IntuneDeviceConfigurationEndpointProtectionPolicyWindows10: Cannot compile if ProfileTypes (in FirewallRules) is present

[ricmestre]

Description of the issue

The CIM instance FirewallRules has a property called ProfileTypes which contains where the rules will be applied (notConfigured, domain, public and private and any combination of the last 3) and it should be exported and handled like an array, unfortunately it's being handled like a regular string separated by commas which by itself is not a problem since the API actually expects it that way but the schema.mof file as a ValueMap of these expected values so if you try to compile the blueprint to MOF you get the error below.

Microsoft365DSC\MSFT_MicrosoftGraphwindowsFirewallRule : At least one of the values 'domain,private,public' is not supported or valid for property 'ProfileTypes' on class   'MSFT_MicrosoftGraphWindowsFirewallRule'. Please specify only supported values: notConfigured, domain, private, public.

The proper way to solve this would be to change the property to string array and handle it accordingly in the module, just like it's already being done for InterfaceTypes, but that would be considered a breaking change so the quick fix is to remove the ValueMap from the schema.mof file, I'll raise a PR to fix this.

Microsoft 365 DSC Version

1.24.724.1

Which workloads are affected

Intune

The DSC configuration

IntuneDeviceConfigurationEndpointProtectionPolicyWindows10 "IntuneDeviceConfigurationEndpointProtectionPolicyWindows10-test"
        {
            ApplicationGuardAllowFileSaveOnHost                                          = $False;
            ApplicationGuardAllowPersistence                                             = $False;
            ApplicationGuardAllowPrintToLocalPrinters                                    = $False;
            ApplicationGuardAllowPrintToNetworkPrinters                                  = $False;
            ApplicationGuardAllowPrintToPDF                                              = $False;
            ApplicationGuardAllowPrintToXPS                                              = $False;
            ApplicationGuardAllowVirtualGPU                                              = $False;
            ApplicationGuardBlockClipboardSharing                                        = "notConfigured";
            ApplicationGuardBlockFileTransfer                                            = "notConfigured";
            ApplicationGuardBlockNonEnterpriseContent                                    = $False;
            ApplicationGuardCertificateThumbprints                                       = @();
            ApplicationGuardEnabled                                                      = $False;
            ApplicationGuardEnabledOptions                                               = "notConfigured";
            ApplicationGuardForceAuditing                                                = $False;
            AppLockerApplicationControl                                                  = "notConfigured";
            Assignments                                                                  = @();
            BitLockerAllowStandardUserEncryption                                         = $False;
            BitLockerDisableWarningForOtherDiskEncryption                                = $False;
            BitLockerEnableStorageCardEncryptionOnMobile                                 = $False;
            BitLockerEncryptDevice                                                       = $False;
            BitLockerFixedDrivePolicy                                                    = MSFT_MicrosoftGraphbitLockerFixedDrivePolicy{
                RequireEncryptionForWriteAccess = $False

