IntuneDeviceFeaturesConfigurationPolicyMacOS

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
AdminShowHostInfo	Write	Boolean	Whether to show admin host information on the login window.
AirPrintDestinations	Write	MSFT_MicrosoftGraphAirPrintDestination[]	An array of AirPrint printers that should always be shown. This collection can contain a maximum of 500 elements.
AppAssociatedDomains	Write	MSFT_MicrosoftGraphMacOSAssociatedDomainsItem[]	Gets or sets a list that maps apps to their associated domains. Application identifiers must be unique. This collection can contain a maximum of 500 elements.
Assignments	Write	MSFT_DeviceManagementConfigurationPolicyAssignments[]	Represents the assignment to the Intune policy.
AssociatedDomains	Write	MSFT_MicrosoftGraphKeyValuePair2[]	DEPRECATED: use appAssociatedDomains instead. Gets or sets a list that maps apps to their associated domains. The key should match the app's ID, and the value should be a string in the form of 'service:domain' where domain is a fully qualified hostname (e.g. webcredentials:example.com). This collection can contain a maximum of 500 elements.
AuthorizedUsersListHidden	Write	Boolean	Whether to show the name and password dialog or a list of users on the login window.
AuthorizedUsersListHideAdminUsers	Write	Boolean	Whether to hide admin users in the authorized users list on the login window.
AuthorizedUsersListHideLocalUsers	Write	Boolean	Whether to show only network and system users in the authorized users list on the login window.
AuthorizedUsersListHideMobileAccounts	Write	Boolean	Whether to hide mobile users in the authorized users list on the login window.
AuthorizedUsersListIncludeNetworkUsers	Write	Boolean	Whether to show network users in the authorized users list on the login window.
AuthorizedUsersListShowOtherManagedUsers	Write	Boolean	Whether to show other users in the authorized users list on the login window.
AutoLaunchItems	Write	MSFT_MicrosoftGraphMacOSLaunchItem[]	List of applications, files, folders, and other items to launch when the user logs in. This collection can contain a maximum of 500 elements.
ConsoleAccessDisabled	Write	Boolean	Whether the Other user will disregard use of the console special user name.
ContentCachingBlockDeletion	Write	Boolean	Prevents content caches from purging content to free up disk space for other apps.
ContentCachingClientListenRanges	Write	MSFT_MicrosoftGraphIpRange2[]	A list of custom IP ranges content caches will use to listen for clients. This collection can contain a maximum of 500 elements.
ContentCachingClientPolicy	Write	String	Determines the method in which content caching servers will listen for clients. Possible values are: notConfigured, clientsInLocalNetwork, clientsWithSamePublicIpAddress, clientsInCustomLocalNetworks, clientsInCustomLocalNetworksWithFallback.	notConfigured, clientsInLocalNetwork, clientsWithSamePublicIpAddress, clientsInCustomLocalNetworks, clientsInCustomLocalNetworksWithFallback
ContentCachingDataPath	Write	String	The path to the directory used to store cached content. The value must be (or end with) /Library/Application Support/Apple/AssetCache/Data
ContentCachingDisableConnectionSharing	Write	Boolean	Disables internet connection sharing.
ContentCachingEnabled	Write	Boolean	Enables content caching and prevents it from being disabled by the user.
ContentCachingForceConnectionSharing	Write	Boolean	Forces internet connection sharing. contentCachingDisableConnectionSharing overrides this setting.
ContentCachingKeepAwake	Write	Boolean	Prevent the device from sleeping if content caching is enabled.
ContentCachingLogClientIdentities	Write	Boolean	Enables logging of IP addresses and ports of clients that request cached content.
ContentCachingMaxSizeBytes	Write	SInt64	The maximum number of bytes of disk space that will be used for the content cache. A value of 0 (default) indicates unlimited disk space.
ContentCachingParents	Write	String[]	A list of IP addresses representing parent content caches.
