microsoft / Microsoft365DSC

Manages, configures, extracts and monitors Microsoft 365 tenant configurations
https://aka.ms/M365DSC
MIT License
1.47k stars 447 forks source link

BUG? [SPOSharingSettings] throws error: "the member BccExternalSharingInvitations is not valid" #4786

Closed GeldHades27355 closed 3 weeks ago

GeldHades27355 commented 3 weeks ago

Description of the issue

We pulled an export of our master tenant, and [SPOSharingSettings] seems to be problematic (also see https://github.com/microsoft/Microsoft365DSC/issues/4771).

We're getting "the member BccExternalSharingInvitations is not valid", when trying to apply this resource.

According to the documentation, this should be a valid parameter, AND the export contains it as well.

Is this a bug? Or is there a special trick to make this parameter work?

image

Microsoft 365 DSC Version

1.24.605.1

Which workloads are affected

SharePoint Online

The DSC configuration

SPOSharingSettings "SPOSharingSettings"
        {
            BccExternalSharingInvitations              = $False;
            Credential                                 = $Credscredential;
            DefaultLinkPermission                      = "Edit";
            DefaultSharingLinkType                     = "Internal";
            EnableGuestSignInAcceleration              = $False;
            Ensure                                     = "Present";
            ExternalUserExpirationRequired             = $False;
            ExternalUserExpireInDays                   = 60;
            FileAnonymousLinkType                      = "Edit";
            FolderAnonymousLinkType                    = "Edit";
            IsSingleInstance                           = "Yes";
            MySiteSharingCapability                    = "ExternalUserAndGuestSharing";
            NotifyOwnersWhenItemsReshared              = $True;
            PreventExternalUsersFromResharing          = $True;
            ProvisionSharedWithEveryoneFolder          = $False;
            RequireAcceptingAccountMatchInvitedAccount = $True;
            SharingCapability                          = "ExternalUserAndGuestSharing";
            SharingDomainRestrictionMode               = "None";
            ShowAllUsersClaim                          = $False;
            ShowEveryoneClaim                          = $False;
            ShowEveryoneExceptExternalUsersClaim       = $True;
            ShowPeoplePickerSuggestionsForGuestUsers   = $False;
        }

Verbose logs showing the problem

See description

Environment Information + PowerShell Version

OsName : Microsoft Windows Server 2022 Standard Evaluation OsOperatingSystemSKU : 79 OsArchitecture : 64-bit WindowsVersion : 2009 WindowsBuildLabEx : 20348.1.amd64fre.fe_release.210507-1500 OsLanguage : en-US OsMuiLanguages : {en-US, de-DE}

Name Value


PSVersion 5.1.20348.2400 PSEdition Desktop PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...} BuildVersion 10.0.20348.2400 CLRVersion 4.0.30319.42000 WSManStackVersion 3.0 PSRemotingProtocolVersion 2.3 SerializationVersion 1.1.0.1

ricmestre commented 3 weeks ago

You have some problem in your blueprint, according to the screenshot you are using that property BccExternalSharingInvitations where it doesn't belong. You don't show the whole screenshot but according to what's visible at least you have the property being used for the ODSettings and O365OrgSettings resources and it doesn't belong there.

GeldHades27355 commented 3 weeks ago

You have some problem in your blueprint, according to the screenshot you are using that property BccExternalSharingInvitations where it doesn't belong. You don't show the whole screenshot but according to what's visible at least you have the property being used for the ODSettings and O365OrgSettings resources and it doesn't belong there.

hmmm... it seems to be in the documenation tho: https://microsoft365dsc.com/resources/sharepoint/SPOSharingSettings/

Also, this isn't a blueprint - we're just re-importing an export raw to another tenant. The output from this:

Export-M365DSCConfiguration -Components @("AADSecurityDefaults", "EXOMailTips", "IntuneDeviceCompliancePolicyWindows10", "IntuneDeviceConfigurationEmailProfilePolicyWindows10", "O365OrgSettings", "ODSettings", "SCSensitivityLabel", "SPOSharingSettings", "TeamsUpgradePolicy") -Credential $Credential

is, verbatim, the DSC code I posted above.

