Add Conditional Access disableResilienceDefaults

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Change log for Microsoft365DSC
 
+# UNRELEASED
+* AADConditionalAccessPolicy
+  * Add disableResilienceDefaults
+
 # 1.24.1218.1
 
 * AADApplication

Modules/Microsoft365DSC/DSCResources/MSFT_AADConditionalAccessPolicy/MSFT_AADConditionalAccessPolicy.psm1

@@ -199,6 +199,10 @@ function Get-TargetResource
         [System.Boolean]
         $PersistentBrowserIsEnabled,
 
+        [Parameter()]
+        [System.Boolean]
+        $DisableResilienceDefaultsIsEnabled,
+
         [Parameter()]
         [System.String]
         $TermsOfUse,
@@ -706,6 +710,8 @@ function Get-TargetResource
         SignInFrequencyInterval                  = $SignInFrequencyIntervalValue
         #no translation needed
         PersistentBrowserIsEnabled               = $false -or $Policy.SessionControls.PersistentBrowser.IsEnabled
+        #no translation needed
+        DisableResilienceDefaultsIsEnabled       = $false -or $Policy.SessionControls.disableResilienceDefaults.IsEnabled
         #make false if undefined, true if true
         PersistentBrowserMode                    = [System.String]$Policy.SessionControls.PersistentBrowser.Mode
         #no translation needed
@@ -929,6 +935,10 @@ function Set-TargetResource
         [System.Boolean]
         $PersistentBrowserIsEnabled,
 
+        [Parameter()]
+        [System.Boolean]
+        $DisableResilienceDefaultsIsEnabled,
+
         [Parameter()]
         [System.String]
         $TermsOfUse,
@@ -1735,7 +1745,7 @@ function Set-TargetResource
             $NewParameters.Add('grantControls', $GrantControls)
         }
 
-        if ($ApplicationEnforcedRestrictionsIsEnabled -or $CloudAppSecurityIsEnabled -or $SignInFrequencyIsEnabled -or $PersistentBrowserIsEnabled)
+        if ($ApplicationEnforcedRestrictionsIsEnabled -or $CloudAppSecurityIsEnabled -or $SignInFrequencyIsEnabled -or $PersistentBrowserIsEnabled -or $DisableResilienceDefaultsIsEnabled)
         {
             Write-Verbose -Message 'Set-Targetresource: process session controls'
             $sessioncontrols = $null
@@ -1802,6 +1812,10 @@ function Set-TargetResource
                 $sessioncontrols.persistentBrowser.isEnabled = $true
                 $sessioncontrols.persistentBrowser.mode = $PersistentBrowserMode
             }
+            if ($DisableResilienceDefaultsIsEnabled)
+            {
+                $sessioncontrols.Add('disableResilienceDefaults', $true)
+            }
             $NewParameters.Add('sessionControls', $sessioncontrols)
             #add SessionControls to the parameter list
         }
@@ -2087,6 +2101,10 @@ function Test-TargetResource
         [System.Boolean]
         $PersistentBrowserIsEnabled,
 
+        [Parameter()]
+        [System.Boolean]
+        $disableResilienceDefaults,
+
         [Parameter()]
         [System.String]
         $TermsOfUse,

Modules/Microsoft365DSC/DSCResources/MSFT_AADConditionalAccessPolicy/MSFT_AADConditionalAccessPolicy.schema.mof

@@ -47,6 +47,7 @@ class MSFT_AADConditionalAccessPolicy : OMI_BaseResource
     [Write, Description("Sign in frequency interval. Possible values are: timeBased, everyTime and unknownFutureValue."), ValueMap{"timeBased","everyTime","unknownFutureValue"}, Values{"timeBased","everyTime","unknownFutureValue"}] String SignInFrequencyInterval;
     [Write, Description("Specifies, whether Browser Persistence is controlled by the Policy.")] Boolean PersistentBrowserIsEnabled;
     [Write, Description("Specifies, what Browser Persistence control is enforced by the Policy."), ValueMap{"Always","Never",""}, Values{"Always","Never",""}] String PersistentBrowserMode;
+    [Write, Description("Specifies, if DisableResilienceDefaults is enabled.")] Boolean DisableResilienceDefaultsIsEnabled;
     [Write, Description("Name of the associated authentication strength policy.")] String AuthenticationStrength;
     [Write, Description("Names of the associated authentication flow transfer methods. Possible values are '', 'deviceCodeFlow', 'authenticationTransfer', or 'deviceCodeFlow,authenticationTransfer'.")] String TransferMethods;
     [Write, Description("Authentication context class references.")] String AuthenticationContexts[];
@@ -60,4 +61,3 @@ class MSFT_AADConditionalAccessPolicy : OMI_BaseResource
     [Write, Description("Managed ID being used for authentication.")] Boolean ManagedIdentity;
     [Write, Description("Access token used for authentication.")] String AccessTokens[];
 };
-