ContentCachingParentSelectionPolicy	Write	String	Determines the method in which content caching servers will select parents if multiple are present. Possible values are: notConfigured, roundRobin, firstAvailable, urlPathHash, random, stickyAvailable.	notConfigured, roundRobin, firstAvailable, urlPathHash, random, stickyAvailable
ContentCachingPeerFilterRanges	Write	MSFT_MicrosoftGraphIpRange2[]	A list of custom IP ranges content caches will use to query for content from peers caches. This collection can contain a maximum of 500 elements.
ContentCachingPeerListenRanges	Write	MSFT_MicrosoftGraphIpRange2[]	A list of custom IP ranges content caches will use to listen for peer caches. This collection can contain a maximum of 500 elements.
ContentCachingPeerPolicy	Write	String	Determines the method in which content caches peer with other caches. Possible values are: notConfigured, peersInLocalNetwork, peersWithSamePublicIpAddress, peersInCustomLocalNetworks.	notConfigured, peersInLocalNetwork, peersWithSamePublicIpAddress, peersInCustomLocalNetworks
ContentCachingPort	Write	SInt32	Sets the port used for content caching. If the value is 0, a random available port will be selected. Valid values 0 to 65535
ContentCachingPublicRanges	Write	MSFT_MicrosoftGraphIpRange2[]	A list of custom IP ranges that Apple's content caching service should use to match clients to content caches. This collection can contain a maximum of 500 elements.
ContentCachingShowAlerts	Write	Boolean	Display content caching alerts as system notifications.
ContentCachingType	Write	String	Determines what type of content is allowed to be cached by Apple's content caching service. Possible values are: notConfigured, userContentOnly, sharedContentOnly.	notConfigured, userContentOnly, sharedContentOnly
Description	Write	String	Admin provided description of the Device Configuration.
DisplayName	Key	String	Admin provided name of the device configuration.
Id	Write	String	The unique identifier for an entity. Read-only.
LoginWindowText	Write	String	Custom text to be displayed on the login window.
LogOutDisabledWhileLoggedIn	Write	Boolean	Whether the Log Out menu item on the login window will be disabled while the user is logged in.
MacOSSingleSignOnExtension	Write	MSFT_MicrosoftGraphMacOSSingleSignOnExtension	Gets or sets a single sign-on extension profile.
PowerOffDisabledWhileLoggedIn	Write	Boolean	Whether the Power Off menu item on the login window will be disabled while the user is logged in.
RestartDisabled	Write	Boolean	Whether to hide the Restart button item on the login window.
RestartDisabledWhileLoggedIn	Write	Boolean	Whether the Restart menu item on the login window will be disabled while the user is logged in.
RoleScopeTagIds	Write	String[]	List of Scope Tags for this Entity instance.
ScreenLockDisableImmediate	Write	Boolean	Whether to disable the immediate screen lock functions.
ShutDownDisabled	Write	Boolean	Whether to hide the Shut Down button item on the login window.
ShutDownDisabledWhileLoggedIn	Write	Boolean	Whether the Shut Down menu item on the login window will be disabled while the user is logged in.
SingleSignOnExtension	Write	MSFT_MicrosoftGraphSingleSignOnExtension	Gets or sets a single sign-on extension profile. Deprecated: use MacOSSingleSignOnExtension instead.
SleepDisabled	Write	Boolean	Whether to hide the Sleep menu item on the login window.
Ensure	Write	String	Specify if the policy should exist.	Present, Absent
Credential	Write	PSCredential	Credentials of the Intune Admin
ApplicationId	Write	String	Id of the Entra ID application to authenticate with.
TenantId	Write	String	Id of the Entra ID tenant used for authentication.
ApplicationSecret	Write	PSCredential	Secret of the Entra ID application to authenticate with.
CertificateThumbprint	Write	String	Thumbprint of the Entra ID application's authentication certificate to use for authentication.
CertificatePassword	Write	PSCredential	Username can be made up to anything but password will be used for CertificatePassword
CertificatePath	Write	String	Path to certificate used in service principal usually a PFX file.
ManagedIdentity	Write	Boolean	Managed ID being used for authentication.
AccessTokens	Write	String[]	Access token used for authentication.

