Get Device Assignment Targets Return Empty Objects

[tyler-the-freeman]

Thanks for reporting the bug. Please ensure you've gone through the following checklist before opening an issue:

• Make sure you can reproduce this issue using the latest released version of Microsoft.Graph or Microsoft.Graph.Beta.
• Please search the existing issues to see if there has been a similar issue filed.
• For issues related to authentication and service errors, please refer to our troubleshooting guide. For service issues, please open a question at https://developer.microsoft.com/graph/support.

Describe the bug
Running the Powershell commands to get assignment targets for Intune devices (apps, compliance policies etc.) return an object with no properties. The commands appear to return the empty base class (deviceAndAppManagementAssignmentTarget) rather than the type of the target (for example groupAssignmentTarget, which is a child of deviceAndAppManagementAssignmentTarget). It correctly responds with the ID of the assignment target object but the object itself has no properties, meaning there is no way see what anything is actually assigned to.

Running the equivalent commands directly to the Graph API over HTTP respond with the correct object type.

To Reproduce
Steps to reproduce the behavior:

1. Execute Get-MgDeviceManagementDeviceCompliancePolicyAssignment with -DeviceCompliancePolicyId $compliancePolicyId
2. See error at ... (No Error, there is a response)

Expected behavior
Get-MgDeviceManagementDeviceCompliancePolicyAssignment should respond with a collection of objects inheriting from deviceAndAppManagementAssignmentTarget (groupAssignmentTarget) which include additional information specifying what the compliance policy is assigned to.

Debug Output

DEBUG: [CmdletBeginProcessing]: - Get-MgDeviceManagementDeviceCompliancePolicyAssignment begin processing with parameterSet 'List'.
DEBUG: [Authentication]: - AuthType: 'AppOnly', TokenCredentialType: 'ClientCertificate', ContextScope: 'Process', AppName: 'GraphAPI to Manage Group and Device Data (Intune, Autopilot)'.
DEBUG: [Authentication]: - Scopes: [Device.ReadWrite.All, Group.ReadWrite.All, User.Read.All, DeviceManagementServiceConfig.ReadWrite.All, DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementConfiguration.ReadWrite.All].
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies/b047bb1e-523a-4145-b268-0c777018f1eb/assignments

Headers:
FeatureFlag                   : 00000043
Cache-Control                 : no-store, no-cache
User-Agent                    : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.19045; en-US),PowerShell/2023.8.0
Accept-Encoding               : gzip
SdkVersion                    : graph-powershell/2.9.0
client-request-id             : cd5fd498-4a05-4025-8ef5-5dfc7be6c864

Body:



DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Transfer-Encoding             : chunked
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : dd0630dc-a4e1-49e8-bb5b-3d177058ed81
client-request-id             : cd5fd498-4a05-4025-8ef5-5dfc7be6c864
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"Central US","Slice":"E","Ring":"2","ScaleUnit":"001","RoleInstance":"DS2PEPF000009B1"}}
OData-Version                 : 4.0
Date                          : Thu, 16 Nov 2023 17:32:10 GMT

Body:
{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#deviceManagement/deviceCompliancePolicies('b047bb1e-523a-4145-b268-0c777018f1eb')/assignments",
  "value": [
    {
      "id": "b047bb1e-523a-4145-b268-0c777018f1eb_b09fd5d7-1892-4117-bc5a-2ca3bf743deb",
      "target": {
        "@odata.type": "#microsoft.graph.groupAssignmentTarget",
        "groupId": "b09fd5d7-1892-4117-bc5a-2ca3bf743deb"
      }
    },
    {
      "id": "b047bb1e-523a-4145-b268-0c777018f1eb_e59c52ea-1d04-4d8a-9cea-5d84b5b0ece8",
      "target": {
        "@odata.type": "#microsoft.graph.groupAssignmentTarget",
        "groupId": "e59c52ea-1d04-4d8a-9cea-5d84b5b0ece8"
      }
    }
  ]
}


DEBUG: [CmdletEndProcessing]: - Get-MgDeviceManagementDeviceCompliancePolicyAssignment end processing.

Module Version

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     2.9.0                 Microsoft.Graph.Authentication      {Add-MgEnvironment, Connect-MgGraph, Disconnect-MgGraph, Get-MgContext…}
Script     2.9.0                 Microsoft.Graph.DeviceManagement    {Get-MgAdminEdge, Get-MgAdminEdgeInternetExplorerMode, Get-MgAdminEdgeInternetExplorerModeSiteList, Get-MgAdminEdgeInternetExplorlorerModeSiteList, Get-MgAdminEdgeInternetExplorerModeSiteListCount…}
Script     2.9.0                 Microsoft.Graph.Devices.CorporateM… {Get-MgDeviceAppManagement, Get-MgDeviceAppManagementAndroidManagedAppProtection, Get-MgDeviceAppManagementAndroidManagedAppProte Get-MgDeviceAppManagementAndroidManagedAppProtectionApp, Get-MgDeviceAppMan…                                                                                                                         erModeSiteListCount…}
Script     2.9.0                 Microsoft.Graph.Groups              {Add-MgGroupDriveListContentTypeCopy, Add-MgGroupDriveListContentTypeCopyFromContentTypeHub, Add-MgGroupFavorite, Add-MgGroupSitectionApp, Get-MgDeviceAppMan… entTypeHub, Add-MgGroupFavorite, Add-MgGroupSite…}     

Environment Data

Name                           Value
----                           -----
PSVersion                      7.3.9
PSEdition                      Core
GitCommitId                    7.3.9
OS                             Microsoft Windows 10.0.19045
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Screenshots
Command run in powershell:

Equivalent HTTP call to Graph:

Additional context
The debug output shows the object types correctly being returned as groupAssignmentTarget when the command calls the endpoint. It pulls the ID out of the response correctly, but "Target" becomes Microsoft.Graph.PowerShell.Models.MicrosoftGraphDeviceAndAppManagementAssignmentTarget. My assumption is that this should be something like Microsoft.Graph.PowerShell.Models.MicrosoftGraphGroupAssignmentTarget? If this is intended behavior, how am I supposed to use the Microsoft.Graph.PowerShell.Models.MicrosoftGraphDeviceAndAppManagementAssignmentTarget? There doesn't appear to be a way to use this object (or its ID) to get any info about what things are actually assigned to.

[timayabi2020]

Hi @tyler-the-freeman ,
I reproduced the issue but added the -ExandpandProperty target to modify the graph request to something like this "https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies//assignments?$expand=target" expecting the target property to be expanded. Unfortunately, the service is not able to expand that and so the SDK cannot do the same. (See image below)

Therefore, this seems to be an API related issue and we are not best placed to give an answer. Kindly raise an issue here https://developer.microsoft.com/en-us/graph/support so that the API owner can respond to it.

However, you can use Invoke-MgGraphRequest to get through to the object contents.
For example: $result= Invoke-MgGraphRequest -Method GET -OutputType HashTable -Uri "https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies/<ID>/assignments"

[microsoft-github-policy-service]

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 4 days. It will be closed if no further activity occurs within 3 days of this comment.