BccExternalSharingInvitations is ONLY contained in SPOSharingSettings, nowhere else.

ricmestre commented 3 weeks ago

The result of the export is called a blueprint, the file M365TenantConfig.ps1 is your blueprint. The errors shown in your screenshot show that the property appears in several lines, you need to investigate why they ended up there.

GeldHades27355 commented 3 weeks ago

The result of the export is called a blueprint, the file M365TenantConfig.ps1 is your blueprint. The errors shown in your screenshot show that the property appears in several lines, you need to investigate why they ended up there.

It runs three times due to a bug in our DevOps Agent config. But that shouldn't cause the parameter to fail, since it seems to be exactly where it should be. It should succeed three times, if anything, shouldn't it?

Here is the entire code:

param ( [parameter()] [System.Management.Automation.PSCredential] $Credential )

Configuration M365TenantConfig { param ( [parameter()] [System.Management.Automation.PSCredential] $Credential )

if ($null -eq $Credential)
{
    <# Credentials #>
    $Credscredential = Get-Credential -Message "Credentials"

}
else
{
    $CredsCredential = $Credential
}

$OrganizationName = $CredsCredential.UserName.Split('@')[1]

Import-DscResource -ModuleName 'Microsoft365DSC' -ModuleVersion '1.24.605.1'