Embedded Instances

MSFT_MicrosoftGraphAirPrintDestination

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
ForceTls	Write	Boolean	If true AirPrint connections are secured by Transport Layer Security (TLS). Default is false. Available in iOS 11.0 and later.
IpAddress	Write	String	The IP Address of the AirPrint destination.
Port	Write	SInt32	The listening port of the AirPrint destination. If this key is not specified AirPrint will use the default port. Available in iOS 11.0 and later.
ResourcePath	Write	String	The Resource Path associated with the printer. This corresponds to the rp parameter of the ipps.tcp Bonjour record. For example: printers/CanonMG5300series, printers/XeroxPhaser7600, ipp/print, EpsonIPPPrinter.

MSFT_MicrosoftGraphMacOSAssociatedDomainsItem

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
ApplicationIdentifier	Write	String	The application identifier of the app to associate domains with.
DirectDownloadsEnabled	Write	Boolean	Determines whether data should be downloaded directly or via a CDN.
Domains	Write	String[]	The list of domains to associate.

MSFT_DeviceManagementConfigurationPolicyAssignments

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
dataType	Required	String	The type of the target assignment.	#microsoft.graph.cloudPcManagementGroupAssignmentTarget, #microsoft.graph.groupAssignmentTarget, #microsoft.graph.allLicensedUsersAssignmentTarget, #microsoft.graph.allDevicesAssignmentTarget, #microsoft.graph.exclusionGroupAssignmentTarget, #microsoft.graph.configurationManagerCollectionAssignmentTarget
deviceAndAppManagementAssignmentFilterType	Write	String	The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.	none, include, exclude
deviceAndAppManagementAssignmentFilterId	Write	String	The Id of the filter for the target assignment.
deviceAndAppManagementAssignmentFilterDisplayName	Write	String	The display name of the filter for the target assignment.
groupId	Write	String	The group Id that is the target of the assignment.
groupDisplayName	Write	String	The group Display Name that is the target of the assignment.
collectionId	Write	String	The collection Id that is the target of the assignment.(ConfigMgr)

MSFT_MicrosoftGraphKeyValuePair2

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
Name	Write	String	Name for this key-value pair
Value	Write	String	Value for this key-value pair

MSFT_MicrosoftGraphMacOSLaunchItem

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
Hide	Write	Boolean	Whether or not to hide the item from the Users and Groups List.
Path	Write	String	Path to the launch item.

MSFT_MicrosoftGraphIpRange2

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
CidrAddress	Write	String	IPv4 address in CIDR notation. Not nullable.
LowerAddress	Write	String	Lower address.
ODataType	Write	String	The type of the entity.	#microsoft.graph.iPv4CidrRange, #microsoft.graph.iPv4Range, #microsoft.graph.iPv6CidrRange, #microsoft.graph.iPv6Range
UpperAddress	Write	String	Upper address.

