IntuneDeviceConfigurationPolicyMacOS : At least one of the values 'delayAppUpdateVisibility,delayMajorOsUpdateVisibility' is not supported

[hvdbrink]

Details of the scenario you tried and the problem that is occurring

This happens after an export of the workload of Intune.

Verbose logs showing the problem

Microsoft365DSC\IntuneDeviceConfigurationPolicyMacOS : At least one of the values 'delayAppUpdateVisibility,delayMajorOsUpdateVisibility' is not supported or valid for property 'UpdateDelayPolicy' on class 'IntuneDeviceConfigurationPolicyMacOS'. Please specify only supported values:
none, delayOSUpdateVisibility, delayAppUpdateVisibility, unknownFutureValue, delayMajorOsUpdateVisibility.
At Path/filename.ps1:1589 char:9

•     IntuneDeviceConfigurationPolicyMacOS 9a43fd65-02fc-4590-b154- ...
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [Write-Error], ParentContainsErrorRecordException
  • FullyQualifiedErrorId : UnsupportedValueForProperty,Microsoft365DSC\IntuneDeviceConfigurationPolicyMacOS

Suggested solution to the issue

The DSC configuration that is used to reproduce the issue (as detailed as possible)

Version of the DSC module that was used ('dev' if using current dev branch)

1.22.1221.1

[ykuijs]

The parameter UpdateDelayPolicy is stored and returned as a string, but is an array of values under the covers (comma separated string). This means that it needs to get split on the comma character.

A second issue is that the current parameter is a string value, instead of an array value. This needs to get updated as well.

Working on correcting this issue.

[hvdbrink]

I've just updated and checked, but the error is still there for me.
UpdateDelayPolicy = "delayAppUpdateVisibility","delayMajorOsUpdateVisibility"; == This one works with creating the mof file.
UpdateDelayPolicy = @("delayAppUpdateVisibility,delayMajorOsUpdateVisibility"); = is how it's generated now.

[ykuijs]

I see what the difference is between the two values you shared. Will investigate and correct the issue.

[William-Francillette]

I believe the updateDelayPolicy should be a single value and not an array as it is an enum
https://learn.microsoft.com/en-us/graph/api/resources/intune-deviceconfig-macossoftwareupdatedelaypolicy?view=graph-rest-beta

[ykuijs]

Not quite, the updateDelayPolicy can contain multiple values in Intune. Before the previous PR, this resulted in errors because the cmdlets return multiple values and the config only accepts a single value.

[William-Francillette]

A bit confused here as the policy should return a single value based on the definition

I also checked the metadata schema and there is no mention of collection

If the resource returns more than one value, it could be an issue with the Get-TargetResource

Probably best to check what Get-MgDeviceManagementDeviceConfiguration returns

The first Get using DisplayName could return multiple policies as the DisplayName is not unique - if that's the case then $getValue.AdditionalProperties.updateDelayPolicy will return multiple value

Possible fix would be to reduce the scope of Get-MgDeviceManagementDeviceConfiguration and DisplayName by adding the templateId of the policy - I also prefer using the Id as a first method to retrieve a policy rather than using displayName
I would also filter on the server side instead of retrieving all device configuration policy - in a large environment it will not be efficient

[ykuijs]

If I check the policy in the Admin portal, I am able to configure these settings:

When I run these commands:

$getValue = Get-MgDeviceManagementDeviceConfiguration `
    -ErrorAction Stop | Where-Object `
    -FilterScript { $_.DisplayName -eq "testDSC" }

$getValue.AdditionalProperties.updateDelayPolicy

I get this result delayOSUpdateVisibility,delayAppUpdateVisibility,delayMajorOsUpdateVisibility

[William-Francillette]

Can you check how many policies are returned by the get cmdlet
I guess the customer has 3 policies called testDSC

[ykuijs]

Is on my Test tenant and I only have one TestDSC policy 😉

[William-Francillette]

My bad Yorick!
I just checked the payload and it's not in accordance of the doc!
updateDelayPolicy: "delayOSUpdateVisibility,delayAppUpdateVisibility,delayMajorOsUpdateVisibility" - the doc should be updated in my opinion
I get the same result than you - building a single string from the array may resolve the issue

[ykuijs]

Have updated the code. In my previous PR I made a stupid copy/paste mistake.

New fix will be included in a next PR