Node localhost
{
    AADSecurityDefaults "AADSecurityDefaults"
    {
        Credential           = $Credscredential;
        Description          = "Security defaults is a set of basic identity security mechanisms recommended by Microsoft. When enabled, these recommendations will be automatically enforced in your organization. Administrators and users will be better protected from common identity related attacks.";
        DisplayName          = "Security Defaults";
        IsEnabled            = $False;
        IsSingleInstance     = "Yes";
    }
    EXOMailTips "EXOMailTips"
    {
        Credential                            = $Credscredential;
        Ensure                                = "Present";
        IsSingleInstance                      = "Yes";
        MailTipsAllTipsEnabled                = $True;
        MailTipsExternalRecipientsTipsEnabled = $True;
        MailTipsGroupMetricsEnabled           = $True;
        MailTipsLargeAudienceThreshold        = 25;
        MailTipsMailboxSourcedTipsEnabled     = $True;
    }
    IntuneDeviceCompliancePolicyWindows10 "IntuneDeviceCompliancePolicyWindows10-Standard device compliance for Windows"
    {
        ActiveFirewallRequired                      = $True;
        AntiSpywareRequired                         = $True;
        AntivirusRequired                           = $True;
        Assignments                                 = @(
            MSFT_DeviceManagementConfigurationPolicyAssignments{
                deviceAndAppManagementAssignmentFilterType = 'none'
                groupDisplayName = 'All users'
                dataType = '#microsoft.graph.allLicensedUsersAssignmentTarget'
            }
            MSFT_DeviceManagementConfigurationPolicyAssignments{
                deviceAndAppManagementAssignmentFilterType = 'include'
                groupDisplayName = 'All devices'
                dataType = '#microsoft.graph.allDevicesAssignmentTarget'
                deviceAndAppManagementAssignmentFilterId = '***-7de940bb81b8'
            });
        BitLockerEnabled                            = $True;
        CodeIntegrityEnabled                        = $True;
        ConfigurationManagerComplianceRequired      = $False;
        Credential                                  = $Credscredential;
        DefenderEnabled                             = $True;
        DeviceThreatProtectionEnabled               = $True;
        DeviceThreatProtectionRequiredSecurityLevel = "low";
        DisplayName                                 = "Standard device compliance for Windows";
        EarlyLaunchAntiMalwareDriverEnabled         = $False;
        Ensure                                      = "Present";
        PasswordBlockSimple                         = $True;
        PasswordRequired                            = $True;
        PasswordRequiredToUnlockFromIdle            = $True;
        PasswordRequiredType                        = "deviceDefault";
        RequireHealthyDeviceReport                  = $False;
        RTPEnabled                                  = $True;
        SecureBootEnabled                           = $True;
        SignatureOutOfDate                          = $True;
        StorageRequireEncryption                    = $True;
        ValidOperatingSystemBuildRanges             = @();
    }
    IntuneDeviceConfigurationEmailProfilePolicyWindows10 "IntuneDeviceConfigurationEmailProfilePolicyWindows10-Email, Calendar and People apps: automatic + basic configuration"
    {
        AccountName           = "Work";
        Assignments           = @(
            MSFT_DeviceManagementConfigurationPolicyAssignments{
                deviceAndAppManagementAssignmentFilterType = 'none'
                groupDisplayName = 'All users'
                dataType = '#microsoft.graph.allLicensedUsersAssignmentTarget'
            }
        );
        Credential            = $Credscredential;
        DisplayName           = "Email, Calendar and People apps: automatic + basic configuration";
        DurationOfEmailToSync = "unlimited";
        EmailAddressSource    = "primarySmtpAddress";
        EmailSyncSchedule     = "asMessagesArrive";
        Ensure                = "Present";
        HostName              = "outlook.office365.com";
        Id                    = "***-849d9b90cde4";
        RequireSsl            = $True;
        SyncCalendar          = $True;
        SyncContacts          = $True;
        SyncTasks             = $True;
    }
    O365OrgSettings "O365OrgSettings"
    {
        AdminCenterReportDisplayConcealedNames                = $False;
        AppsAndServicesIsAppAndServicesTrialEnabled           = $True;
        AppsAndServicesIsOfficeStoreEnabled                   = $True;
        CortanaEnabled                                        = $False;
        Credential                                            = $Credscredential;
        DynamicsCustomerVoiceIsInOrgFormsPhishingScanEnabled  = $True;
        DynamicsCustomerVoiceIsRecordIdentityByDefaultEnabled = $True;
        DynamicsCustomerVoiceIsRestrictedSurveyAccessEnabled  = $False;
        FormsIsBingImageSearchEnabled                         = $True;
        FormsIsExternalSendFormEnabled                        = $True;
        FormsIsExternalShareCollaborationEnabled              = $True;
        FormsIsExternalShareResultEnabled                     = $True;
        FormsIsExternalShareTemplateEnabled                   = $True;
        FormsIsInOrgFormsPhishingScanEnabled                  = $True;
        FormsIsRecordIdentityByDefaultEnabled                 = $True;
        InstallationOptionsAppsForMac                         = @();
        InstallationOptionsAppsForWindows                     = @("isVisioEnabled","isProjectEnabled","isMicrosoft365AppsEnabled");
        InstallationOptionsUpdateChannel                      = "current";
        IsSingleInstance                                      = "Yes";
        M365WebEnableUsersToOpenFilesFrom3PStorage            = $False;