MSFT_MicrosoftGraphMacOSSingleSignOnExtension

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
ActiveDirectorySiteCode	Write	String	Gets or sets the Active Directory site.
BlockActiveDirectorySiteAutoDiscovery	Write	Boolean	Enables or disables whether the Kerberos extension can automatically determine its site name.
BlockAutomaticLogin	Write	Boolean	Enables or disables Keychain usage.
BundleIdAccessControlList	Write	String[]	An optional list of additional bundle IDs allowed to use the AAD extension for single sign-on.
CacheName	Write	String	Gets or sets the Generic Security Services name of the Kerberos cache to use for this profile.
Configurations	Write	MSFT_MicrosoftGraphKeyTypedValuePair[]	Gets or sets a list of typed key-value pairs used to configure Credential-type profiles. This collection can contain a maximum of 500 elements.
CredentialBundleIdAccessControlList	Write	String[]	Gets or sets a list of app Bundle IDs allowed to access the Kerberos Ticket Granting Ticket.
CredentialsCacheMonitored	Write	Boolean	When set to True, the credential is requested on the next matching Kerberos challenge or network state change. When the credential is expired or missing, a new credential is created. Available for devices running macOS versions 12 and later.
DomainRealms	Write	String[]	Gets or sets a list of realms for custom domain-realm mapping. Realms are case sensitive.
Domains	Write	String[]	Gets or sets a list of hosts or domain names for which the app extension performs SSO.
EnableSharedDeviceMode	Write	Boolean	Enables or disables shared device mode.
ExtensionIdentifier	Write	String	Gets or sets the bundle ID of the app extension that performs SSO for the specified URLs.
IsDefaultRealm	Write	Boolean	When true, this profile's realm will be selected as the default. Necessary if multiple Kerberos-type profiles are configured.
KerberosAppsInBundleIdACLIncluded	Write	Boolean	When set to True, the Kerberos extension allows any apps entered with the app bundle ID, managed apps, and standard Kerberos utilities, such as TicketViewer and klist, to access and use the credential. Available for devices running macOS versions 12 and later.
ManagedAppsInBundleIdACLIncluded	Write	Boolean	When set to True, the Kerberos extension allows managed apps, and any apps entered with the app bundle ID to access the credential. When set to False, the Kerberos extension allows all apps to access the credential. Available for devices running iOS and iPadOS versions 14 and later.
ModeCredentialUsed	Write	String	Select how other processes use the Kerberos Extension credential.
ODataType	Write	String	The type of the entity.	#microsoft.graph.macOSAzureAdSingleSignOnExtension, #microsoft.graph.macOSCredentialSingleSignOnExtension, #microsoft.graph.macOSKerberosSingleSignOnExtension, #microsoft.graph.macOSRedirectSingleSignOnExtension
PasswordBlockModification	Write	Boolean	Enables or disables password changes.
PasswordChangeUrl	Write	String	Gets or sets the URL that the user will be sent to when they initiate a password change.
PasswordEnableLocalSync	Write	Boolean	Enables or disables password syncing. This won't affect users logged in with a mobile account on macOS.
PasswordExpirationDays	Write	SInt32	Overrides the default password expiration in days. For most domains, this value is calculated automatically.
PasswordExpirationNotificationDays	Write	SInt32	Gets or sets the number of days until the user is notified that their password will expire (default is 15).
PasswordMinimumAgeDays	Write	SInt32	Gets or sets the minimum number of days until a user can change their password again.
PasswordMinimumLength	Write	SInt32	Gets or sets the minimum length of a password.
PasswordPreviousPasswordBlockCount	Write	SInt32	Gets or sets the number of previous passwords to block.
PasswordRequireActiveDirectoryComplexity	Write	Boolean	Enables or disables whether passwords must meet Active Directory's complexity requirements.
PasswordRequirementsDescription	Write	String	Gets or sets a description of the password complexity requirements.
PreferredKDCs	Write	String[]	Add creates an ordered list of preferred Key Distribution Centers (KDCs) to use for Kerberos traffic. This list is used when the servers are not discoverable using DNS. When the servers are discoverable, the list is used for both connectivity checks, and used first for Kerberos traffic. If the servers dont respond, then the device uses DNS discovery. Delete removes an existing list, and devices use DNS discovery. Available for devices running macOS versions 12 and later.
Realm	Write	String	Gets or sets the case-sensitive realm name for this profile.
RequireUserPresence	Write	Boolean	Gets or sets whether to require authentication via Touch ID, Face ID, or a passcode to access the keychain entry.
SignInHelpText	Write	String	Text displayed to the user at the Kerberos sign in window. Available for devices running iOS and iPadOS versions 14 and later.
TeamIdentifier	Write	String	Gets or sets the team ID of the app extension that performs SSO for the specified URLs.
TlsForLDAPRequired	Write	Boolean	When set to True, LDAP connections are required to use Transport Layer Security (TLS). Available for devices running macOS versions 11 and later.
UrlPrefixes	Write	String[]	One or more URL prefixes of identity providers on whose behalf the app extension performs single sign-on. URLs must begin with http:// or https://. All URL prefixes must be unique for all profiles.
UsernameLabelCustom	Write	String	This label replaces the user name shown in the Kerberos extension. You can enter a name to match the name of your company or organization. Available for devices running macOS versions 11 and later.
UserPrincipalName	Write	String	Gets or sets the principle user name to use for this profile. The realm name does not need to be included.
UserSetupDelayed	Write	Boolean	When set to True, the user isnt prompted to set up the Kerberos extension until the extension is enabled by the admin, or a Kerberos challenge is received. Available for devices running macOS versions 11 and later.