            };
            BitLockerRecoveryPasswordRotation                                            = "notConfigured";
            BitLockerRemovableDrivePolicy                                                = MSFT_MicrosoftGraphbitLockerRemovableDrivePolicy{
                BlockCrossOrganizationWriteAccess = $False
                RequireEncryptionForWriteAccess = $False
            };
            BitLockerSystemDrivePolicy                                                   = MSFT_MicrosoftGraphbitLockerSystemDrivePolicy{
                PrebootRecoveryEnableMessageAndUrl = $False
                StartupAuthenticationTpmPinUsage = 'blocked'
                StartupAuthenticationTpmPinAndKeyUsage = 'blocked'
                StartupAuthenticationRequired = $False
                StartupAuthenticationTpmUsage = 'blocked'
                StartupAuthenticationTpmKeyUsage = 'blocked'
                StartupAuthenticationBlockWithoutTpmChip = $False
            };
            Credential                                                                   = $Credscredential;
            DefenderAdditionalGuardedFolders                                             = @();
            DefenderAdobeReaderLaunchChildProcess                                        = "notConfigured";
            DefenderAdvancedRansomewareProtectionType                                    = "notConfigured";
            DefenderAttackSurfaceReductionExcludedPaths                                  = @();
            DefenderBlockPersistenceThroughWmiType                                       = "userDefined";
            DefenderEmailContentExecution                                                = "userDefined";
            DefenderEmailContentExecutionType                                            = "userDefined";
            DefenderFileExtensionsToExclude                                              = @();
            DefenderFilesAndFoldersToExclude                                             = @();
            DefenderGuardedFoldersAllowedAppPaths                                        = @();
            DefenderGuardMyFoldersType                                                   = "userDefined";
            DefenderNetworkProtectionType                                                = "notConfigured";
            DefenderOfficeAppsExecutableContentCreationOrLaunch                          = "userDefined";
            DefenderOfficeAppsExecutableContentCreationOrLaunchType                      = "userDefined";
            DefenderOfficeAppsLaunchChildProcess                                         = "userDefined";
            DefenderOfficeAppsLaunchChildProcessType                                     = "userDefined";
            DefenderOfficeAppsOtherProcessInjection                                      = "userDefined";
            DefenderOfficeAppsOtherProcessInjectionType                                  = "userDefined";
            DefenderOfficeCommunicationAppsLaunchChildProcess                            = "notConfigured";
            DefenderOfficeMacroCodeAllowWin32Imports                                     = "userDefined";
            DefenderOfficeMacroCodeAllowWin32ImportsType                                 = "userDefined";
            DefenderPreventCredentialStealingType                                        = "notConfigured";
            DefenderProcessCreation                                                      = "userDefined";
            DefenderProcessCreationType                                                  = "userDefined";
            DefenderProcessesToExclude                                                   = @();
            DefenderScriptDownloadedPayloadExecution                                     = "userDefined";
            DefenderScriptDownloadedPayloadExecutionType                                 = "userDefined";
            DefenderScriptObfuscatedMacroCode                                            = "userDefined";
            DefenderScriptObfuscatedMacroCodeType                                        = "userDefined";
            DefenderSecurityCenterBlockExploitProtectionOverride                         = $False;
            DefenderSecurityCenterITContactDisplay                                       = "notConfigured";
            DefenderSecurityCenterNotificationsFromApp                                   = "notConfigured";
            DefenderUntrustedExecutable                                                  = "userDefined";
            DefenderUntrustedExecutableType                                              = "userDefined";
            DefenderUntrustedUSBProcess                                                  = "userDefined";
            DefenderUntrustedUSBProcessType                                              = "userDefined";
            DeviceGuardEnableSecureBootWithDMA                                           = $False;
            DeviceGuardEnableVirtualizationBasedSecurity                                 = $False;
            DeviceGuardLaunchSystemGuard                                                 = "notConfigured";
            DeviceGuardLocalSystemAuthorityCredentialGuardSettings                       = "notConfigured";
            DeviceGuardSecureBootWithDMA                                                 = "notConfigured";
            DisplayName                                                                  = "test";
            DmaGuardDeviceEnumerationPolicy                                              = "deviceDefault";
            Ensure                                                                       = "Present";
            FirewallCertificateRevocationListCheckMethod                                 = "deviceDefault";