        PlannerAllowCalendarSharing                           = $True;
        ToDoIsExternalJoinEnabled                             = $True;
        ToDoIsExternalShareEnabled                            = $False;
        ToDoIsPushNotificationEnabled                         = $True;
        VivaInsightsDigestEmail                               = $False;
        VivaInsightsOutlookAddInAndInlineSuggestions          = $False;
        VivaInsightsScheduleSendSuggestions                   = $False;
        VivaInsightsWebExperience                             = $False;
    }
    ODSettings "ODSettings"
    {
        BlockMacSync                              = $False;
        Credential                                = $Credscredential;
        DisableReportProblemDialog                = $False;
        DomainGuids                               = @();
        Ensure                                    = "Present";
        ExcludedFileExtensions                    = @();
        IsSingleInstance                          = "Yes";
        NotificationsInOneDriveForBusinessEnabled = $True;
        NotifyOwnersWhenInvitationsAccepted       = $True;
        ODBAccessRequests                         = "Unspecified";
        ODBMembersCanShare                        = "Unspecified";
        OneDriveForGuestsEnabled                  = $False;
        OneDriveStorageQuota                      = 1048576;
        OrphanedPersonalSitesRetentionPeriod      = 30;
        TenantRestrictionEnabled                  = $False;
    }
    SCSensitivityLabel "SCSensitivityLabel-General"
    {
        AdvancedSettings                               = @(
            MSFT_SCLabelSetting
            {
                Key   = 'color'
                Value = '#13A10E'
            }
            MSFT_SCLabelSetting
            {
                Key   = 'isparent'
                Value = 'False'
            }
        );
        Comment                                        = "";
        ContentType                                    = @("File, Email","Site, UnifiedGroup","SchematizedData");
        Credential                                     = $Credscredential;
        DisplayName                                    = "General";
        EncryptionEnabled                              = $True;
        EncryptionProtectionType                       = "removeprotection";
        Ensure                                         = "Present";
        LocaleSettings                                 = @(
            MSFT_SCLabelLocaleSettings
            {
                LocaleKey = 'displayName'
                LabelSettings  = @(
                    MSFT_SCLabelSetting
                    {
                        Key   = 'default'
                        Value = 'General'
                    }
                )
            }
            MSFT_SCLabelLocaleSettings
            {
                LocaleKey = 'tooltip'
                LabelSettings  = @(
                    MSFT_SCLabelSetting
                    {
                        Key   = 'default'
                        Value = 'Data which has no specific sensitivity and need no particular protection. There are no sharing restrictions.'
                    }
                )
            }
        );
        Name                                           = "General";
        Priority                                       = 0;
        SiteAndGroupExternalSharingControlType         = "ExternalUserAndGuestSharing";
        SiteAndGroupProtectionAllowAccessToGuestUsers  = $False;
        SiteAndGroupProtectionAllowEmailFromGuestUsers = $True;
        SiteAndGroupProtectionAllowFullAccess          = $True;
        SiteAndGroupProtectionAllowLimitedAccess       = $False;
        SiteAndGroupProtectionBlockAccess              = $False;
        SiteAndGroupProtectionEnabled                  = $True;
        SiteAndGroupProtectionPrivacy                  = "public";
        Tooltip                                        = "Data which has no specific sensitivity and need no particular protection. There are no sharing restrictions.";
    }
    SCSensitivityLabel "SCSensitivityLabel-Preview"
    {
        AdvancedSettings                               = @(
            MSFT_SCLabelSetting
            {
                Key   = 'color'
                Value = '#3A96DD'
            }
            MSFT_SCLabelSetting
            {
                Key   = 'isparent'
                Value = 'False'
            }
        );
        ApplyContentMarkingFooterAlignment             = "Left";
        ApplyContentMarkingFooterEnabled               = $False;
        ApplyContentMarkingFooterFontColor             = "#000000";
        ApplyContentMarkingFooterFontSize              = "10";
        ApplyContentMarkingFooterMargin                = "5";
        ApplyContentMarkingFooterText                  = "Preview";
        ApplyContentMarkingHeaderAlignment             = "Left";
        ApplyContentMarkingHeaderEnabled               = $True;
        ApplyContentMarkingHeaderFontColor             = "#000000";
        ApplyContentMarkingHeaderFontSize              = "10";
        ApplyContentMarkingHeaderMargin                = "5";
        ApplyContentMarkingHeaderText                  = "Preview";
        Comment                                        = "";
        ContentType                                    = @("File, Email","Site, UnifiedGroup","SchematizedData");
        Credential                                     = $Credscredential;
        DisplayName                                    = "Preview";
        EncryptionEnabled                              = $True;
        EncryptionProtectionType                       = "removeprotection";
        Ensure                                         = "Present";
        LocaleSettings                                 = @(
            MSFT_SCLabelLocaleSettings
            {
                LocaleKey = 'displayName'
                LabelSettings  = @(