MSFT_MicrosoftGraphSingleSignOnExtension

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
ActiveDirectorySiteCode	Write	String	Gets or sets the Active Directory site.
BlockActiveDirectorySiteAutoDiscovery	Write	Boolean	Enables or disables whether the Kerberos extension can automatically determine its site name.
BlockAutomaticLogin	Write	Boolean	Enables or disables Keychain usage.
CacheName	Write	String	Gets or sets the Generic Security Services name of the Kerberos cache to use for this profile.
Configurations	Write	MSFT_MicrosoftGraphKeyTypedValuePair[]	Gets or sets a list of typed key-value pairs used to configure Credential-type profiles. This collection can contain a maximum of 500 elements.
CredentialBundleIdAccessControlList	Write	String[]	Gets or sets a list of app Bundle IDs allowed to access the Kerberos Ticket Granting Ticket.
DomainRealms	Write	String[]	Gets or sets a list of realms for custom domain-realm mapping. Realms are case sensitive.
Domains	Write	String[]	Gets or sets a list of hosts or domain names for which the app extension performs SSO.
ExtensionIdentifier	Write	String	Gets or sets the bundle ID of the app extension that performs SSO for the specified URLs.
IsDefaultRealm	Write	Boolean	When true, this profile's realm will be selected as the default. Necessary if multiple Kerberos-type profiles are configured.
ODataType	Write	String	The type of the entity.	#microsoft.graph.credentialSingleSignOnExtension, #microsoft.graph.iosSingleSignOnExtension, #microsoft.graph.kerberosSingleSignOnExtension, #microsoft.graph.macOSSingleSignOnExtension, #microsoft.graph.redirectSingleSignOnExtension
PasswordBlockModification	Write	Boolean	Enables or disables password changes.
PasswordChangeUrl	Write	String	Gets or sets the URL that the user will be sent to when they initiate a password change.
PasswordEnableLocalSync	Write	Boolean	Enables or disables password syncing. This won't affect users logged in with a mobile account on macOS.
PasswordExpirationDays	Write	SInt32	Overrides the default password expiration in days. For most domains, this value is calculated automatically.
PasswordExpirationNotificationDays	Write	SInt32	Gets or sets the number of days until the user is notified that their password will expire (default is 15).
PasswordMinimumAgeDays	Write	SInt32	Gets or sets the minimum number of days until a user can change their password again.
PasswordMinimumLength	Write	SInt32	Gets or sets the minimum length of a password.
PasswordPreviousPasswordBlockCount	Write	SInt32	Gets or sets the number of previous passwords to block.
PasswordRequireActiveDirectoryComplexity	Write	Boolean	Enables or disables whether passwords must meet Active Directory's complexity requirements.
PasswordRequirementsDescription	Write	String	Gets or sets a description of the password complexity requirements.
Realm	Write	String	Gets or sets the case-sensitive realm name for this profile.
RequireUserPresence	Write	Boolean	Gets or sets whether to require authentication via Touch ID, Face ID, or a passcode to access the keychain entry.
TeamIdentifier	Write	String	Gets or sets the team ID of the app extension that performs SSO for the specified URLs.
UrlPrefixes	Write	String[]	One or more URL prefixes of identity providers on whose behalf the app extension performs single sign-on. URLs must begin with http:// or https://. All URL prefixes must be unique for all profiles.
UserPrincipalName	Write	String	Gets or sets the principle user name to use for this profile. The realm name does not need to be included.

MSFT_MicrosoftGraphKeyTypedValuePair

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
Key	Write	String	The string key of the key-value pair.
ODataType	Write	String	The type of the entity.	#microsoft.graph.keyBooleanValuePair, #microsoft.graph.keyIntegerValuePair, #microsoft.graph.keyRealValuePair, #microsoft.graph.keyStringValuePair
Value	Write	Boolean	The Boolean value of the key-value pair.

Description

This resource configures a Intune Device Features Configuration Policy for macOS.

Permissions

Graph

To authenticate with the Graph API, this resource requires the following permissions:

Delegated permissions

• Read

• GroupMember.Read.All, DeviceManagementConfiguration.Read.All, DeviceManagementRBAC.Read.All

• Update

• GroupMember.Read.All, DeviceManagementConfiguration.ReadWrite.All, DeviceManagementRBAC.Read.All

Application permissions

• Read

• GroupMember.Read.All, DeviceManagementConfiguration.Read.All, DeviceManagementRBAC.Read.All

• Update

• GroupMember.Read.All, DeviceManagementConfiguration.ReadWrite.All, DeviceManagementRBAC.Read.All

