DSC SCLabelPolicy export error #3104

Thz4UQgy · 2023-03-31T08:19:09Z

Details of the scenario you tried and the problem that is occurring

Verbose logs showing the problem

The DSC configuration that is used to reproduce the issue (as detailed as possible)

# At the end in pictures

Version of the DSC module that was used ('dev' if using current dev branch)

Newest version from 03.28.23

Pictures

NikCharlebois · 2023-03-31T16:02:16Z

Can you provide additional details around the policy that is throwing the error? Screenshots that would allow us to recreate in our environment to help troubleshooting the issue would be very useful. Thanks

Thz4UQgy · 2023-04-03T07:35:13Z

Hi Nik, sure.

NikCharlebois · 2023-04-04T12:22:04Z

Thanks for the screenshots. We are not able to replicate on our end.

Could you please try the following and see if you get the same error? This is the internal logic of the resource.

$creds = Get-Credential
Connect-IPPSSession -Credential $creds
$policy = Get-LabelPolicy -Identity UMobi_all
$settings = $policy.Settings
foreach ($setting in $settings)
{
    $settingString = $setting.Replace('[', '').Replace(']', '')
    $settingKey = $settingString.Split(',')[0]
    $startPos = $settingString.IndexOf(',', 0) + 1
    $valueString = $settingString.Substring($startPos, $settingString.Length - $startPos).Trim()
    if ($valueString -like '*,*')
    {
        $values = $valueString -split ','
    }
    else
    {
        $values = $valueString
    }
    if ($settingKey -like '*defaultlabel*')
    {
        $label = Get-Label -Identity $values
        Write-Host $label.DisplayName
    }
}

Thz4UQgy · 2023-04-05T09:04:32Z

Hi Nik,

Same error:

PS C:\WINDOWS\system32> Connect-IPPSSession -Credential $creds
$policy = Get-LabelPolicy -Identity UMobi_all
$settings = $policy.Settings
foreach ($setting in $settings)
{
    $settingString = $setting.Replace('[', '').Replace(']', '')
    $settingKey = $settingString.Split(',')[0]
    $startPos = $settingString.IndexOf(',', 0) + 1
    $valueString = $settingString.Substring($startPos, $settingString.Length - $startPos).Trim()
    if ($valueString -like '*,*')
    {
        $values = $valueString -split ','
    }
    else
    {
        $values = $valueString
    }
    if ($settingKey -like '*defaultlabel*')
    {
        $label = Get-Label -Identity $values
        Write-Host $label.DisplayName
    }
}
The operation couldn't be performed because object 'None' couldn't be found on 'FfoConfigurationSession'.
    + CategoryInfo          : NotSpecified: (:) [Get-Label], ManagementObjectNotFoundException
    + FullyQualifiedErrorId : [Server=DM6NAM11WS032,RequestId=4c2e6269-fe1e-472a-9a9c-a1b6dc2b5da5,TimeStamp=05.04.2023 09:03:44] [FailureCategory=Cmdlet-ManagementObje 
   ctNotFoundException] EB231B2F,Microsoft.Office.CompliancePolicy.Tasks.GetLabel
    + PSComputerName        : nam11b.ps.compliance.protection.outlook.com

andikrueger · 2023-04-05T09:12:55Z

Could you please extend the output of the script a bit:

Connect-IPPSSession -Credential $creds
$policy = Get-LabelPolicy -Identity UMobi_all
$settings = $policy.Settings
foreach ($setting in $settings)
{
try{
    $settingString = $setting.Replace('[', '').Replace(']', '')
    $settingKey = $settingString.Split(',')[0]
    $startPos = $settingString.IndexOf(',', 0) + 1
    $valueString = $settingString.Substring($startPos, $settingString.Length - $startPos).Trim()
Write-Host "valueString: $($valuestring)"
    if ($valueString -like '*,*')
    {
        $values = $valueString -split ','
    }
    else
    {
        $values = $valueString
    }

    if ($settingKey -like '*defaultlabel*')
    {
        Write-Host "Getting Label for value: $($values)"
        $label = Get-Label -Identity $values
        Write-Host $label.DisplayName
    }
}
catch
{
Write-Host $_
}
}

Thz4UQgy · 2023-04-05T09:23:59Z

Hi Andi,

Sure:

