EXOGroupSettings: Configuration Drift Loop - GUID vs SMTP Address Mismatch

[SNikalaichyk]

Description of the issue

Issue

EXOGroupSettings returns GUIDs instead of SMTP addresses because Get-UnifiedGroup cmdlet is not using the -Include*WithDisplayNames switch parameters.

Root Cause

The module calls Get-UnifiedGroup without the following parameters:

• IncludeAcceptMessagesOnlyFromSendersOrMembersWithDisplayNames
• IncludeBypassModerationFromSendersOrMembersWithDisplayNames
• IncludeGrantSendOnBehalfToWithDisplayNames
• IncludeModeratedByWithDisplayNames
• IncludeRejectMessagesFromSendersOrMembersWithDisplayNames

This causes GUID values to be returned instead of SMTP addresses, causing repeated false positive drift detection when configuration specifies SMTP addresses.

Example ConfigurationDrift event payload:

<ConfigurationDrift Source="MSFT_EXOGroupSettings" TenantId="contoso.onmicrosoft.com">
    <ParametersNotInDesiredState>
        <Param Name="ModeratedBy">
            <CurrentValue>8a1b2c3d-4e5f-6789-abcd-ef1234567890 9f8e7d6c-5b4a-3918-2765-4321fedcba09</CurrentValue>
            <DesiredValue>user1@contoso.com user2@contoso.com</DesiredValue>
        </Param>
        <Param Name="AcceptMessagesOnlyFromSendersOrMembers">
            <CurrentValue>8a1b2c3d-4e5f-6789-abcd-ef1234567890 9f8e7d6c-5b4a-3918-2765-4321fedcba09</CurrentValue>
            <DesiredValue>user1@contoso.com user2@contoso.com</DesiredValue>
        </Param>
    </ParametersNotInDesiredState>
</ConfigurationDrift>

Solution

Update EXOGroupSettings to specify -Include*WithDisplayNames parameters when calling Get-UnifiedGroup.

Reference: Get-UnifiedGroup documentation

Impact

Repeated false positive drift detections and unnecessary remediation attempts.

Microsoft 365 DSC Version

v1.25.1015.1

Which workloads are affected

Exchange Online

The DSC configuration

Verbose logs showing the problem

Environment Information + PowerShell Version

[FabienTschanz]

Thanks for submitting the feedback. I'm currently working on it, but it requires us to do some lookups if the configuration contains a Guid instead of an SMTP address. Will keep you updated on how it goes.

[SNikalaichyk]

To maintain backwards compatibility, you could implement a new property (perhaps called IdentifierType) with a validate set of Guid, DisplayName, SmtpAddress, where Guid is the default value.

[FabienTschanz]

We don‘t usually add properties to the resource that are not directly related to the state of the resource. There will be another method used to check them. Working on it, but without a timeline for now.