                    MSFT_SCLabelSetting
                    {
                        Key   = 'default'
                        Value = 'Preview'
                    }
                )
            }
            MSFT_SCLabelLocaleSettings
            {
                LocaleKey = 'tooltip'
                LabelSettings  = @(
                    MSFT_SCLabelSetting
                    {
                        Key   = 'default'
                        Value = 'For sharing with our preview customers and partners. Access is not restricted nor is data encrypted, but it is trackable and revokable.'
                    }
                )
            }
        );
        Name                                           = "Preview";
        Priority                                       = 1;
        SiteAndGroupExternalSharingControlType         = "ExistingExternalUserSharingOnly";
        SiteAndGroupProtectionAllowAccessToGuestUsers  = $False;
        SiteAndGroupProtectionAllowEmailFromGuestUsers = $True;
        SiteAndGroupProtectionAllowFullAccess          = $False;
        SiteAndGroupProtectionAllowLimitedAccess       = $False;
        SiteAndGroupProtectionBlockAccess              = $False;
        SiteAndGroupProtectionEnabled                  = $True;
        SiteAndGroupProtectionPrivacy                  = "public";
        Tooltip                                        = "For sharing with our preview customers and partners. Access is not restricted nor is data encrypted, but it is trackable and revokable.";
    }
    SCSensitivityLabel "SCSensitivityLabel-Confidential"
    {
        AdvancedSettings                               = @(
            MSFT_SCLabelSetting
            {
                Key   = 'color'
                Value = '#EAA300'
            }
            MSFT_SCLabelSetting
            {
                Key   = 'isparent'
                Value = 'False'
            }
        );
        ApplyContentMarkingFooterAlignment             = "Left";
        ApplyContentMarkingFooterEnabled               = $False;
        ApplyContentMarkingFooterFontColor             = "#000000";
        ApplyContentMarkingFooterFontSize              = "10";
        ApplyContentMarkingFooterMargin                = "5";
        ApplyContentMarkingFooterText                  = "confidential";
        ApplyContentMarkingHeaderAlignment             = "Left";
        ApplyContentMarkingHeaderEnabled               = $True;
        ApplyContentMarkingHeaderFontColor             = "#000000";
        ApplyContentMarkingHeaderFontSize              = "10";
        ApplyContentMarkingHeaderMargin                = "5";
        ApplyContentMarkingHeaderText                  = "confidential";
        Comment                                        = "";
        ContentType                                    = @("File, Email","Site, UnifiedGroup","SchematizedData");
        Credential                                     = $Credscredential;
        DisplayName                                    = "Secure Collaboration";
        EncryptionContentExpiredOnDateInDaysOrNever    = "Never";
        EncryptionEnabled                              = $True;
        EncryptionOfflineAccessDays                    = "1";
        EncryptionProtectionType                       = "template";
        EncryptionRightsDefinitions                    = "***@$($OrganizationName):VIEW,VIEWRIGHTSDATA,DOCEDIT,EDIT,PRINT,EXTRACT,REPLY,REPLYALL,FORWARD,EDITRIGHTSDATA,EXPORT,OBJMODEL,OWNER;AuthenticatedUsers:VIEW,VIEWRIGHTSDATA,DOCEDIT,EDIT,PRINT,EXTRACT,REPLY,REPLYALL,FORWARD,OBJMODEL";
        Ensure                                         = "Present";
        LocaleSettings                                 = @(
            MSFT_SCLabelLocaleSettings
            {
                LocaleKey = 'displayName'
                LabelSettings  = @(
                    MSFT_SCLabelSetting
                    {
                        Key   = 'default'
                        Value = 'Secure Collaboration'
                    }
                )
            }
            MSFT_SCLabelLocaleSettings
            {
                LocaleKey = 'tooltip'
                LabelSettings  = @(
                    MSFT_SCLabelSetting
                    {
                        Key   = 'default'
                        Value = 'Examples can be confidential IP (internal and external), document drafts for sharing with trusted business partners and PII. Confidential information is encrypted and and can only be consumed by employees or by invited guests. IMPORTANT: Users must use M365 desktop or web Apps connected to Entra ID or a Microsoft Account MSA in order to consume this information.'
                    }
                )
            }
        );
        Name                                           = "Confidential";
        Priority                                       = 2;
        SiteAndGroupExternalSharingControlType         = "ExistingExternalUserSharingOnly";
        SiteAndGroupProtectionAllowAccessToGuestUsers  = $False;
        SiteAndGroupProtectionAllowEmailFromGuestUsers = $True;
        SiteAndGroupProtectionAllowFullAccess          = $False;
        SiteAndGroupProtectionAllowLimitedAccess       = $False;
        SiteAndGroupProtectionBlockAccess              = $False;
        SiteAndGroupProtectionEnabled                  = $True;
        SiteAndGroupProtectionPrivacy                  = "public";
        Tooltip                                        = "Examples can be confidential IP (internal and external), document drafts for sharing with trusted business partners and PII. Confidential information is encrypted and and can only be consumed by employees or by invited guests. IMPORTANT: Users must use M365 desktop or web Apps connected to Entra ID or a Microsoft Account MSA in order to consume this information.";
    }
    SCSensitivityLabel "SCSensitivityLabel-Revoked"
    {
        AdvancedSettings                               = @(