Modules/Microsoft365DSC/SchemaDefinition.json

@@ -3522,6 +3522,11 @@
                                "Name":  "PersistentBrowserMode",
                                "Option":  "Write"
                            },
+                           {
+                               "CIMType":  "Boolean",
+                               "Name":  "DisableResilienceDefaultsIsEnabled",
+                               "Option":  "Write"
+                           },
                            {
                                "CIMType":  "String",
                                "Name":  "AuthenticationStrength",

Tests/Unit/Microsoft365DSC/Microsoft365DSC.AADConditionalAccessPolicy.Tests.ps1

@@ -83,6 +83,7 @@ Describe -Name $Global:DscHelper.DescribeHeader -Fixture {
                     IncludeGuestOrExternalUserTypes      = @('b2bCollaborationGuest')
                     PersistentBrowserIsEnabled           = $True
                     PersistentBrowserMode                = 'Always'
+                    DisableResilienceDefaultsIsEnabled   = $True
                     SignInFrequencyIsEnabled             = $True
                     SignInFrequencyType                  = 'Days'
                     SignInFrequencyValue                 = 5
@@ -178,6 +179,7 @@ Describe -Name $Global:DscHelper.DescribeHeader -Fixture {
                     IncludeGuestOrExternalUserTypes          = @('b2bCollaborationGuest')
                     PersistentBrowserIsEnabled               = $True
                     PersistentBrowserMode                    = 'Always'
+                    DisableResilienceDefaultsIsEnabled       = $True
                     SignInFrequencyIsEnabled                 = $True
                     SignInFrequencyType                      = 'Days'
                     SignInFrequencyValue                     = 5
@@ -450,6 +452,7 @@ Describe -Name $Global:DscHelper.DescribeHeader -Fixture {
                     IncludeGuestOrExternalUserTypes          = @('b2bCollaborationGuest')
                     PersistentBrowserIsEnabled               = $True
                     PersistentBrowserMode                    = 'Always'
+                    DisableResilienceDefaultsIsEnabled       = $True
                     SignInFrequencyIsEnabled                 = $True
                     SignInFrequencyType                      = 'Days'
                     SignInFrequencyValue                     = 5
@@ -615,6 +618,7 @@ Describe -Name $Global:DscHelper.DescribeHeader -Fixture {
                     IncludeUsers                             = 'All'
                     PersistentBrowserIsEnabled               = $True
                     PersistentBrowserMode                    = 'Always'
+                    DisableResilienceDefaultsIsEnabled       = $True
                     SignInFrequencyIsEnabled                 = $True
                     SignInFrequencyType                      = 'Days'
                     SignInFrequencyValue                     = 5

docs/docs/resources/azure-ad/AADConditionalAccessPolicy.md

@@ -50,6 +50,7 @@
 | **SignInFrequencyInterval** | Write | String | Sign in frequency interval. Possible values are: timeBased, everyTime and unknownFutureValue. | `timeBased`, `everyTime`, `unknownFutureValue` |
 | **PersistentBrowserIsEnabled** | Write | Boolean | Specifies, whether Browser Persistence is controlled by the Policy. | |
 | **PersistentBrowserMode** | Write | String | Specifies, what Browser Persistence control is enforced by the Policy. | `Always`, `Never`, `` |
+| **DisableResilienceDefaultsIsEnabled** | Write | Boolean | Specifies, if DisableResilienceDefaults is enabled. | |
 | **AuthenticationStrength** | Write | String | Name of the associated authentication strength policy. | |
 | **TransferMethods** | Write | String | Names of the associated authentication flow transfer methods. Possible values are '', 'deviceCodeFlow', 'authenticationTransfer', or 'deviceCodeFlow,authenticationTransfer'. | |
 | **AuthenticationContexts** | Write | StringArray[] | Authentication context class references. | |