PS C:\WINDOWS\system32> $policy = Get-LabelPolicy -Identity Umobi_all
$settings = $policy.Settings
foreach ($setting in $settings)
{
try{
    $settingString = $setting.Replace('[', '').Replace(']', '')
    $settingKey = $settingString.Split(',')[0]
    $startPos = $settingString.IndexOf(',', 0) + 1
    $valueString = $settingString.Substring($startPos, $settingString.Length - $startPos).Trim()
Write-Host "valueString: $($valuestring)"
    if ($valueString -like '*,*')
    {
        $values = $valueString -split ','
    }
    else
    {
        $values = $valueString
    }

    if ($settingKey -like '*defaultlabel*')
    {
        Write-Host "Getting Label for value: $($values)"
        $label = Get-Label -Identity $values
        Write-Host $label.DisplayName
    }
}
catch
{
Write-Host $_
}
}
valueString: false
valueString: true
valueString: true
valueString: false
valueString: false
valueString: false
valueString: false
valueString: true
valueString: None
Getting Label for value: None
The operation couldn't be performed because object 'None' couldn't be found on 'FfoConfigurationSession'.
    + CategoryInfo          : NotSpecified: (:) [Get-Label], ManagementObjectNotFoundException
    + FullyQualifiedErrorId : [Server=DM6NAM11WS032,RequestId=9790444a-4548-454c-a8f3-eabe66857a93,TimeStamp=05.04.2023 09:23:04] [FailureCategory=Cmdlet-ManagementObje 
   ctNotFoundException] EB231B2F,Microsoft.Office.CompliancePolicy.Tasks.GetLabel
    + PSComputerName        : nam11b.ps.compliance.protection.outlook.com
 

valueString: false

andikrueger · 2023-04-05T09:34:38Z

Why is there a 'None'. Would you mind outputting the setting as well and the policy?

Thz4UQgy · 2023-04-05T10:21:42Z

No problem Andi. Which command should I do that you can get all your information that you need?

Thz4UQgy · 2023-04-05T10:35:25Z

I think I got the error. The advanced label policy setting for "outlookdefaultlabel" is set to none not false or true. I will check that and inform you.

Thz4UQgy · 2023-04-05T10:39:10Z

Ok for the advanced settings is not allowed to set it to false or true.

PS C:\Company\Scripts\M365DSC> Set-LabelPolicy -Identity Umobi_all -AdvancedSettings @{outlookdefaultlabel="false"}

WARNING: Encountered exception: Microsoft.Exchange.Management.UnifiedPolicy.ErrorResolvingMipLabelIdException: Error resolving MIP label ID 'false' to a Guid.
   at Microsoft.Office.CompliancePolicy.Tasks.MipLabelContentTypeUtils.ValidateDefaultLabelContentType(String defaultLabelId, MipLabelContentType expectedContentType, Lis
t`1 labels)
   at Microsoft.Office.CompliancePolicy.Tasks.MipLabelUtilities.ValidateDefaultLabel(List`1 labelStorages, List`1 settings, OrganizationId orgId, UnifiedPolicyCmdletLogge
r cmdletLogger, MipLabelsSnapshot tenantSnapshot)
   at Microsoft.Office.CompliancePolicy.Tasks.SetLabelPolicy.InternalValidate()
Error resolving MIP label ID 'false' to a Guid.
    + CategoryInfo          : NotSpecified: (:) [Set-LabelPolicy], ErrorResolvingMipLabelIdException
    + FullyQualifiedErrorId : [Server=DM6NAM11WS032,RequestId=676c3478-db03-4b1d-bdfa-117e6cf1caab,TimeStamp=05.04.2023 10:37:24] [FailureCategory=Cmdlet-ErrorResolving 
   MipLabelIdException] 3F4C9378,Microsoft.Office.CompliancePolicy.Tasks.SetLabelPolicy
    + PSComputerName        : nam11b.ps.compliance.protection.outlook.com

andikrueger · 2023-04-05T10:45:48Z

How does the advanced label differ? We need to add an additional condition to this statement:

if ($settingKey -like 'defaultlabel')

Thz4UQgy · 2023-04-05T10:46:45Z

I checked the advanced setting and in the UI it is possible to set "None" for this setting.

andikrueger · 2023-04-05T10:51:06Z

Could you try to set it to $null

Specify this parameter with the identity (name or GUID) of the policy, with key/value pairs in a hash table. To remove an advanced setting, use the same AdvancedSettings parameter syntax, but specify a null string value.
https://learn.microsoft.com/en-us/powershell/module/exchange/set-labelpolicy?view=exchange-ps#-advancedsettings

Thz4UQgy · 2023-04-05T10:53:22Z

Yes like this:

OutlookDefaultLabel: Outlook apps that support this setting apply a default label, or no label. Example: Set-LabelPolicy -Identity Global -AdvancedSettings @{OutlookDefaultLabel="None"}. For more information about this configuration choice, see Outlook-specific options for default label and mandatory labeling.