            FirewallIPSecExemptionsAllowDHCP                                             = $False;
            FirewallIPSecExemptionsAllowICMP                                             = $False;
            FirewallIPSecExemptionsAllowNeighborDiscovery                                = $False;
            FirewallIPSecExemptionsAllowRouterDiscovery                                  = $False;
            FirewallIPSecExemptionsNone                                                  = $False;
            FirewallPacketQueueingMethod                                                 = "deviceDefault";
            FirewallPreSharedKeyEncodingMethod                                           = "deviceDefault";
            FirewallProfileDomain                                                        = MSFT_MicrosoftGraphwindowsFirewallNetworkProfile{
                PolicyRulesFromGroupPolicyNotMerged = $False
                InboundNotificationsBlocked = $False
                OutboundConnectionsRequired = $False
                GlobalPortRulesFromGroupPolicyNotMerged = $False
                ConnectionSecurityRulesFromGroupPolicyNotMerged = $False
                UnicastResponsesToMulticastBroadcastsRequired = $False
                PolicyRulesFromGroupPolicyMerged = $False
                UnicastResponsesToMulticastBroadcastsBlocked = $False
                IncomingTrafficRequired = $False
                IncomingTrafficBlocked = $False
                ConnectionSecurityRulesFromGroupPolicyMerged = $False
                StealthModeRequired = $False
                InboundNotificationsRequired = $False
                AuthorizedApplicationRulesFromGroupPolicyMerged = $False
                InboundConnectionsBlocked = $False
                OutboundConnectionsBlocked = $False
                StealthModeBlocked = $False
                GlobalPortRulesFromGroupPolicyMerged = $False
                SecuredPacketExemptionBlocked = $False
                SecuredPacketExemptionAllowed = $False
                InboundConnectionsRequired = $False
                FirewallEnabled = 'allowed'
                AuthorizedApplicationRulesFromGroupPolicyNotMerged = $False
            };
            FirewallProfilePrivate                                                       = MSFT_MicrosoftGraphwindowsFirewallNetworkProfile{
                PolicyRulesFromGroupPolicyNotMerged = $False
                InboundNotificationsBlocked = $False
                OutboundConnectionsRequired = $False
                GlobalPortRulesFromGroupPolicyNotMerged = $False
                ConnectionSecurityRulesFromGroupPolicyNotMerged = $False
                UnicastResponsesToMulticastBroadcastsRequired = $False
                PolicyRulesFromGroupPolicyMerged = $False
                UnicastResponsesToMulticastBroadcastsBlocked = $False
                IncomingTrafficRequired = $False
                IncomingTrafficBlocked = $False
                ConnectionSecurityRulesFromGroupPolicyMerged = $False
                StealthModeRequired = $False
                InboundNotificationsRequired = $False
                AuthorizedApplicationRulesFromGroupPolicyMerged = $False
                InboundConnectionsBlocked = $False
                OutboundConnectionsBlocked = $False
                StealthModeBlocked = $False
                GlobalPortRulesFromGroupPolicyMerged = $False
                SecuredPacketExemptionBlocked = $False
                SecuredPacketExemptionAllowed = $False
                InboundConnectionsRequired = $False
                FirewallEnabled = 'allowed'
                AuthorizedApplicationRulesFromGroupPolicyNotMerged = $False
            };
            FirewallProfilePublic                                                        = MSFT_MicrosoftGraphwindowsFirewallNetworkProfile{
                PolicyRulesFromGroupPolicyNotMerged = $False
                InboundNotificationsBlocked = $False
                OutboundConnectionsRequired = $False
                GlobalPortRulesFromGroupPolicyNotMerged = $False
                ConnectionSecurityRulesFromGroupPolicyNotMerged = $False
                UnicastResponsesToMulticastBroadcastsRequired = $False
                PolicyRulesFromGroupPolicyMerged = $False
                UnicastResponsesToMulticastBroadcastsBlocked = $False
                IncomingTrafficRequired = $False
                IncomingTrafficBlocked = $False
                ConnectionSecurityRulesFromGroupPolicyMerged = $False
                StealthModeRequired = $False
                InboundNotificationsRequired = $False
                AuthorizedApplicationRulesFromGroupPolicyMerged = $False
                InboundConnectionsBlocked = $False
                OutboundConnectionsBlocked = $False
                StealthModeBlocked = $False
                GlobalPortRulesFromGroupPolicyMerged = $False
                SecuredPacketExemptionBlocked = $False
                SecuredPacketExemptionAllowed = $False
                InboundConnectionsRequired = $False
                FirewallEnabled = 'allowed'
                AuthorizedApplicationRulesFromGroupPolicyNotMerged = $False
            };
            FirewallRules                                                                = @(
                MSFT_MicrosoftGraphwindowsFirewallRule{
                    LocalAddressRanges = @()
                    Action = 'blocked'
                    InterfaceTypes = @(
                        'remoteAccess'
                        'wireless'
                        'lan'
                    )
                    RemotePortRanges = @()
                    DisplayName = 'test1'
                    TrafficDirection = 'in'