            MSFT_SCLabelSetting
            {
                Key   = 'color'
                Value = '#393939'
            }
            MSFT_SCLabelSetting
            {
                Key   = 'isparent'
                Value = 'False'
            }
        );
        ApplyContentMarkingHeaderAlignment             = "Left";
        ApplyContentMarkingHeaderFontColor             = "#000000";
        ApplyContentMarkingHeaderFontSize              = "10";
        ApplyContentMarkingHeaderMargin                = "5";
        ApplyContentMarkingHeaderText                  = "Revoked";
        Comment                                        = "";
        ContentType                                    = @("File, Email","Site, UnifiedGroup","SchematizedData");
        Credential                                     = $Credscredential;
        DisplayName                                    = "Revoked";
        EncryptionContentExpiredOnDateInDaysOrNever    = "Never";
        EncryptionEnabled                              = $True;
        EncryptionOfflineAccessDays                    = "7";
        EncryptionProtectionType                       = "template";
        EncryptionRightsDefinitions                    = "$($OrganizationName):VIEW,VIEWRIGHTSDATA,DOCEDIT,EDIT,PRINT,EXTRACT,REPLY,REPLYALL,FORWARD,EDITRIGHTSDATA,EXPORT,OBJMODEL,OWNER";
        Ensure                                         = "Present";
        LocaleSettings                                 = @(
            MSFT_SCLabelLocaleSettings
            {
                LocaleKey = 'displayName'
                LabelSettings  = @(
                    MSFT_SCLabelSetting
                    {
                        Key   = 'default'
                        Value = 'Revoked'
                    }
                )
            }
            MSFT_SCLabelLocaleSettings
            {
                LocaleKey = 'tooltip'
                LabelSettings  = @(
                    MSFT_SCLabelSetting
                    {
                        Key   = 'default'
                        Value = 'Use this to revoke any possible access outside of and label documents as invalid. Examples can include: superseded documentation, obsolete drafts. Revoked documents are only accessible for internal employees. External sharing is blocked.'
                    }
                )
            }
        );
        Name                                           = "Revoked";
        Priority                                       = 3;
        SiteAndGroupExternalSharingControlType         = "Disabled";
        SiteAndGroupProtectionAllowAccessToGuestUsers  = $True;
        SiteAndGroupProtectionAllowEmailFromGuestUsers = $True;
        SiteAndGroupProtectionAllowFullAccess          = $False;
        SiteAndGroupProtectionAllowLimitedAccess       = $False;
        SiteAndGroupProtectionBlockAccess              = $False;
        SiteAndGroupProtectionEnabled                  = $True;
        SiteAndGroupProtectionPrivacy                  = "public";
        Tooltip                                        = "Use this to revoke any possible access outside of and label documents as invalid. Examples can include: superseded documentation, obsolete drafts. Revoked documents are only accessible for internal employees. External sharing is blocked.";
    }
    SCSensitivityLabel "SCSensitivityLabel-Highly Confidential"
    {
        AdvancedSettings                               = @(
            MSFT_SCLabelSetting
            {
                Key   = 'color'
                Value = '#A4262C'
            }
            MSFT_SCLabelSetting
            {
                Key   = 'isparent'
                Value = 'False'
            }
        );
        ApplyContentMarkingFooterAlignment             = "Left";
        ApplyContentMarkingFooterEnabled               = $False;
        ApplyContentMarkingFooterFontColor             = "#000000";
        ApplyContentMarkingFooterFontSize              = "10";
        ApplyContentMarkingFooterMargin                = "5";
        ApplyContentMarkingFooterText                  = "internal use only.";
        ApplyContentMarkingHeaderAlignment             = "Left";
        ApplyContentMarkingHeaderEnabled               = $True;
        ApplyContentMarkingHeaderFontColor             = "#000000";
        ApplyContentMarkingHeaderFontSize              = "10";
        ApplyContentMarkingHeaderMargin                = "5";
        ApplyContentMarkingHeaderText                  = "internal only";
        ApplyWaterMarkingEnabled                       = $False;
        ApplyWaterMarkingFontColor                     = "#000000";
        ApplyWaterMarkingFontSize                      = "10";
        ApplyWaterMarkingLayout                        = "Diagonal";
        ApplyWaterMarkingText                          = "Internal use only";
        Comment                                        = "";
        ContentType                                    = @("File, Email","Site, UnifiedGroup","SchematizedData");
        Credential                                     = $Credscredential;
        DisplayName                                    = "Confidential - Internal only";
        EncryptionContentExpiredOnDateInDaysOrNever    = "Never";
        EncryptionEnabled                              = $True;
        EncryptionOfflineAccessDays                    = "0";
        EncryptionProtectionType                       = "template";
        EncryptionRightsDefinitions                    = "***@$($OrganizationName):VIEW,VIEWRIGHTSDATA,DOCEDIT,EDIT,PRINT,EXTRACT,REPLY,REPLYALL,FORWARD,EDITRIGHTSDATA,EXPORT,OBJMODEL,OWNER";
        Ensure                                         = "Present";
        LocaleSettings                                 = @(
            MSFT_SCLabelLocaleSettings
            {
                LocaleKey = 'displayName'
                LabelSettings  = @(
                    MSFT_SCLabelSetting
                    {
