AADAuthorizationPolicy

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
IsSingleInstance	Key	String	Only valid value is 'Yes'.	Yes
DisplayName	Write	String	Display name for this policy.
Description	Write	String	Description of this policy.
AllowedToSignUpEmailBasedSubscriptions	Write	Boolean	Boolean Indicates whether users can sign up for email based subscriptions.
AllowedToUseSSPR	Write	Boolean	Boolean Indicates whether the Self-Serve Password Reset feature can be used by users on the tenant.
AllowEmailVerifiedUsersToJoinOrganization	Write	Boolean	Boolean Indicates whether a user can join the tenant by email validation.
AllowInvitesFrom	Write	String	Indicates who can invite external users to the organization. Possible values are: None, AdminsAndGuestInviters, AdminsGuestInvitersAndAllMembers, Everyone. Everyone is the default setting for all cloud environments except US Government.	None, AdminsAndGuestInviters, AdminsGuestInvitersAndAllMembers, Everyone
BlockMsolPowershell	Write	Boolean	Boolean To disable the use of MSOL PowerShell, set this property to true. This will also disable user-based access to the legacy service endpoint used by MSOL PowerShell. This does not affect Azure AD Connect or Microsoft Graph.
DefaultUserRoleAllowedToCreateApps	Write	Boolean	Boolean Indicates whether the default user role can create applications.
DefaultUserRoleAllowedToCreateSecurityGroups	Write	Boolean	Boolean Indicates whether the default user role can create security groups.
DefaultUserRoleAllowedToReadBitlockerKeysForOwnedDevice	Write	Boolean	Indicates whether the registered owners of a device can read their own BitLocker recovery keys with default user role.
DefaultUserRoleAllowedToCreateTenants	Write	Boolean	Indicates whether the default user role can create tenants. This setting corresponds to the Restrict non-admin users from creating tenants setting in the User settings menu in the Azure portal. When this setting is false, users assigned the Tenant Creator role can still create tenants.
DefaultUserRoleAllowedToReadOtherUsers	Write	Boolean	Boolean Indicates whether the default user role can read other users.
GuestUserRole	Write	String	The role that should be granted to guest users. Refer to List unifiedRoleDefinitions to find the list of available role templates. Only supported roles today are User, Guest User, and Restricted Guest User (2af84b1e-32c8-42b7-82bc-daa82404023b).	Guest, RestrictedGuest, User
PermissionGrantPolicyIdsAssignedToDefaultUserRole	Write	StringArray[]	String collection Indicates if user consent to apps is allowed, and if it is, which permission to grant consent and which app consent policy (permissionGrantPolicy) govern the permission for users to grant consent. Value should be in the format managePermissionGrantsForSelf.{id}, where {id} is the id of a built-in or custom app consent policy. An empty list indicates user consent to apps is disabled.
Ensure	Write	String	Specify that the Azure Authorization Policy should exist.	Present
Credential	Write	PSCredential	Credentials for the Microsoft Graph delegated permissions.
ApplicationId	Write	String	Id of the Azure Active Directory application to authenticate with.
TenantId	Write	String	Id of the Azure Active Directory tenant used for authentication.
ApplicationSecret	Write	PSCredential	Secret of the Azure Active Directory application to authenticate with.
CertificateThumbprint	Write	String	Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication.
ManagedIdentity	Write	Boolean	Managed ID being used for authentication.
AccessTokens	Write	StringArray[]	Access token used for authentication.

Description

This resource configures the Azure Active Directory Authorization Policy.

The policy is managed using the BETA API, some properties may have been added in the API but not in the resource

Azure AD Permissions

To authenticate via Microsoft Graph, this resource required the following Application permissions:

• Automate
• Policy.Read.All

• Policy.ReadWrite.Authorization

• Export

• Policy.Read.All

NOTE: All permissions listed above require admin consent.

Permissions

Microsoft Graph

To authenticate with the Microsoft Graph API, this resource required the following permissions:

Delegated permissions

• Read

  • Policy.Read.All

• Update

  • Policy.ReadWrite.Authorization

Application permissions

• Read

  • Policy.Read.All

• Update

  • Policy.ReadWrite.Authorization

Examples

Example 1

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param(
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    node localhost
    {
        AADAuthorizationPolicy 'AADAuthPol'
        {
            IsSingleInstance                                  = 'Yes'
            DisplayName                                       = 'Authorization Policy'
            Description                                       = 'Used to manage authorization related settings across the company.'
            AllowEmailVerifiedUsersToJoinOrganization         = $true
            AllowInvitesFrom                                  = 'everyone'
            AllowedToSignUpEmailBasedSubscriptions            = $true
            AllowedToUseSspr                                  = $true
            BlockMsolPowerShell                               = $false
            DefaultUserRoleAllowedToCreateApps                = $true
            DefaultUserRoleAllowedToCreateSecurityGroups      = $true
            DefaultUserRoleAllowedToReadOtherUsers            = $true
            GuestUserRole                                     = 'Guest'
            PermissionGrantPolicyIdsAssignedToDefaultUserRole = @()
            Ensure                                            = 'Present'
            ApplicationId         = $ApplicationId
            TenantId              = $TenantId
            CertificateThumbprint = $CertificateThumbprint
        }
    }
}