                    RemoteAddressRanges = @()
                    LocalPortRanges = @()
                    ProfileTypes = 'domain,private,public'
                    EdgeTraversal = 'notConfigured'
                }
            );
            Id                                                                           = "6025a216-2485-4ea8-9a0d-33c5e28b1184";
            LanManagerAuthenticationLevel                                                = "lmAndNltm";
            LanManagerWorkstationDisableInsecureGuestLogons                              = $False;
            LocalSecurityOptionsAdministratorElevationPromptBehavior                     = "notConfigured";
            LocalSecurityOptionsAllowAnonymousEnumerationOfSAMAccountsAndShares          = $False;
            LocalSecurityOptionsAllowPKU2UAuthenticationRequests                         = $False;
            LocalSecurityOptionsAllowRemoteCallsToSecurityAccountsManagerHelperBool      = $False;
            LocalSecurityOptionsAllowSystemToBeShutDownWithoutHavingToLogOn              = $False;
            LocalSecurityOptionsAllowUIAccessApplicationElevation                        = $False;
            LocalSecurityOptionsAllowUIAccessApplicationsForSecureLocations              = $False;
            LocalSecurityOptionsAllowUndockWithoutHavingToLogon                          = $False;
            LocalSecurityOptionsBlockMicrosoftAccounts                                   = $False;
            LocalSecurityOptionsBlockRemoteLogonWithBlankPassword                        = $False;
            LocalSecurityOptionsBlockRemoteOpticalDriveAccess                            = $False;
            LocalSecurityOptionsBlockUsersInstallingPrinterDrivers                       = $False;
            LocalSecurityOptionsClearVirtualMemoryPageFile                               = $False;
            LocalSecurityOptionsClientDigitallySignCommunicationsAlways                  = $False;
            LocalSecurityOptionsClientSendUnencryptedPasswordToThirdPartySMBServers      = $False;
            LocalSecurityOptionsDetectApplicationInstallationsAndPromptForElevation      = $False;
            LocalSecurityOptionsDisableAdministratorAccount                              = $False;
            LocalSecurityOptionsDisableClientDigitallySignCommunicationsIfServerAgrees   = $False;
            LocalSecurityOptionsDisableGuestAccount                                      = $False;
            LocalSecurityOptionsDisableServerDigitallySignCommunicationsAlways           = $False;
            LocalSecurityOptionsDisableServerDigitallySignCommunicationsIfClientAgrees   = $False;
            LocalSecurityOptionsDoNotAllowAnonymousEnumerationOfSAMAccounts              = $False;
            LocalSecurityOptionsDoNotRequireCtrlAltDel                                   = $False;
            LocalSecurityOptionsDoNotStoreLANManagerHashValueOnNextPasswordChange        = $False;
            LocalSecurityOptionsFormatAndEjectOfRemovableMediaAllowedUser                = "notConfigured";
            LocalSecurityOptionsHideLastSignedInUser                                     = $False;
            LocalSecurityOptionsHideUsernameAtSignIn                                     = $False;
            LocalSecurityOptionsInformationDisplayedOnLockScreen                         = "notConfigured";
            LocalSecurityOptionsInformationShownOnLockScreen                             = "notConfigured";
            LocalSecurityOptionsMinimumSessionSecurityForNtlmSspBasedClients             = "none";
            LocalSecurityOptionsMinimumSessionSecurityForNtlmSspBasedServers             = "none";
            LocalSecurityOptionsOnlyElevateSignedExecutables                             = $False;
            LocalSecurityOptionsRestrictAnonymousAccessToNamedPipesAndShares             = $False;
            LocalSecurityOptionsSmartCardRemovalBehavior                                 = "noAction";
            LocalSecurityOptionsStandardUserElevationPromptBehavior                      = "notConfigured";
            LocalSecurityOptionsSwitchToSecureDesktopWhenPromptingForElevation           = $False;
            LocalSecurityOptionsUseAdminApprovalMode                                     = $False;
            LocalSecurityOptionsUseAdminApprovalModeForAdministrators                    = $False;
            LocalSecurityOptionsVirtualizeFileAndRegistryWriteFailuresToPerUserLocations = $False;
            SmartScreenBlockOverrideForFiles                                             = $False;
            SmartScreenEnableInShell                                                     = $False;
            SupportsScopeTags                                                            = $True;
            WindowsDefenderTamperProtection                                              = "notConfigured";
            XboxServicesAccessoryManagementServiceStartupMode                            = "manual";
            XboxServicesEnableXboxGameSaveTask                                           = $False;
            XboxServicesLiveAuthManagerServiceStartupMode                                = "manual";
            XboxServicesLiveGameSaveServiceStartupMode                                   = "manual";
            XboxServicesLiveNetworkingServiceStartupMode                                 = "manual";
        }

Verbose logs showing the problem

Microsoft365DSC\MSFT_MicrosoftGraphwindowsFirewallRule : At least one of the values 'domain,private,public' is not supported or valid for property 'ProfileTypes' on class   'MSFT_MicrosoftGraphWindowsFirewallRule'. Please specify only supported values: notConfigured, domain, private, public.

Environment Information + PowerShell Version

Win11 / PS5.1