Required confirmations before submitting
Issue Description
Description
The Configure MDM user scope standard fails across all tested customer tenants with the following error:
Microsoft.MobilityService: includedGroups: could not find key property 'id' in response object.
The issue appears to be related to the Graph request expanding includedGroups while selecting only displayName.
Current request used by the standard:
$expand=includedGroups($select=displayName)
Adding the group id to the select resolves the issue:
$expand=includedGroups($select=id,displayName)
Affected code
The current MDM Scope standard uses:
backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMScope.ps1
with:
$expand=includedGroups($select=displayName)
The MDM policy DB cache also appears to use the same expansion:
backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMobileDeviceManagementPolicies.ps1
with:
$expand=includedGroups($select=displayName)
Therefore, this may affect both the standard execution and the newer baseline/cache path.
Reproduction
This was reproduced using the CIPP ExecGraphRequestProfile diagnostic endpoint, allowing both tests to run from the same CIPP runtime and with the same tenant authentication context.
Test 1 - Current CIPP query
Parameters:
Endpoint:
policies/mobileDeviceManagementPolicies/0000000a-0000-0000-c000-000000000000
Version:
beta
$select:
termsOfUseUrl,discoveryUrl,complianceUrl,appliesTo
$expand:
includedGroups($select=displayName)
Result:
HTTP 500 Internal Server Error
Response status code does not indicate success:
500 (Internal Server Error).
This is consistent with the error generated when the MDM User Scope standard runs:
Microsoft.MobilityService:
includedGroups: could not find key property 'id' in response object.
Test 2 - Same request with group id included
The only change was:
$expand:
includedGroups($select=id,displayName)
Result:
The CIPP profiler successfully completed all three request paths:
DirectInvokeRestMethod ResultCount=1
PooledCIPPRestMethod ResultCount=1
GetGraphRequestList ResultCount=1
This indicates that the request succeeds through the direct REST path, the pooled CIPP REST client, and the Graph request wrapper when id is included.
Additional validation
The Graph request was also tested independently using Microsoft Graph PowerShell.
The following query succeeds interactively:
$uri = 'https://graph.microsoft.com/beta/policies/mobileDeviceManagementPolicies/0000000a-0000-0000-c000-000000000000?$select=termsOfUseUrl,discoveryUrl,complianceUrl,appliesTo&$expand=includedGroups($select=displayName)'
Invoke-MgGraphRequest -Method GET -Uri $uri
It returns a valid MDM policy, with includedGroups empty in the tested case.
However, when the equivalent request is executed through the CIPP runtime/authentication path, selecting only displayName results in the MobilityService error.
Adding id makes the same request succeed through CIPP.
Scope
This does not appear to be tenant-specific.
The MDM User Scope standard fails with the same error across multiple customer tenants tested in the same CIPP instance.
A single tenant was then used with ExecGraphRequestProfile to isolate and reproduce the behavior described above.
Expected behavior
The MDM User Scope standard should retrieve the current MDM scope and evaluate the standard without error.
Proposed fix
Change:
includedGroups($select=displayName)
to:
includedGroups($select=id,displayName)
At minimum, the same pattern appears in:
backend/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMScope.ps1
and:
backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMobileDeviceManagementPolicies.ps1
Existing consumers can continue using includedGroups.displayName. Including id should not otherwise change the standard logic.
Environment Type
Non-sponsored user
Front End Version
1.9.0
Back End Version
1.9.0
Relevant Logs / Stack Trace
Required confirmations before submitting
Issue Description
Description
The Configure MDM user scope standard fails across all tested customer tenants with the following error:
The issue appears to be related to the Graph request expanding
includedGroupswhile selecting onlydisplayName.Current request used by the standard:
Adding the group
idto the select resolves the issue:Affected code
The current MDM Scope standard uses:
with:
The MDM policy DB cache also appears to use the same expansion:
with:
Therefore, this may affect both the standard execution and the newer baseline/cache path.
Reproduction
This was reproduced using the CIPP
ExecGraphRequestProfilediagnostic endpoint, allowing both tests to run from the same CIPP runtime and with the same tenant authentication context.Test 1 - Current CIPP query
Parameters:
Result:
This is consistent with the error generated when the MDM User Scope standard runs:
Test 2 - Same request with group id included
The only change was:
Result:
The CIPP profiler successfully completed all three request paths:
This indicates that the request succeeds through the direct REST path, the pooled CIPP REST client, and the Graph request wrapper when
idis included.Additional validation
The Graph request was also tested independently using Microsoft Graph PowerShell.
The following query succeeds interactively:
It returns a valid MDM policy, with
includedGroupsempty in the tested case.However, when the equivalent request is executed through the CIPP runtime/authentication path, selecting only
displayNameresults in the MobilityService error.Adding
idmakes the same request succeed through CIPP.Scope
This does not appear to be tenant-specific.
The MDM User Scope standard fails with the same error across multiple customer tenants tested in the same CIPP instance.
A single tenant was then used with
ExecGraphRequestProfileto isolate and reproduce the behavior described above.Expected behavior
The MDM User Scope standard should retrieve the current MDM scope and evaluate the standard without error.
Proposed fix
Change:
to:
At minimum, the same pattern appears in:
and:
Existing consumers can continue using
includedGroups.displayName. Includingidshould not otherwise change the standard logic.Environment Type
Non-sponsored user
Front End Version
1.9.0
Back End Version
1.9.0
Relevant Logs / Stack Trace