Cannot find O365AdminAuditLogConfig and O365OrgCustomizationSetting's compiled permissions

[batehurry]

Dear,

Details of the scenario you tried and the problem that is occurring

When I used cmdlet Export-M365DSCConfiguration to export the component O365AdminAuditLogConfig with CertificateThumbprint,
It shows error "Extracting [O365AdminAuditLogConfig] using {CertificateThumbprint}...UnAuthorized".

Then I tried to execute cmdlet "Get-M365DSCCompiledPermissionList -ResourceNameList @("O365AdminAuditLogConfig") -Source 'Graph' -PermissionsType 'Application'" to get the permission, it returned empty value of ReadPermissions and UpdatePermissions.

The scripts I used:

1. Export-M365DSCConfiguration -Components @("O365AdminAuditLogConfig") -ApplicationId 'XXX' -TenantId 'XXX' -CertificateThumbprint 'XXX' -Path 'C:\Temp'

2. Get-M365DSCCompiledPermissionList -ResourceNameList @("O365AdminAuditLogConfig") -Source 'Graph' -PermissionsType 'Application'

Also the component O365OrgCustomizationSetting configuration exporting has same issue.
Could you like to advise the permission list of O365OrgCustomizationSetting and O365AdminAuditLogConfig.
Thanks.

[mlhickey]

@batehurry - The underlying cmdlets are EXO PowerShell cmdlets, not Graph. You'd need to follow the EXO permissions configuration in the user guide. If further scoping is required you can use the Get-ManagementRole cmdlet to determine the additional EXO permissions.

[batehurry]

@mlhickey
Do you mean the cmdlets should be "Get-M365DSCCompiledPermissionList -ResourceNameList @('O365OrgCustomizationSetting') -Source 'Exchange'".
Thanks.

[mlhickey]

@batehurry - I think that should be the path. I'll defer to the author of the resource as the associated settings.json files are not currently populated, hence no return when running Get-M365DSCCompiledPermissionList.

[batehurry]

So, May I know which permissions do you prefer to set. Thanks.

[andikrueger]

@ykuijs Could you help with a settings.json file for this resource?

[NikCharlebois]

Here are the required roles:

O365AdminAuditLogConfig

        "exchange": {
            "requiredroles": [
                "Audit Logs"
            ],
            "requiredrolegroups": []
        }

O365OrgCustomizationSetting

        "exchange": {
            "requiredroles": [
                "Organization Configuration"
            ],
            "requiredrolegroups": []
        }

We will update the settings.json files for next release to reflect this.

[batehurry]

Thanks