Examples

Example 1

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        IntuneDeviceFeaturesConfigurationPolicyMacOS 'IntuneDeviceFeaturesConfigurationPolicyMacOS-Example'
        {
            AdminShowHostInfo                        = $true;
            AirPrintDestinations                     = @(
                MSFT_MicrosoftGraphAirPrintDestination{
                    ForceTls     = $true
                    IpAddress    = "10.20.30.40"
                    Port         = 631
                    ResourcePath = "printers/Design-Colour-01"
                }
            );
            AppAssociatedDomains                     = @(
                MSFT_MicrosoftGraphMacOSAssociatedDomainsItem{
                    ApplicationIdentifier  = "com.contoso.intranet"
                    DirectDownloadsEnabled = $false
                    Domains                = @("webcredentials:intranet.contoso.com", "applinks:intranet.contoso.com")
                }
            );
            Assignments                              = @(
                MSFT_DeviceManagementConfigurationPolicyAssignments{
                    dataType                                   = "#microsoft.graph.allDevicesAssignmentTarget"
                    deviceAndAppManagementAssignmentFilterType = "none"
                }
            );
            AssociatedDomains                        = @(
                MSFT_MicrosoftGraphKeyValuePair2{
                    Name  = "com.contoso.intranet"
                    Value = "webcredentials:intranet.contoso.com"
                }
            );
            AuthorizedUsersListHidden                = $false;
            AuthorizedUsersListHideAdminUsers        = $true;
            AuthorizedUsersListHideLocalUsers        = $false;
            AuthorizedUsersListHideMobileAccounts    = $false;
            AuthorizedUsersListIncludeNetworkUsers   = $true;
            AuthorizedUsersListShowOtherManagedUsers = $false;
            AutoLaunchItems                          = @(
                MSFT_MicrosoftGraphMacOSLaunchItem{
                    Hide = $true
                    Path = "/Applications/Microsoft Teams.app"
                }
            );
            ConsoleAccessDisabled                    = $true;
            ContentCachingBlockDeletion              = $false;
            ContentCachingClientListenRanges         = @(
                MSFT_MicrosoftGraphIpRange2{
                    CidrAddress  = "10.20.0.0/16"
                    LowerAddress = "10.20.0.1"
                    ODataType    = "#microsoft.graph.iPv4CidrRange"
                    UpperAddress = "10.20.255.254"
                }
            );
            ContentCachingClientPolicy               = "clientsInLocalNetwork";
            ContentCachingDataPath                   = "/Library/Application Support/Apple/AssetCache/Data";
            ContentCachingDisableConnectionSharing   = $false;
            ContentCachingEnabled                    = $true;
            ContentCachingForceConnectionSharing     = $false;
            ContentCachingKeepAwake                  = $true;
            ContentCachingLogClientIdentities        = $true;
            ContentCachingMaxSizeBytes               = 107374182400;
            ContentCachingParents                    = @("mac-cache-01.contoso.com", "mac-cache-02.contoso.com");
            ContentCachingParentSelectionPolicy      = "roundRobin";
            ContentCachingPeerFilterRanges           = @(
                MSFT_MicrosoftGraphIpRange2{
                    CidrAddress  = "10.20.0.0/16"
                    LowerAddress = "10.20.0.1"
                    ODataType    = "#microsoft.graph.iPv4CidrRange"
                    UpperAddress = "10.20.255.254"
                }
            );
            ContentCachingPeerListenRanges           = @(
                MSFT_MicrosoftGraphIpRange2{
                    CidrAddress  = "10.20.0.0/16"
                    LowerAddress = "10.20.0.1"
                    ODataType    = "#microsoft.graph.iPv4CidrRange"
                    UpperAddress = "10.20.255.254"
                }
            );
            ContentCachingPeerPolicy                 = "peersInLocalNetwork";
            ContentCachingPort                       = 49152;
            ContentCachingPublicRanges               = @(
                MSFT_MicrosoftGraphIpRange2{
                    CidrAddress  = "10.20.0.0/16"
                    LowerAddress = "10.20.0.1"
                    ODataType    = "#microsoft.graph.iPv4CidrRange"
                    UpperAddress = "10.20.255.254"
                }
            );
            ContentCachingShowAlerts                 = $true;
            ContentCachingType                       = "userContentOnly";
            Description                              = "Login window branding and content caching for managed Macs";
            DisplayName                              = "macOS Device Features";
            LoginWindowText                          = "Property of Contoso. Unauthorized use is prohibited.";
            LogOutDisabledWhileLoggedIn              = $false;
            MacOSSingleSignOnExtension               = MSFT_MicrosoftGraphMacOSSingleSignOnExtension{
                ActiveDirectorySiteCode                  = "EMEA-ZRH"
                BlockActiveDirectorySiteAutoDiscovery    = $false
                BlockAutomaticLogin                      = $false
                BundleIdAccessControlList                = @("com.microsoft.Outlook", "com.microsoft.teams2")
                CacheName                                = "CONTOSO.COM"
                Configurations                           = @(
                        MSFT_MicrosoftGraphKeyTypedValuePair{
                            Key       = "allowPasswordChange"
                            ODataType = "#microsoft.graph.keyBooleanValuePair"
