IntuneDeviceEnrollmentStatusPageWindows10: Cannot deploy to another tenant with cert-based auth

[ricmestre]

Details of the scenario you tried and the problem that is occurring

After exporting two IntuneDeviceEnrollmentStatusPageWindows10 policies from one tenant (the default one assigned to all users/devices and another one custom) with cert-based auth when trying to apply the custom one to another tenant, also using certificate, it doesn't work complaining that it might be running in interactive mode.

Usually this problem is due to incorrect permissions nevertheless please note that in both tenants I've given the app and granted admin consent for the required permissions DeviceManagementServiceConfig.ReadWrite.All and DeviceManagementConfiguration.ReadWrite.All.

Trying to deploy it with credentials there's yet another problem that it detects that the resource is absent in the target tenant, Test-TargetResource returns false, but it doesn't create the resource at all, but I'd like to have the issue with the Service Principal with certificate solved, this one is not a priority for me right now, it's just for your information.

Verbose logs showing the problem

VERBOSE: [REDACTED]:[[IntuneDeviceEnrollmentStatusPageWindows10]IntuneDeviceEnrollmentStatusPageWindows10-REDACTED] Creating an Intune Device Enrollment Configuration for Windows10 with DisplayName {REDACTED}

VERBOSE: [REDACTED]:[[IntuneDeviceEnrollmentStatusPageWindows10]IntuneDeviceEnrollmentStatusPageWindows10-REDACTED] POST https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations/REDACTED_Windows10EnrollmentCompletionPageConfiguration/assign with 815-byte payload

VERBOSE: [REDACTED]:[[IntuneDeviceEnrollmentStatusPageWindows10]IntuneDeviceEnrollmentStatusPageWindows10-REDACTED] received 841-byte response of content type application/json

PowerShell Desired State Configuration does not support execution of commands in an interactive mode. Please ensure that the underlying command is not prompting for user   input, such as missing mandatory parameter, confirmation prompt etc.
+ CategoryInfo          : OperationStopped: (:) [], CimException
+ FullyQualifiedErrorId : System.NotSupportedException
+ PSComputerName        : localhost

Suggested solution to the issue

N/A

The DSC configuration that is used to reproduce the issue (as detailed as possible)

Configuration ESP
{
    $OrganizationName = "REDACTED"

    Import-DscResource -ModuleName 'Microsoft365DSC' -ModuleVersion '1.23.628.1'

    Node localhost
    {
        IntuneDeviceEnrollmentStatusPageWindows10 "IntuneDeviceEnrollmentStatusPageWindows10-REDACTED"
        {
            AllowDeviceResetOnInstallFailure        = $True;
            AllowDeviceUseOnInstallFailure          = $False;
            AllowLogCollectionOnInstallFailure      = $True;
            AllowNonBlockingAppInstallation         = $False;
            ApplicationId                           = "REDACTED";
            CertificateThumbprint                   = "REDACTED";
            Assignments                             = @(
MSFT_DeviceManagementConfigurationPolicyAssignments{
dataType = '#microsoft.graph.groupAssignmentTarget'
deviceAndAppManagementAssignmentFilterType = 'none'
deviceAndAppManagementAssignmentFilterId = '00000000-0000-0000-0000-000000000000'
groupId = 'REDACTED'
}
);
            BlockDeviceSetupRetryByUser             = $False;
            CustomErrorMessage                      = "Installation exceeded 2 hours time limit. Try again or contact your IT Service Desk for help.";
            DisableUserStatusTrackingAfterFirstUser = $True;
            DisplayName                             = "REDACTED";
            Ensure                                  = "Present";
            Id                                      = "REDACTED_Windows10EnrollmentCompletionPageConfiguration";
            InstallProgressTimeoutInMinutes         = 120;
            InstallQualityUpdates                   = $False;
            Priority                                = 1;
            ShowInstallationProgress                = $True;
            TenantId                                = $OrganizationName;
            TrackInstallProgressForAutopilotOnly    = $True;
        }
    }
}

ESP -ConfigurationData .\ConfigurationData.psd1

The operating system the target node is running

Win10

Version of the DSC module that was used ('dev' if using current dev branch)

1.23.628.1

[ricmestre]

Please update label to V1.23.705.1 since it also fails with latest version, tested it locally (not DevOps) with cert-based auth.

[William-Francillette]

@ricmestre and @richardjgreen I'll have a look tonight after work it's probably something silly
Thanks for reporting the issue

[William-Francillette]

Hi gents, I knew it was something silly
in function definition of Update-DeviceEnrollmentConfigurationPriority, the catch statement was missing ` to link New-M365DSCLogEntry to the parameter next line

Pushing PR now