Get-MgBetaDeviceAppManagementTargetedManagedAppConfigurationSetting doesn't work and IntueAppConfigurationPolicy can't support 'Settings Catalogue' settings as a result.

[dannyKBjj]

Description of the issue

Trying to fix and update IntueAppConfigurationPolicy, but cannot retrieve

Get-MgBetaDeviceAppManagementTargetedManagedAppConfigurationSettingdoesn't work.

You can run the following code as a test...

<#
this will retrieve the policy. Strangley using the -TargetedManagedAppConfigurationId seems to also cause an error, so used 'Where-Object' to get my policy....
#>

$settingTest = Get-MgBetaDeviceAppManagementTargetedManagedAppConfiguration -ExpandProperty "Settings" | Where-Object {$_.Id -eq "{myMobileAppConfiguration-ID}"}

<#
I got this command from graph explorer https://graph.microsoft.com/beta/deviceAppManagement/targetedManagedAppConfigurations/{myMobileAppConfiguration-ID}/settings
#>

$test = Get-MgBetaDeviceAppManagementTargetedManagedAppConfigurationSetting -TargetedManagedAppConfigurationId $settingTest.Id

Expected: an object is returned that contains the information.

Actual Result: Instead of retrieving the information I get the error below. I've also tried the URI with invoke-mgGraph and get a similar error.... on another note, I'd expect Get-MgBetaDeviceAppManagementTargetedManagedAppConfiguration -ExpandProperty "Settings" to actually retrieve something, but the object's 'settings' property remains $null

Microsoft 365 DSC Version

1.25.122.1

Which workloads are affected

Intune

The DSC configuration

Verbose logs showing the problem

Get-MgBetaDeviceAppManagementTargetedManagedAppConfigurationSetting : {
  "_version": 3,
  "Message": "An internal server error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 5c573dbe-b76f-45de-a619-5535e1443c3b - Url: 
https://fef.msub06.manage.microsoft.com/MAMAdmin_2412/MAMAdminFEService/deviceAppManagement/targetedManagedAppConfigurations('{myMobileAppConfiguration-ID}')/settings?api-version=5024-02-26",
  "CustomApiErrorPhrase": "",
  "RetryAfter": null,
  "ErrorSourceService": "",
  "HttpHeaders": "{}"
}
Status: 500 (InternalServerError)
ErrorCode: InternalServerError
Date: 2025-01-26T18:06:03
Headers:
Transfer-Encoding             : chunked
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : 7085de08-126b-47c7-b032-ad64f336e7a1
client-request-id             : 5c573dbe-b76f-45de-a619-5535e1443c3b
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"UK South","Slice":"E","Ring":"5","ScaleUnit":"003","RoleInstance":"LO2PEPF0000332A"}}
Date                          : Sun, 26 Jan 2025 18:06:02 GMT
At line:1 char:1
+ Get-MgBetaDeviceAppManagementTargetedManagedAppConfigurationSetting - ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: ({ TargetedManag... , Headers =  }:<>f__AnonymousType83`10) [Get-MgBetaDevic...ionSetting_List], Exception
    + FullyQualifiedErrorId : InternalServerError,Microsoft.Graph.Beta.PowerShell.Cmdlets.GetMgBetaDeviceAppManagementTargetedManagedAppConfigurationSetting_List

Environment Information + PowerShell Version

[dannyKBjj]

also reported here: https://feedbackportal.microsoft.com/feedback/idea/f77feb49-11dc-ef11-95f6-0022484d7a88

[FabienTschanz]

@dannyKBjj I just opened a Microsoft Premier support ticket with my company. Will keep you posted what the result is.

[dannyKBjj]

That's amazing, thanks!

[FabienTschanz]

@dannyKBjj I got the following response after a couple of calls and mails:

Issue: Microsoft Graph / Intune - Cannot fetch app configuration policies with PowerShell
Cause: Throttling limits
Resolution: As discussed, the internal server error issue is due to throttling limits. The Azure team is currently working on this, and a fix is expected within a month. You will be informed about this through public articles and a panel notification in Intune.

The issue lies in the way the communication from PowerShell (external request) vs the Intune portal (integrated request) is done. The external request is load-balanced and passes through dlp configurations, whereas the integrated requests are forwarded straight to the service. There is an issue with how this is all balanced and will be addressed until next month. So we have to stay put for the moment and wait until further notice.

[dannyKBjj]

Thanks for the info!