                            Value     = $true
                        }
                    )
                CredentialBundleIdAccessControlList      = @("com.apple.Safari", "com.microsoft.edgemac")
                CredentialsCacheMonitored                = $true
                DomainRealms                             = @("contoso.com", "corp.contoso.com")
                Domains                                  = @("contoso.com", "corp.contoso.com")
                EnableSharedDeviceMode                   = $false
                ExtensionIdentifier                      = "com.microsoft.CompanyPortalMac.ssoextension"
                IsDefaultRealm                           = $true
                KerberosAppsInBundleIdACLIncluded        = $true
                ManagedAppsInBundleIdACLIncluded         = $true
                ModeCredentialUsed                       = "Password"
                ODataType                                = "#microsoft.graph.macOSAzureAdSingleSignOnExtension"
                PasswordBlockModification                = $false
                PasswordChangeUrl                        = "https://passwordreset.contoso.com"
                PasswordEnableLocalSync                  = $true
                PasswordExpirationDays                   = 90
                PasswordExpirationNotificationDays       = 14
                PasswordMinimumAgeDays                   = 1
                PasswordMinimumLength                    = 12
                PasswordPreviousPasswordBlockCount       = 5
                PasswordRequireActiveDirectoryComplexity = $true
                PasswordRequirementsDescription          = "At least 12 characters, with an upper case letter, a lower case letter and a number"
                PreferredKDCs                            = @("kdc01.contoso.com", "kdc02.contoso.com")
                Realm                                    = "CONTOSO.COM"
                RequireUserPresence                      = $true
                SignInHelpText                           = "Sign in with your Contoso account"
                TeamIdentifier                           = "UBF8T346G9"
                TlsForLDAPRequired                       = $true
                UrlPrefixes                              = @("https://intranet.contoso.com", "https://portal.contoso.com")
                UsernameLabelCustom                      = "Contoso account"
                UserPrincipalName                        = "mac.admin@$TenantId"
                UserSetupDelayed                         = $false
            };
            PowerOffDisabledWhileLoggedIn            = $false;
            RestartDisabled                          = $false;
            RestartDisabledWhileLoggedIn             = $false;
            RoleScopeTagIds                          = @("0");
            ScreenLockDisableImmediate               = $false;
            ShutDownDisabled                         = $false;
            ShutDownDisabledWhileLoggedIn            = $false;
            SingleSignOnExtension                    = MSFT_MicrosoftGraphSingleSignOnExtension{
                ActiveDirectorySiteCode                  = "EMEA-ZRH"
                BlockActiveDirectorySiteAutoDiscovery    = $false
                BlockAutomaticLogin                      = $false
                CacheName                                = "CONTOSO.COM"
                Configurations                           = @(
                        MSFT_MicrosoftGraphKeyTypedValuePair{
                            Key       = "allowPasswordChange"
                            ODataType = "#microsoft.graph.keyBooleanValuePair"
                            Value     = $true
                        }
                    )
                CredentialBundleIdAccessControlList      = @("com.apple.Safari", "com.microsoft.edgemac")
                DomainRealms                             = @("contoso.com", "corp.contoso.com")
                Domains                                  = @("contoso.com", "corp.contoso.com")
                ExtensionIdentifier                      = "com.microsoft.CompanyPortalMac.ssoextension"
                IsDefaultRealm                           = $true
                ODataType                                = "#microsoft.graph.credentialSingleSignOnExtension"
                PasswordBlockModification                = $false
                PasswordChangeUrl                        = "https://passwordreset.contoso.com"
                PasswordEnableLocalSync                  = $true
                PasswordExpirationDays                   = 90
                PasswordExpirationNotificationDays       = 14
                PasswordMinimumAgeDays                   = 1
                PasswordMinimumLength                    = 12
                PasswordPreviousPasswordBlockCount       = 5
                PasswordRequireActiveDirectoryComplexity = $true
                PasswordRequirementsDescription          = "At least 12 characters, with an upper case letter, a lower case letter and a number"
                Realm                                    = "CONTOSO.COM"
                RequireUserPresence                      = $true
                TeamIdentifier                           = "UBF8T346G9"
                UrlPrefixes                              = @("https://intranet.contoso.com", "https://portal.contoso.com")
                UserPrincipalName                        = "mac.admin@$TenantId"
            };
            SleepDisabled                            = $false;
            Ensure                                   = "Present";
            ApplicationId                            = $ApplicationId;
            TenantId                                 = $TenantId;
            CertificateThumbprint                    = $CertificateThumbprint;
        }
    }
}

