Is Get-MgBetaDeviceManagementDeviceCompliancePolicyScheduledActionForRule broken

Daniel King 0

I am trying to retrieve compliance policy actions for a Microsoft 365 DSC resource module.

I seem to have the same issue as reported here:

https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/2177

Running cmdlet I get this error:
User's image

I think the cmdlet is using URI documented here https://learn.microsoft.com/en-gb/graph/api/intune-deviceconfig-devicecompliancescheduledactionforrule-list?view=graph-rest-1.0&tabs=http

but that doesn't appear to be correct?

Using graph explorer to check the URI

    "error": {
        "code": "No method match route template",
        "message": "No OData route exists that match template ~/singleton/navigation/key/navigation with http verb GET for request /DeviceConfiguration_2412/StatelessDeviceConfigurationFEService/deviceManagement/deviceCompliancePolicies('16400cd3-0bb7-4ad0-a086-6d667e054755')/scheduledActionsForRule.",
        "innerError": {
            "date": "2025-01-09T16:13:13",
            "request-id": "9fdbfdf0-a410-46df-b8fb-fc6e20032eb4",
            "client-request-id": "5a89e92b-a6af-5e37-91e8-e0a3b20b0413"
        }
    }
}

Daniel King 0 Reputation points

2025-01-09T17:53:46.7+00:00

Further to this, I've managed to get the data I want in Graph Explorer (beta) with the following URI

https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies/{myPolicyID}?$expand=scheduledActionsForRule($expand=scheduledActionConfigurations)

but Invoke-MgGraph can't handle the expanded properties and does not return the data I need.
Daniel King 0 Reputation points

2025-01-09T22:29:51.42+00:00

Code snippets for Graph Explorer suggests

$policy = Get-MgBetaDeviceManagementDeviceCompliancePolicy -ExpandProperty "scheduledActionsForRule(`$expand=scheduledActionConfigurations)" -DeviceCompliancePolicyId {myPolicyID}

If I then pipe that through ConvertTo-Json

i.e.

$policy.ScheduledActionsForRule | ConvertTo-Json

I can see the information I'm looking for.
Daniel King 0 Reputation points

2025-01-09T23:15:37.5766667+00:00

surely there's a better way and it very much seems like

Get-MgBetaDeviceManagementDeviceCompliancePolicy
Get-MgBetaDeviceManagementDeviceCompliancePolicyScheduledActionForRule

are not working as intended?

Daniel King 0

Just in case this helps anyone else struggling with this, with some help from Graph Explorer I've worked out that I can set compliance actions as follows:

    $AdditionalProperties = @{

        '@odata.type'                                  = "#microsoft.graph.androidWorkProfileCompliancePolicy"

    }

    #$AdditionalProperties['@odata.type'] = "#microsoft.graph.androidWorkProfileCompliancePolicy"

    $DisplayName                                = "Android Work Profile - GRAPH POLICY"

    $Description                                = "Compliance policy for Android work profile devices."

    $scheduledActionsForRule = @{

        '@odata.type'                 = '#microsoft.graph.deviceComplianceScheduledActionForRule'

        ruleName                      = ''

        scheduledActionConfigurations = @(

            @{

                '@odata.type' = '#microsoft.graph.deviceComplianceActionItem'

                actionType    = 'block' #Mark device noncompliant

                gracePeriodHours = 0  

            }

            @{

                '@odata.type' = '#microsoft.graph.deviceComplianceActionItem'

                actionType    = 'notification' #send email to user

                gracePeriodHours = 24  

                NotificationMessageCcList = @("a7715e66-b84a-4075-9412-b8942236ab43")

                NotificationTemplateId = "00000000-0000-0000-0000-000000000000"

            }

            @{

                '@odata.type' = '#microsoft.graph.deviceComplianceActionItem'

                actionType    = 'pushnotification' #Send push notification to end user

                gracePeriodHours = 48  

            }

            @{

                '@odata.type' = '#microsoft.graph.deviceComplianceActionItem'

                actionType    = 'retire' #Send push notification to end user

                gracePeriodHours = 72  

            }

            @{

                '@odata.type' = '#microsoft.graph.deviceComplianceActionItem'

                actionType    = 'remoteLock' #Send push notification to end user

                gracePeriodHours = 72  

            }     

        )

    }

    $policy = New-MgBetaDeviceManagementDeviceCompliancePolicy -DisplayName $DisplayName `

        -Description $Description `

        -AdditionalProperties $AdditionalProperties `

        -ScheduledActionsForRule $scheduledActionsForRule

Share via

Is Get-MgBetaDeviceManagementDeviceCompliancePolicyScheduledActionForRule broken

Your answer