Output:

PS C:\Company\Scripts\M365DSC> (Get-Labelpolicy -Identity Umobi_all).settings
[powerbimandatory, false]
[requiredowngradejustification, true]
[mandatory, true]
[disablemandatoryinoutlook, false]
[enablecustompermissions, false]
[hidebarbydefault, false]
[siteandgroupmandatory, false]
[enablepdfv2protection, true]
[teamworkmandatory, false]
[outlookdefaultlabel, None]

andikrueger · 2023-04-05T10:55:49Z

I don’t get it. I’ve read this passage as well. Either the documentation is wrong or the code 😬

Thz4UQgy · 2023-04-05T10:58:55Z

I think the DSC Module can't handle this setting because "None" is set. You can test ist by your own. Now is my second policy also not working as well ;)

Thz4UQgy · 2023-04-05T11:02:00Z

andikrueger · 2023-04-05T11:06:55Z

I think, we are closer to the solution. At the moment, in M365DSC there is an issue with NONE values. On the other hand, you were not able to run this command with success:

Set-LabelPolicy -Identity Umobi_all -AdvancedSettings @{outlookdefaultlabel="false"}

Would be good to know, if we can set it like this:

Set-LabelPolicy -Identity Umobi_all -AdvancedSettings @{outlookdefaultlabel="null"}

or

Set-LabelPolicy -Identity Umobi_all -AdvancedSettings @{outlookdefaultlabel=$null}

Any chance you could run the both commands above? I don't a have a test environment for labels ATM.

Thz4UQgy · 2023-04-05T11:33:13Z

First command not possible second command no error occurs.

PS C:\Company\Scripts\MIP> Set-LabelPolicy -Identity Umobi_all -AdvancedSettings @{outlookdefaultlabel="null"}
WARNING: Encountered exception: Microsoft.Exchange.Management.UnifiedPolicy.ErrorResolvingMipLabelIdException: Error resolving MIP label ID 'null' to a Guid.
   at Microsoft.Office.CompliancePolicy.Tasks.MipLabelContentTypeUtils.ValidateDefaultLabelContentType(String defaultLabelId, MipLabelContentType expectedContentType, Lis
t`1 labels)
   at Microsoft.Office.CompliancePolicy.Tasks.MipLabelUtilities.ValidateDefaultLabel(List`1 labelStorages, List`1 settings, OrganizationId orgId, UnifiedPolicyCmdletLogge
r cmdletLogger, MipLabelsSnapshot tenantSnapshot)
   at Microsoft.Office.CompliancePolicy.Tasks.SetLabelPolicy.InternalValidate()
Error resolving MIP label ID 'null' to a Guid.
    + CategoryInfo          : NotSpecified: (:) [Set-LabelPolicy], ErrorResolvingMipLabelIdException
    + FullyQualifiedErrorId : [Server=DM6NAM11WS025,RequestId=82d90740-7287-477a-9ee2-94b3d0f609ac,TimeStamp=05.04.2023 11:32:13] [FailureCategory=Cmdlet-ErrorResolving 
   MipLabelIdException] C1898350,Microsoft.Office.CompliancePolicy.Tasks.SetLabelPolicy
    + PSComputerName        : nam11b.ps.compliance.protection.outlook.com
 

PS C:\Company\Scripts\MIP> Set-LabelPolicy -Identity Umobi_all -AdvancedSettings @{outlookdefaultlabel=$null}

PS C:\Company\Scripts\MIP>

Thz4UQgy · 2023-04-05T11:34:56Z

But now the setting in the UI is changed to "same as document" that would be false.

andikrueger · 2023-04-05T11:38:53Z

I was about to celebrate...

What do we know so far:

Setting the label to 'None' with this command Set-LabelPolicy -Identity Umobi_all -AdvancedSettings @{outlookdefaultlabel=$null} results in "same as document" in the UI
We need to treat values of "None" differently in M365DSC. The current implementation needs to check, if the value is none. If yes, we cannot query for this label.

Thz4UQgy · 2023-04-05T11:40:21Z

Can I confirm ;)

Thz4UQgy · 2023-04-06T07:51:38Z

So what is going on next?

andikrueger · 2023-04-06T07:57:21Z

We need to find a fix for this issue. Right now, there is the challenge on how to set the object to be none.

ricmestre · 2023-04-13T10:52:10Z

@andikrueger Hi, setting outlookdefaultlabel to None works, in fact this is documented in https://learn.microsoft.com/en-us/powershell/module/exchange/set-labelpolicy?view=exchange-ps :

OutlookDefaultLabel: Outlook apps that support this setting apply a default label, or no label. Example: Set-LabelPolicy -Identity Global -AdvancedSettings @{OutlookDefaultLabel="None"}. For more information about this configuration choice, see Outlook-specific options for default label and mandatory labeling.

