Export-M365DSCConfiguration error {InvalidOperation} System.Exception: [UnknownError]

[horgasz2023]

Description of the issue

Export fails with the following error:

[2023/10/05 02:38:27]
"Couldn't find user xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx , that is defined in policy xxxxx - Require Compliance for all Salesforce Apps iOS and Android"
TenantId: xxxx.onmicrosoft.com

[2023/10/05 02:38:55]
"Couldn't find user xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx , that is defined in policy xxx - MFA Registration for All-Users and Windows when Termes & Conditions accepted"
TenantId: xxxx.onmicrosoft.com

Is this expected that for export we need ReadWrite permissions?

RoleEligibilitySchedule.ReadWrite.Directory, RoleManagement.ReadWrite.Directory

[2023/10/05 02:40:44]
{InvalidOperation}
System.Exception: [UnknownError] : {"errorCode":"PermissionScopeNotGranted","message":"Authorization failed due to missing permission scope RoleEligibilitySchedule.ReadWrite.Directory,RoleManagement.ReadWrite.Directory.","instanceAnnotations":[]}
"Error during Export:"
at Get-MgBetaRoleManagementDirectoryRoleEligibilityScheduleRequest, C:\Program Files\WindowsPowerShell\Modules\Microsoft.Graph.Beta.Identity.Governance\2.6.1\exports\ProxyCmdletDefinitions.ps1: line 101367
at Export-TargetResource, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.1004.1\DSCResources\MSFT_AADRoleEligibilityScheduleRequest\MSFT_AADRoleEligibilityScheduleRequest.psm1: line 635
at Start-M365DSCConfigurationExtract, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.1004.1\modules\M365DSCReverse.psm1: line 615
at Export-M365DSCConfiguration, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.1004.1\modules\M365DSCUtil.psm1: line 1312
at , C:\M365DSC\Run_ExportConfig.ps1: line 3
TenantId: xxxx.onmicrosoft.com

Microsoft 365 DSC Version

1.23.1004.1

Which workloads are affected

Azure Active Directory

The DSC configuration

Export-M365DSCConfiguration -Components @("AADAuthenticationMethodPolicy", "AADAuthenticationMethodPolicyAuthenticator", "AADAuthenticationMethodPolicyEmail", "AADAuthenticationMethodPolicyFido2", "AADAuthenticationMethodPolicySms", "AADAuthenticationMethodPolicySoftware", "AADAuthenticationMethodPolicyTemporary", "AADAuthenticationMethodPolicyVoice", "AADAuthenticationMethodPolicyX509", "AADAuthenticationStrengthPolicy", "AADAuthorizationPolicy", "AADConditionalAccessPolicy", "AADCrossTenantAccessPolicy", "AADCrossTenantAccessPolicyConfigurationDefault", "AADCrossTenantAccessPolicyConfigurationPartner", "AADEntitlementManagementAccessPackage", "AADEntitlementManagementAccessPackageAssignmentPolicy", "AADEntitlementManagementAccessPackageCatalog", "AADEntitlementManagementAccessPackageCatalogResource", "AADEntitlementManagementConnectedOrganization", "AADGroupLifecyclePolicy", "AADGroupsNamingPolicy", "AADGroupsSettings", "AADNamedLocationPolicy", "AADRoleDefinition", "AADRoleEligibilityScheduleRequest", "AADRoleSetting", "AADSecurityDefaults", "AADTenantDetails", "AADTokenLifetimePolicy") -ApplicationId $ApplicationId -ApplicationSecret $ApplicationSecret -TenantId $TenantId

Verbose logs showing the problem

[2023/10/05 02:38:27]
"Couldn't find user xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx , that is defined in policy xxxxx - Require Compliance for all Salesforce Apps iOS and Android"
TenantId: xxxx.onmicrosoft.com

[2023/10/05 02:38:55]
"Couldn't find user xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx , that is defined in policy xxx - MFA Registration for All-Users and Windows when Termes & Conditions accepted"
TenantId: xxxx.onmicrosoft.com


[2023/10/05 02:40:44]
{InvalidOperation}
System.Exception: [UnknownError] : {"errorCode":"PermissionScopeNotGranted","message":"Authorization failed due to missing permission scope RoleEligibilitySchedule.ReadWrite.Directory,RoleManagement.ReadWrite.Directory.","instanceAnnotations":[]}
"Error during Export:"
at Get-MgBetaRoleManagementDirectoryRoleEligibilityScheduleRequest<Process>, C:\Program Files\WindowsPowerShell\Modules\Microsoft.Graph.Beta.Identity.Governance\2.6.1\exports\ProxyCmdletDefinitions.ps1: line 101367
at Export-TargetResource, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.1004.1\DSCResources\MSFT_AADRoleEligibilityScheduleRequest\MSFT_AADRoleEligibilityScheduleRequest.psm1: line 635
at Start-M365DSCConfigurationExtract, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.1004.1\modules\M365DSCReverse.psm1: line 615
at Export-M365DSCConfiguration, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.1004.1\modules\M365DSCUtil.psm1: line 1312
at <ScriptBlock>, C:\M365DSC\Run_ExportConfig.ps1: line 3
TenantId: xxxx.onmicrosoft.com

Environment Information + PowerShell Version

OsName               : Microsoft Windows 10 Enterprise
OsOperatingSystemSKU : EnterpriseEdition
OsArchitecture       : 64-bit
WindowsVersion       : 2009
WindowsBuildLabEx    : 19041.1.amd64fre.vb_release.191206-1406
OsLanguage           : en-US
OsMuiLanguages       : {en-US}

Name                           Value
----                           -----
PSVersion                      5.1.19041.3031
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.19041.3031
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

[Sylit82]

Hello,

My question is regarding this case why such a privileged API permission like 'RoleEligibilitySchedule.ReadWrite.Directory' and 'RoleManagement.ReadWrite.Directory' needs for an export?
Export is just a read activity, right?
Why needs 'Write' related API permissions?

Export fails in that stage:
"Extracting [AADConditionalAccessPolicy] using {ApplicationSecret}..."

Why these API permissions need do not defined in the official documentation of the ‘AADConditionalAccessPolicy’ component?
It only define 'Policy.Read.All' for read activity.
Reference:
https://microsoft365dsc.com/resources/azure-ad/AADConditionalAccessPolicy/

Thanks in advance!

BR,
J.

[andikrueger]

This looks like a bug within the current settings.json file of the resource.

Usually, we would only require read permissions for read operations.

[FabienTschanz]

The permissions were updated to reflect the actual required ones.