Pipeline which takes DSC snapshots

[bartvermeersch]

I would be very much interested in having another pipeline in this solution which could run on a schedule and take a DSC snapshot of the tenants (using the secrets from the keyvault) and store it in the github repo so any changes could be tracked.

I gave it a try myself, but failed miserably so far ...

[ykuijs]

Great idea. I will have a look on how to best implement such a pipeline. Please share if you have ideas/suggestions.

[FabienTschanz]

@ykuijs A sample I'm using for an automated backup is the following (really simple):

pool:
  vmImage: windows-latest

variables:
- group: variables-prod

steps:
- checkout: self
  persistCredentials: true

- task: PowerShell@2
  displayName: Install Microsoft365DSC in Windows PowerShell
  inputs:
    targetType: inline
    script: |
      Install-PackageProvider -Name NuGet -Force -Scope AllUsers
      Install-Module -Name Microsoft.PowerShell.PSResourceGet -Scope AllUsers -Force
      Install-PSResource -Name "Microsoft365DSC" -Scope AllUsers -TrustRepository
      Update-M365DSCModule -Scope AllUsers
      [System.Environment]::SetEnvironmentVariable('M365DSCTelemetryEnabled', $false, [System.EnvironmentVariableTarget]::Machine)

- task: PowerShell@2
  displayName: Install modules in PowerShell 7
  inputs:
    targetType: inline
    pwsh: true
    script: |
      Update-M365DSCModule -Scope AllUsers

- task: PowerShell@2
  displayName: Export Intune Configuration
  inputs:
    targetType: inline
    pwsh: true
    script: |
      Export-M365DSCConfiguration -Workloads INTUNE -Path $ENV:REPO_DIR -ApplicationId $ENV:CLIENT_ID -ApplicationSecret $ENV:CLIENT_SECRET -TenantId $ENV:TENANT_NAME
  env:
    REPO_DIR: $(REPO_DIR)
    TENANT_NAME: $(TENANT_NAME)
    CLIENT_ID: $(CLIENT_ID)
    CLIENT_SECRET: $(CLIENT_SECRET)

- task: PowerShell@2
  displayName: Configure Git
  inputs:
    targetType: inline
    pwsh: true
    script: |
      git config --global user.name "intunebackup-prod"
      git config --global user.email "intunebackup-prod@azuredevops.local"

- task: PowerShell@2
  displayName: Commit changes
  inputs:
    targetType: inline
    pwsh: true
    script: |
      $branchName = "configs-$(Get-Date -Format "yyyy-MM-dd-HH-mm")"
      cd $ENV:REPO_DIR
      git checkout -b $branchName
      git add M365TenantConfig.ps1
      git commit -m "Update Intune export"
      git push --set-upstream origin $branchName

Given that this definitely can be improved, but for a first draft, this should be good enough.

[bartvermeersch]

Ideally it would fetch the certificates and the workloads/components to export from the configuration files. But this would require a considerable amount of refactoring.