Release pipeline errors caused by AADAuthenticationMethodPolicy.

[kochi-shunsuke]

Description of the issue

I built my environment according to the Azure DevOps whitepaper.
And I added AzureAD workload using exported settings.
Error occurred in the release pipeline.
If I comment out AADAuthenticationMethodPolicyFido2, the error did not occur.
What is causing it?　And how should I do to solve these?

Microsoft 365 DSC Version

V1.23.1213.1

Which workloads are affected

Azure Active Directory

The DSC configuration

AADAuthenticationMethodPolicyFido2 "AADAuthenticationMethodPolicyFido2"
        {
            Credential                       = $Credential;
            Ensure                           = "Present";
            Id                               = "Fido2";
            IncludeTargets                   = @(
                MSFT_AADAuthenticationMethodPolicyFido2IncludeTarget{
                    Id = 'all_users'
                    TargetType = 'group'
                }
            );
            IsAttestationEnforced            = $False;
            IsSelfServiceRegistrationAllowed = $True;
            KeyRestrictions                  = MSFT_MicrosoftGraphfido2KeyRestrictions{
                IsEnforced = $False
                EnforcementType = 'block'
                AaGuids = @()
            };
            State                            = "disabled";
        }

Verbose logs showing the problem

##[error]ClassVersion Qualifier not found.
    + CategoryInfo          : ObjectNotFound: (root/Microsoft/...gurationManager:String) [], CimException

    + FullyQualifiedErrorId : MI RESULT 6

    + PSComputerName        : localhost

Environment Information + PowerShell Version

No response

[ykuijs]

Hi @kochi-shunsuke, where exactly did you add the above DSC config? And during which step are you getting the mentioned errors?

[kochi-shunsuke]

Hi @ykuijs, the config was added to AzureAD.schema.psm1. (I create the file by copying Office365's one. )
And the error occurred during the step to deploy the configuration in the release pipeline.

[ykuijs]

Could you share a version of the file that is not working?

[kochi-shunsuke]

The files are following:
AzureAD.psd1

    RootModule           = 'AzureAD.schema.psm1'
    ModuleVersion        = '0.0.1'
    GUID                 = '4fc5f373-7984-46e6-835c-97401ba17f9a'
    Author               = 'Yorick Kuijs'
    CompanyName          = 'Microsoft'
    Copyright            = 'Copyright to Microsoft Corporation. All rights reserved.'
    ##RequiredModules      = @(
    #    @{ ModuleName = 'xPSDesiredStateConfiguration'; ModuleVersion = '8.4.0.0' }
    #)
    DscResourcesToExport = @('AzureAD')
}

AzureAD.schema.psm1
※Parameters other than "AADAuthenticationMethodPolicyFido2" are omitted.

{
    param
    (
        [Parameter()]
        [PSCredential]
        $Credential,
        [Parameter()]
        [System.String]
        $ApplicationId,
        [Parameter()]
        [System.String]
        $TenantId,
        [Parameter()]
        [System.String]
        $Thumbprint
    )
    Import-DscResource -ModuleName Microsoft365DSC
    $paramCount = ($PSBoundParameters.GetEnumerator() | Where-Object -FilterScript { $_.Key -in 'ApplicationId', 'TenantId', 'Thumbprint' }).Count
    if ($paramCount -gt 0 -and $paramCount -lt 3)
    {
        throw "Please specify ApplicationId, TenantId and Thumbprint"
    }
    $OrganizationName = $ConfigurationData.NonNodeData.Environment.OrganizationName

AADAuthenticationMethodPolicyFido2 "AADAuthenticationMethodPolicyFido2-Fido2"
        {
            Credential                       = $Credential;
            Ensure                           = "Present";
            Id                               = "Fido2";
            IncludeTargets                   = @(
                MSFT_AADAuthenticationMethodPolicyFido2IncludeTarget{
                    Id = 'all_users'
                    TargetType = 'group'
                }
            );
            IsAttestationEnforced            = $False;
            IsSelfServiceRegistrationAllowed = $True;
            KeyRestrictions                  = MSFT_MicrosoftGraphfido2KeyRestrictions{
                IsEnforced = $False
                EnforcementType = 'block'
                AaGuids = @()
            };
            State                            = "disabled";
        }
}

#~ Other parameters are omitted ~

[ykuijs]

Can you please try to take out the IncludeTargets parameter and then try again? Does that fix the issue??

[kochi-shunsuke]

I tried, but it didn't fix.

[kochi-shunsuke]

@ykuijs
What should I try next to solve this problem?