                        Key   = 'default'
                        Value = 'Confidential - Internal only'
                    }
                )
            }
            MSFT_SCLabelLocaleSettings
            {
                LocaleKey = 'tooltip'
                LabelSettings  = @(
                    MSFT_SCLabelSetting
                    {
                        Key   = 'default'
                        Value = 'Information not for consumption outside of. Examples can be highly confidential IP (internal and external), internal document drafts and highly sensitive PII. Confidential information is encrypted and and can only be consumed by employees.'
                    }
                )
            }
        );
        Name                                           = "Highly Confidential";
        Priority                                       = 4;
        SiteAndGroupExternalSharingControlType         = "Disabled";
        SiteAndGroupProtectionAllowAccessToGuestUsers  = $True;
        SiteAndGroupProtectionAllowEmailFromGuestUsers = $True;
        SiteAndGroupProtectionAllowFullAccess          = $False;
        SiteAndGroupProtectionAllowLimitedAccess       = $False;
        SiteAndGroupProtectionBlockAccess              = $False;
        SiteAndGroupProtectionEnabled                  = $True;
        SiteAndGroupProtectionPrivacy                  = "private";
        Tooltip                                        = "Information not for consumption outside of. Examples can be highly confidential IP (internal and external), internal document drafts and highly sensitive PII. Confidential information is encrypted and and can only be consumed by employees.";
    }
    SPOSharingSettings "SPOSharingSettings"
    {
        BccExternalSharingInvitations              = $False;
        Credential                                 = $Credscredential;
        DefaultLinkPermission                      = "Edit";
        DefaultSharingLinkType                     = "Internal";
        EnableGuestSignInAcceleration              = $False;
        Ensure                                     = "Present";
        ExternalUserExpirationRequired             = $False;
        ExternalUserExpireInDays                   = 60;
        FileAnonymousLinkType                      = "Edit";
        FolderAnonymousLinkType                    = "Edit";
        IsSingleInstance                           = "Yes";
        MySiteSharingCapability                    = "ExternalUserAndGuestSharing";
        NotifyOwnersWhenItemsReshared              = $True;
        PreventExternalUsersFromResharing          = $True;
        ProvisionSharedWithEveryoneFolder          = $False;
        RequireAcceptingAccountMatchInvitedAccount = $True;
        SharingCapability                          = "ExternalUserAndGuestSharing";
        SharingDomainRestrictionMode               = "None";
        ShowAllUsersClaim                          = $False;
        ShowEveryoneClaim                          = $False;
        ShowEveryoneExceptExternalUsersClaim       = $True;
        ShowPeoplePickerSuggestionsForGuestUsers   = $False;
    }
    TeamsUpgradePolicy "TeamsUpgradePolicy-Global"
    {
        Credential             = $Credscredential;
        Identity               = "Global";
        MigrateMeetingsToTeams = $False;
        Users                  = @();
    }
    TeamsUpgradePolicy "TeamsUpgradePolicy-UpgradeToTeams"
    {
        Credential             = $Credscredential;
        Identity               = "UpgradeToTeams";
        MigrateMeetingsToTeams = $False;
        Users                  = @();
    }
    TeamsUpgradePolicy "TeamsUpgradePolicy-Islands"
    {
        Credential             = $Credscredential;
        Identity               = "Islands";
        MigrateMeetingsToTeams = $False;
        Users                  = @();
    }
    TeamsUpgradePolicy "TeamsUpgradePolicy-IslandsWithNotify"
    {
        Credential             = $Credscredential;
        Identity               = "IslandsWithNotify";
        MigrateMeetingsToTeams = $False;
        Users                  = @();
    }
    TeamsUpgradePolicy "TeamsUpgradePolicy-SfBOnly"
    {
        Credential             = $Credscredential;
        Identity               = "SfBOnly";
        MigrateMeetingsToTeams = $False;
        Users                  = @();
    }
    TeamsUpgradePolicy "TeamsUpgradePolicy-SfBOnlyWithNotify"
    {
        Credential             = $Credscredential;
        Identity               = "SfBOnlyWithNotify";
        MigrateMeetingsToTeams = $False;
        Users                  = @();
    }
    TeamsUpgradePolicy "TeamsUpgradePolicy-SfBWithTeamsCollab"
    {
        Credential             = $Credscredential;
        Identity               = "SfBWithTeamsCollab";
        MigrateMeetingsToTeams = $False;
        Users                  = @();
    }
    TeamsUpgradePolicy "TeamsUpgradePolicy-SfBWithTeamsCollabWithNotify"
    {
        Credential             = $Credscredential;
        Identity               = "SfBWithTeamsCollabWithNotify";
        MigrateMeetingsToTeams = $False;
        Users                  = @();
    }
    TeamsUpgradePolicy "TeamsUpgradePolicy-SfBWithTeamsCollabAndMeetings"
    {
        Credential             = $Credscredential;
        Identity               = "SfBWithTeamsCollabAndMeetings";
        MigrateMeetingsToTeams = $False;
        Users                  = @();
    }
    TeamsUpgradePolicy "TeamsUpgradePolicy-SfBWithTeamsCollabAndMeetingsWithNotify"
    {
        Credential             = $Credscredential;
        Identity               = "SfBWithTeamsCollabAndMeetingsWithNotify";
        MigrateMeetingsToTeams = $False;
        Users                  = @();
    }
    TeamsUpgradePolicy "TeamsUpgradePolicy-SfBOnlyWithOutNotify"
    {
        Credential             = $Credscredential;
        Identity               = "SfBOnlyWithOutNotify";
        MigrateMeetingsToTeams = $False;
        Users                  = @();
    }
}

