IntuneAppProtectionPolicyAndroid: Stopped working because of Assignments and ExcludedGroups

[ricmestre]

Description of the issue

@NikCharlebois Looks like you made some changes to the Assignments and ExcludedGroups in IntuneAppProtectionPolicyAndroid in order to support display names instead of ids but now I can't make deployments with it, the exports has the display names but trying to deploy a new policy or update an existing one results in error.

Microsoft 365 DSC Version

1.25.122.1

Which workloads are affected

Intune

The DSC configuration

IntuneAppProtectionPolicyAndroid "IntuneAppProtectionPolicyAndroid-IntuneAppProtectionPolicyAndroid_1"
        {
            AllowedDataStorageLocations                     = @("oneDriveForBusiness","sharePoint");
            AllowedInboundDataTransferSources               = "managedApps";
            AllowedOutboundClipboardSharingLevel            = "managedAppsWithPasteIn";
            AllowedOutboundDataTransferDestinations         = "managedApps";
            AppGroupType                                    = "selectedPublicApps";
            Apps                                            = @("com.adobe.reader","com.citrix.sharefile.intune","com.microsoft.cortana","com.microsoft.dynamics.invoice","com.microsoft.emmx","com.microsoft.exchange.bookings","com.microsoft.ipviewer","com.microsoft.launcher","com.microsoft.mobile.polymer","com.microsoft.msapps","com.microsoft.office.excel","com.microsoft.office.lync15","com.microsoft.office.onenote","com.microsoft.office.outlook","com.microsoft.office.powerpoint","com.microsoft.office.word","com.microsoft.planner","com.microsoft.powerbim","com.microsoft.sharepoint","com.microsoft.skydrive","com.microsoft.stream","com.microsoft.teams","com.microsoft.todos","com.microsoft.workfolders","com.ninefolders.hd3.work.intune","com.printeron.droid.phone.intune","com.yammer.v1","ols.microsoft.com.shiftr");
            Assignments                                     = @("DummyGroupInclude");
            ContactSyncBlocked                              = $False;
            Credential                                      = $Credscredential;
            CustomBrowserDisplayName                        = "";
            CustomBrowserPackageId                          = "";
            DataBackupBlocked                               = $True;
            Description                                     = "";
            DeviceComplianceRequired                        = $True;
            DisableAppEncryptionIfDeviceEncryptionIsEnabled = $False;
            DisableAppPinIfDevicePinIsSet                   = $False;
            DisplayName                                     = "IntuneAppProtectionPolicyAndroid_1";
            EncryptAppData                                  = $True;
            Ensure                                          = "Present";
            ExcludedGroups                                  = @("DummyGroupExclude");
            FingerprintBlocked                              = $False;
            Id                                              = "T_964e08e7-f352-4c57-9c9f-2f9bbbf50504";
            ManagedBrowser                                  = "microsoftEdge";
            ManagedBrowserToOpenLinksRequired               = $True;
            MaximumPinRetries                               = 5;
            MinimumPinLength                                = 6;
            MinimumRequiredPatchVersion                     = "0000-00-00";
            MinimumWarningPatchVersion                      = "0000-00-00";
            OrganizationalCredentialsRequired               = $False;
            PeriodBeforePinReset                            = "00:00:00";
            PeriodOfflineBeforeAccessCheck                  = "12:00:00";
            PeriodOfflineBeforeWipeIsEnforced               = "90.00:00:00";
            PeriodOnlineBeforeAccessCheck                   = "00:30:00";
            PinCharacterSet                                 = "numeric";
            PinRequired                                     = $True;
            PrintBlocked                                    = $True;
            RequireClass3Biometrics                         = $False;
            RequirePinAfterBiometricChange                  = $False;
            SaveAsBlocked                                   = $True;
            ScreenCaptureBlocked                            = $True;
            SimplePinBlocked                                = $False;
        }

Verbose logs showing the problem

VERBOSE: [REDACTED]:                            [[IntuneAppProtectionPolicyAndroid]IntuneAppProtectionPolicyAndroid-IntuneAppProtectionPolicyAndroid_1] Updating existing Android App Protection Policy                                   {IntuneAppProtectionPolicyAndroid_1}
VERBOSE: [REDACTED]:                            [[IntuneAppProtectionPolicyAndroid]IntuneAppProtectionPolicyAndroid-IntuneAppProtectionPolicyAndroid_1] id in configuration document and returned policy do not match - updating policy   with matching Displayname {IntuneAppProtectionPolicyAndroid_1} - ID {T_46a26dd4-ec2d-4b75-94fe-f1a6817242fe}
VERBOSE: [REDACTED]:                            [[IntuneAppProtectionPolicyAndroid]IntuneAppProtectionPolicyAndroid-IntuneAppProtectionPolicyAndroid_1] Setting Group Assignments with values:
[
 "            {\r\n            \"id\":\"b0b8fd3f-af2a-453b-be57-80182d599f02_incl\",\r\n            \"target\": {\r\n                        \"@odata.type\": \"#microsoft.graph.groupAssignmentTarget\",\r\n
\"groupId\": \"b0b8fd3f-af2a-453b-be57-80182d599f02\"\r\n                    }\r\n            }",
"            {\r\n            \"id\":\"DummyGroupExclude_excl\",\r\n            \"target\": {\r\n                        \"@odata.type\": \"#microsoft.graph.exclusionGroupAssignmentTarget\",\r\n
\"groupId\":    \"DummyGroupExclude\"\r\n                    }\r\n            }"
[BadRequest] :
{
 "_version": 3,
"Message": "Invalid group id - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: ad644a31-1055-4a74-8b30-b9db904405be - Url:
https://fef.msub07.manage.microsoft.com/MAMAdmin_2412/MAMAdminFEService/deviceAppManagement/targetedManagedAppConfigurations('T_46a26dd4-ec2d-4b75-94fe-f1a6817242fe')/microsoft.management.services.api.assign?api-version=5024-02-26",        "CustomApiErrorPhrase": "",
"RetryAfter": null,
"ErrorSourceService": "",
"HttpHeaders":
"{}"
 }
+ CategoryInfo          : InvalidOperation: ({ TargetedManag...ionJsonSchema }:) [], CimException
+ FullyQualifiedErrorId : BadRequest,Microsoft.Graph.Beta.PowerShell.Cmdlets.SetMgBetaDeviceAppManagementTargetedManagedAppConfiguration_AssignExpanded
+ PSComputerName        : localhost

Environment Information + PowerShell Version

Win11/PS5.1