+        [System.Boolean]
+        $DefaultUserRoleAllowedToReadBitlockerKeysForOwnedDevice,
+
+        [Parameter()]
+        [System.Boolean]
+        $DefaultUserRoleAllowedToCreateTenants,
+
         [Parameter()]
         [System.Boolean]
         $DefaultUserRoleAllowedToReadOtherUsers,

diff --git a/...oft365DSC/DSCResources/MSFT_AADAuthorizationPolicy/MSFT_AADAuthorizationPolicy.schema.mof b/...oft365DSC/DSCResources/MSFT_AADAuthorizationPolicy/MSFT_AADAuthorizationPolicy.schema.mof
@@ -11,6 +11,8 @@ class MSFT_AADAuthorizationPolicy : OMI_BaseResource
     [Write, Description("Boolean To disable the use of MSOL PowerShell, set this property to true. This will also disable user-based access to the legacy service endpoint used by MSOL PowerShell. This does not affect Azure AD Connect or Microsoft Graph.")] Boolean BlockMsolPowershell;
     [Write, Description("Boolean Indicates whether the default user role can create applications.")] Boolean DefaultUserRoleAllowedToCreateApps;
     [Write, Description("Boolean Indicates whether the default user role can create security groups.")] Boolean DefaultUserRoleAllowedToCreateSecurityGroups;
+    [Write, Description("Indicates whether the registered owners of a device can read their own BitLocker recovery keys with default user role.")] Boolean DefaultUserRoleAllowedToReadBitlockerKeysForOwnedDevice;
+    [Write, Description("Indicates whether the default user role can create tenants. This setting corresponds to the Restrict non-admin users from creating tenants setting in the User settings menu in the Azure portal. When this setting is false, users assigned the Tenant Creator role can still create tenants.")] Boolean DefaultUserRoleAllowedToCreateTenants;
     [Write, Description("Boolean Indicates whether the default user role can read other users.")] Boolean DefaultUserRoleAllowedToReadOtherUsers;
     [Write, Description("The role that should be granted to guest users. Refer to List unifiedRoleDefinitions to find the list of available role templates. Only supported roles today are User, Guest User, and Restricted Guest User (2af84b1e-32c8-42b7-82bc-daa82404023b)."), ValueMap{"Guest","RestrictedGuest","User"}, Values{"Guest","RestrictedGuest","User"}] String GuestUserRole;
     [Write, Description("String collection Indicates if user consent to apps is allowed, and if it is, which permission to grant consent and which app consent policy (permissionGrantPolicy) govern the permission for users to grant consent. Value should be in the format managePermissionGrantsForSelf.{id}, where {id} is the id of a built-in or custom app consent policy. An empty list indicates user consent to apps is disabled.")] String PermissionGrantPolicyIdsAssignedToDefaultUserRole[];

diff --git a/Modules/Microsoft365DSC/Dependencies/Manifest.psd1 b/Modules/Microsoft365DSC/Dependencies/Manifest.psd1
@@ -82,7 +82,7 @@
         },
         @{
             ModuleName      = "MSCloudLoginAssistant"
-            RequiredVersion = "1.0.118"
+            RequiredVersion = "1.0.119"
         },
         @{
             ModuleName      = 'PnP.PowerShell'