AADAuthorizationPolicy: Could not determine authentication method, possible permission issue.

[OptimAdam]

Hi,

I am trying to export my M365 config but I am getting a error on AADAuthorizationPolicy. I think its a permission issue but the error message throws me off. I thought the permissions would be 'Policy.ReadWrite.Authorization' from the MS Graph is this correct?

If its not a permission issue any other ideas, everything else in my command runs fine?

Export-M365DSCConfiguration -Components @("AADAdministrativeUnit", "AADApplication", "AADAuthorizationPolicy", "AADConditionalAccessPolicy", "AADEntitlementManagementAccessPackage", "AADEntitlementManagementAccessPackageAssignmentPolicy", "AADEntitlementManagementAccessPackageCatalog", "AADEntitlementManagementAccessPackageCatalogResource", "AADEntitlementManagementConnectedOrganization", "AADGroupLifecyclePolicy", "AADGroupsNamingPolicy", "AADGroupsSettings", "AADNamedLocationPolicy", "AADRoleDefinition", "AADRoleSetting", "AADSecurityDefaults", "AADTenantDetails", "AADTokenLifetimePolicy", "EXOAcceptedDomain", "EXOActiveSyncDeviceAccessRule", "EXOAddressBookPolicy", "EXOAddressList", "EXOAntiPhishPolicy", "EXOAntiPhishRule", "EXOApplicationAccessPolicy", "EXOAtpPolicyForO365", "EXOAuthenticationPolicy", "EXOAuthenticationPolicyAssignment", "EXOAvailabilityAddressSpace", "EXOAvailabilityConfig", "EXOCASMailboxPlan", "EXOCASMailboxSettings", "EXOClientAccessRule", "EXODataClassification", "EXODataEncryptionPolicy", "EXODistributionGroup", "EXODkimSigningConfig", "EXOEmailAddressPolicy", "EXOGlobalAddressList", "EXOHostedConnectionFilterPolicy", "EXOHostedContentFilterPolicy", "EXOHostedContentFilterRule", "EXOHostedOutboundSpamFilterPolicy", "EXOHostedOutboundSpamFilterRule", "EXOInboundConnector", "EXOIntraOrganizationConnector", "EXOIRMConfiguration", "EXOJournalRule", "EXOMailboxPlan", "EXOMailContact", "EXOMailTips", "EXOMalwareFilterPolicy", "EXOMalwareFilterRule", "EXOManagementRoleAssignment", "EXOMessageClassification", "EXOMobileDeviceMailboxPolicy", "EXOOfflineAddressBook", "EXOOMEConfiguration", "EXOOnPremisesOrganization", "EXOOrganizationConfig", "EXOOrganizationRelationship", "EXOOutboundConnector", "EXOOwaMailboxPolicy", "EXOPartnerApplication", "EXOPerimeterConfiguration", "EXOPolicyTipConfig", "EXOQuarantinePolicy", "EXORemoteDomain", "EXOResourceConfiguration", "EXORoleAssignmentPolicy", "EXORoleGroup", "EXOSafeAttachmentPolicy", "EXOSafeAttachmentRule", "EXOSafeLinksPolicy", "EXOSafeLinksRule", "EXOSharedMailbox", "EXOSharingPolicy", "EXOTransportConfig", "EXOTransportRule") -ApplicationId $ApplicationId -ApplicationSecret $ApplicationSecret -TenantId $TenantId

[2023-03-21 08:30:45]
{OperationStopped}
System.Management.Automation.RuntimeException: Could not determine authentication method
"Error during Export:"
at New-M365DSCConnection, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.315.1\modules\M365DSCUtil.psm1: line 1941
at Get-TargetResource, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.315.1\DSCResources\MSFT_AADAuthorizationPolicy\MSFT_AADAuthorizationPolicy.psm1: line 94
at Export-TargetResource, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.315.1\DSCResources\MSFT_AADAuthorizationPolicy\MSFT_AADAuthorizationPolicy.psm1: line 543
at Start-M365DSCConfigurationExtract, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.315.1\modules\M365DSCReverse.psm1: line 615
at Export-M365DSCConfiguration, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.315.1\modules\M365DSCUtil.psm1: line 1207
at <ScriptBlock>, <No file>: line 1

[andikrueger]

Did you provide values for

# Getting application information for Application + Secret authentication
$ApplicationId = Read-Host -Prompt 'Application Id'
$ApplicationSecret = Read-Host -Prompt 'Application Secret'
$TenantId = Read-Host -Prompt 'Tenant Id'

and does it work if you run the command without exporting AADAuthorizationPolicy

[OptimAdam]

Thank you for getting back to me.

Yes the values have been provided and the other service do not fail when pulling back the configuration information.

[NikCharlebois]

We have been able to replicate and have a fix on the way. The AppSecret parameter wasn't passed back to the Get-TargetResource function which caused MSCloudLoginAssistant not to recognize the auth flow used.