Settings Catalog resources not working with 1.24.828.1

[ricmestre]

Description of the issue

Settings Catalog resources that call Get-IntuneSettingCatalogPolicySetting don't work correctly, this problem was introduced on PR #4962 and occurs when trying to create a new resource at the 1st attempt, the next attempt for some reason then works. This can be reproduced every time by just removing the existing policy and trying to recreate it.

@FabienTschanz First the foreach on Get-IntuneSettingCatalogPolicySettingDSCValue seems to loop several times over the same keys so somehow $global:excludedDscParams is not being updated correctly or at least not in all places it should be, then on the first loop all properties seem to work but on subsequent loops (which probably shouldn't run since it looks like they were processed) it always fails on last property UseAdvancedProtectionAgainstRansomware (using the attached blueprint). The problem occurs following this path:

Get-IntuneSettingCatalogPolicySetting
|-->Get-IntuneSettingCatalogPolicySettingInstanceValue
    |-->Get-IntuneSettingCatalogPolicySettingDSCValue

This then goes back to Get-IntuneSettingCatalogPolicySettingInstanceValue and fails on $SettingValueType = $valuesResult.SettingDefinition.AdditionalProperties.valueDefinition.'@odata.type'.Replace('Definition', '') because the returned value of $valuesResults is $null.

You cannot call a method on a null-valued expression.
+ CategoryInfo          : InvalidOperation: (:) [], CimException
FullyQualifiedErrorId : InvokeMethodOnNull
PSComputerName        : localhost

Could you please have a look into this?

Microsoft 365 DSC Version

1.24.828.1

Which workloads are affected

Intune

The DSC configuration

IntuneAttackSurfaceReductionRulesPolicyWindows10ConfigManager "IntuneAttackSurfaceReductionRulesPolicyWindows10ConfigManager-IntuneAttackSurfaceReductionRulesPolicyWindows10ConfigManager_1"
        {
            Assignments                                                                = @();
            blockabuseofexploitedvulnerablesigneddrivers                               = "block";
            blockadobereaderfromcreatingchildprocesses                                 = "block";
            blockallofficeapplicationsfromcreatingchildprocesses                       = "block";
            blockcredentialstealingfromwindowslocalsecurityauthoritysubsystem          = "block";
            blockexecutablecontentfromemailclientandwebmail                            = "block";
            blockexecutablefilesrunningunlesstheymeetprevalenceagetrustedlistcriterion = "block";
            blockexecutionofpotentiallyobfuscatedscripts                               = "block";
            blockjavascriptorvbscriptfromlaunchingdownloadedexecutablecontent          = "block";
            blockofficeapplicationsfromcreatingexecutablecontent                       = "block";
            blockofficeapplicationsfrominjectingcodeintootherprocesses                 = "block";
            blockofficecommunicationappfromcreatingchildprocesses                      = "block";
            blockpersistencethroughwmieventsubscription                                = "block";
            blockprocesscreationsfrompsexecandwmicommands                              = "block";
            blockuntrustedunsignedprocessesthatrunfromusb                              = "block";
            blockwin32apicallsfromofficemacros                                         = "block";
            Credential                                                                 = $CredsCredential;
            Description                                                                = "IntuneAttackSurfaceReductionRulesPolicyWindows10ConfigManager_1";
            DisplayName                                                                = "IntuneAttackSurfaceReductionRulesPolicyWindows10ConfigManager_1";
            Ensure                                                                     = "Present";
            Identity                                                                   = "f6d1d1bc-d78f-4a5a-8f1b-0d95a60b0bc1";
            useadvancedprotectionagainstransomware                                     = "block";
        }

Verbose logs showing the problem

You cannot call a method on a null-valued expression.
+ CategoryInfo          : InvalidOperation: (:) [], CimException
FullyQualifiedErrorId : InvokeMethodOnNull
PSComputerName        : localhost

Environment Information + PowerShell Version

Win11 / PS5

[FabienTschanz]

@ricmestre On it, thanks for letting me know. I tested that thing rigorously and thought I found all issues, but apparently not...

[FabienTschanz]

@ricmestre Found it, a simple null check was missing... Lucky for me I thought to abstract that stuff quite a bit, so that it's easy to fix. I guess I always tested it by accident with a value on these properties.