C:\> $Policy = Get-LabelPolicy

C:\> $Policy.Settings
[mandatory, false]
[powerbimandatory, false]
[outlookdefaultlabel, defa4170-0d19-0005-0004-bc88714345d2] # Here is set to "All Employees (unrestricted)"
[requiredowngradejustification, true]
[defaultlabelid, defa4170-0d19-0005-0004-bc88714345d2]
[disablemandatoryinoutlook, true]

PS C:\> Set-LabelPolicy -Identity $Policy.Identity -AdvancedSettings @{ outlookdefaultlabel = "None" }

PS C:\> $Policy = Get-LabelPolicy

PS C:\> $Policy.Settings
[mandatory, false]
[powerbimandatory, false]
[outlookdefaultlabel, None] # Here is correctly set to None after changing it
[requiredowngradejustification, true]
[defaultlabelid, defa4170-0d19-0005-0004-bc88714345d2]
[disablemandatoryinoutlook, true]

I have a quick fix to handle "None" which just bypasses `Get-Label' cmdlet since it's not required and I was able to export/test with M365Dsc. I'll send a PR for this.

ricmestre · 2023-04-13T15:32:55Z

Well, setting the label policy to null, has seen in this discussion, also works but removes it from the settings list. Is this something that should be checked too? It's easy to add a check for null.

PS C:\> $Policy = Get-LabelPolicy

PS C:\> $Policy.Settings
[mandatory, false]
[powerbimandatory, false]
[requiredowngradejustification, true]
[defaultlabelid, defa4170-0d19-0005-0004-bc88714345d2]
[disablemandatoryinoutlook, true]
[outlookdefaultlabel, None]

PS C:\> Set-LabelPolicy -Identity $Policy.Identity -AdvancedSettings @{ outlookdefaultlabel = $null }

PS C:\> (Get-LabelPolicy).Settings
[mandatory, false]
[powerbimandatory, false]
[requiredowngradejustification, true]
[defaultlabelid, defa4170-0d19-0005-0004-bc88714345d2]
[disablemandatoryinoutlook, true]

Arguably this would only make sense if writing a blueprint manually and set outlookdefaultlabel to null, so probably should be left alone and my PR is enough to fix this.

andikrueger added Bug Something isn't working Security & Compliance Center labels Mar 31, 2023

NikCharlebois added the Pending Information label Mar 31, 2023

ricmestre mentioned this issue Apr 13, 2023

SCLabelPolicy: If label policy is set to None don't get its label display name since it's not required #3164

Merged

NikCharlebois closed this as completed in #3164 Apr 13, 2023

ykuijs mentioned this issue Apr 19, 2023

Release 1.23.419.1 #3188

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

DSC SCLabelPolicy export error #3104

DSC SCLabelPolicy export error #3104

Thz4UQgy commented Mar 31, 2023 •

edited

Loading

NikCharlebois commented Mar 31, 2023

Thz4UQgy commented Apr 3, 2023

NikCharlebois commented Apr 4, 2023

Thz4UQgy commented Apr 5, 2023 •

edited

Loading

andikrueger commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

andikrueger commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

andikrueger commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

andikrueger commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

andikrueger commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023 •

edited

Loading

Thz4UQgy commented Apr 5, 2023

andikrueger commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

andikrueger commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

Thz4UQgy commented Apr 6, 2023

andikrueger commented Apr 6, 2023

ricmestre commented Apr 13, 2023

ricmestre commented Apr 13, 2023 •

edited

Loading

DSC SCLabelPolicy export error #3104

DSC SCLabelPolicy export error #3104

Comments

Thz4UQgy commented Mar 31, 2023 • edited Loading

Details of the scenario you tried and the problem that is occurring

Verbose logs showing the problem

Suggested solution to the issue

The DSC configuration that is used to reproduce the issue (as detailed as possible)

Version of the DSC module that was used ('dev' if using current dev branch)

Pictures

NikCharlebois commented Mar 31, 2023

Thz4UQgy commented Apr 3, 2023

NikCharlebois commented Apr 4, 2023

Thz4UQgy commented Apr 5, 2023 • edited Loading

andikrueger commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

andikrueger commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

andikrueger commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

andikrueger commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

andikrueger commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023 • edited Loading

Thz4UQgy commented Apr 5, 2023

andikrueger commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

andikrueger commented Apr 5, 2023

Thz4UQgy commented Apr 5, 2023

Thz4UQgy commented Apr 6, 2023

andikrueger commented Apr 6, 2023

ricmestre commented Apr 13, 2023

ricmestre commented Apr 13, 2023 • edited Loading

Thz4UQgy commented Mar 31, 2023 •

edited

Loading

Thz4UQgy commented Apr 5, 2023 •

edited

Loading

Thz4UQgy commented Apr 5, 2023 •

edited

Loading

ricmestre commented Apr 13, 2023 •

edited

Loading