}

M365TenantConfig -ConfigurationData .\ConfigurationData.psd1 -Credential $Credential

ricmestre commented 3 weeks ago

I'm able to compile the blueprint to MOF just fine so try to uninstall M365DSC module, update to latest version, make a new export and try again.

GeldHades27355 commented 3 weeks ago

Yes, the mof always compiles fine - locally. However, we do that with Azure DevOps agents on a remote server, which is where the error occurs. And I believe 1.24.605 is the latest version, isn't it? (we're still in June).

I added info on the remote host to the initial post. Maybe it'll give some insight as to why that parameter fails. (others work fine, btw, also other resources). This looks way too specific IMHO to be a an external problem.

ricmestre commented 3 weeks ago

Latest version is 1.24.619.1, M365DSC has weekly releases.

I also use DevOps and have an whole lot of pipelines working, one of them also does exports automatically and I don't have this problem so this is something specific to your environment. Connect to the host where the agent is installed, upgrade M365DSC and try again as I said, if you still have the same problem you need to checkout that file on the host because it's clearly telling you that the property is showing up in several lines.

GeldHades27355 commented 3 weeks ago

Latest version is 1.24.619.1, M365DSC has weekly releases.

I also use DevOps and have an whole lot of pipelines working, one of them also does exports automatically and I don't have this problem so this is something specific to your environment. Connect to the host where the agent is installed, upgrade M365DSC and try again as I said, if you still have the same problem you need to checkout that file on the host because it's clearly telling you that the property is showing up in several lines.

OK - will do. Thanks!

While we're on it: surely, we're not expected to update weekly? 😉 That'll be VERY hard/risky to do once we reach a few hundred tenants IMHO.

GeldHades27355 commented 3 weeks ago

Never mind - we can't repro this anymore. Closing this for now.