IntuneDeviceEnrollmentPlatformRestriction: Assignments not working

[ricmestre]

Description of the issue

I created a policy manually which I then exported, config found below, then I removed it and tried to recreate but the assignment cannot be applied since it fails with Bad request on Update-DeviceConfigurationPolicyAssignment (failure not visible on CLI, only in Event Viewer).

The policy still gets created but then deploying the config again will result in error (hard failure in CLI, deployment stops) because then it tries to update it a few lines below in the code where it has another call to Update-DeviceConfigurationPolicyAssignment, which would have the same problem as above, but in this case it even fails for another reason which is calling it with $Identity which can be from another tenant (or from an already deleted policy in this case) so that chunk needs to changed to $currentCategory.Identity instead.

Microsoft 365 DSC Version

1.23.1220.1

Which workloads are affected

other

The DSC configuration

IntuneDeviceEnrollmentPlatformRestriction "IntuneDeviceEnrollmentPlatformRestriction-IntuneDeviceEnrollmentPlatformRestriction_1"
        {
            Assignments                       = @(
                MSFT_DeviceManagementConfigurationPolicyAssignments{
                    deviceAndAppManagementAssignmentFilterType = 'none'
                    dataType = '#microsoft.graph.groupAssignmentTarget'
                    deviceAndAppManagementAssignmentFilterId = '00000000-0000-0000-0000-000000000000'
                    groupId = 'b0b8fd3f-af2a-453b-be57-80182d599f02'
                }
            );
            Credential                        = $CredsCredential;
            DeviceEnrollmentConfigurationType = "singlePlatformRestriction";
            DisplayName                       = "IntuneDeviceEnrollmentPlatformRestriction_1";
            Ensure                            = "Present";
            Identity                          = "7857eee0-7b91-48e4-a72c-f66f36c4a483_SinglePlatformRestriction";
            WindowsRestriction                = MSFT_DeviceEnrollmentPlatformRestriction{
                platformBlocked = $False
                personalDeviceEnrollmentBlocked = $False
            };
        }

Verbose logs showing the problem

Error updating data:

{ Response status code does not indicate success: BadRequest (Bad Request). } \ at Update-DeviceConfigurationPolicyAssignment, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.1220.1\modules\M365DSCDRGUtil.psm1: line 1314
 \ at Set-TargetResource, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.23.1220.1\DscResources\MSFT_IntuneDeviceEnrollmentPlatformRestriction\MSFT_IntuneDeviceEnrollmentPlatformRestriction.psm1: line 335

Environment Information + PowerShell Version

OsName               : Microsoft Windows 11 Enterprise
OsOperatingSystemSKU : EnterpriseEdition
OsArchitecture       : 64-bit
WindowsVersion       : 2009
WindowsBuildLabEx    : 22621.1.amd64fre.ni_release.220506-1250
OsLanguage           : en-US
OsMuiLanguages       : {en-US, pt-PT}

Name                           Value
----                           -----
PSVersion                      5.1.22621.2428
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.22621.2428
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1