Example 2

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        IntuneDeviceFeaturesConfigurationPolicyMacOS 'IntuneDeviceFeaturesConfigurationPolicyMacOS-Example'
        {
            AdminShowHostInfo                        = $true;
            AirPrintDestinations                     = @(
                MSFT_MicrosoftGraphAirPrintDestination{
                    ForceTls     = $true
                    IpAddress    = "10.20.30.40"
                    Port         = 631
                    ResourcePath = "printers/Design-Colour-01"
                }
            );
            AppAssociatedDomains                     = @(
                MSFT_MicrosoftGraphMacOSAssociatedDomainsItem{
                    ApplicationIdentifier  = "com.contoso.intranet"
                    DirectDownloadsEnabled = $false
                    Domains                = @("webcredentials:intranet.contoso.com", "applinks:intranet.contoso.com")
                }
            );
            Assignments                              = @(
                MSFT_DeviceManagementConfigurationPolicyAssignments{
                    dataType                                   = "#microsoft.graph.allDevicesAssignmentTarget"
                    deviceAndAppManagementAssignmentFilterType = "none"
                }
            );
            AssociatedDomains                        = @(
                MSFT_MicrosoftGraphKeyValuePair2{
                    Name  = "com.contoso.intranet"
                    Value = "webcredentials:intranet.contoso.com"
                }
            );
            AuthorizedUsersListHidden                = $false;
            AuthorizedUsersListHideAdminUsers        = $true;
            AuthorizedUsersListHideLocalUsers        = $false;
            AuthorizedUsersListHideMobileAccounts    = $false;
            AuthorizedUsersListIncludeNetworkUsers   = $true;
            AuthorizedUsersListShowOtherManagedUsers = $false;
            AutoLaunchItems                          = @(
                MSFT_MicrosoftGraphMacOSLaunchItem{
                    Hide = $true
                    Path = "/Applications/Microsoft Teams.app"
                }
            );
            ConsoleAccessDisabled                    = $true;
            ContentCachingBlockDeletion              = $false;
            ContentCachingClientListenRanges         = @(
                MSFT_MicrosoftGraphIpRange2{
                    CidrAddress  = "10.20.0.0/16"
                    LowerAddress = "10.20.0.1"
                    ODataType    = "#microsoft.graph.iPv4CidrRange"
                    UpperAddress = "10.20.255.254"
                }
            );
            ContentCachingClientPolicy               = "clientsInLocalNetwork";
            ContentCachingDataPath                   = "/Library/Application Support/Apple/AssetCache/Cache"; # Updated Property
            ContentCachingDisableConnectionSharing   = $false;
            ContentCachingEnabled                    = $true;
            ContentCachingForceConnectionSharing     = $false;
            ContentCachingKeepAwake                  = $true;
            ContentCachingLogClientIdentities        = $true;
            ContentCachingMaxSizeBytes               = 107374182400;
            ContentCachingParents                    = @("mac-cache-01.contoso.com", "mac-cache-02.contoso.com");
            ContentCachingParentSelectionPolicy      = "roundRobin";
            ContentCachingPeerFilterRanges           = @(
                MSFT_MicrosoftGraphIpRange2{
                    CidrAddress  = "10.20.0.0/16"
                    LowerAddress = "10.20.0.1"
                    ODataType    = "#microsoft.graph.iPv4CidrRange"
                    UpperAddress = "10.20.255.254"
                }
            );
            ContentCachingPeerListenRanges           = @(
                MSFT_MicrosoftGraphIpRange2{
                    CidrAddress  = "10.20.0.0/16"
                    LowerAddress = "10.20.0.1"
                    ODataType    = "#microsoft.graph.iPv4CidrRange"
                    UpperAddress = "10.20.255.254"
                }
            );
            ContentCachingPeerPolicy                 = "peersInLocalNetwork";
            ContentCachingPort                       = 49152;
            ContentCachingPublicRanges               = @(
                MSFT_MicrosoftGraphIpRange2{
                    CidrAddress  = "10.20.0.0/16"
                    LowerAddress = "10.20.0.1"
                    ODataType    = "#microsoft.graph.iPv4CidrRange"
                    UpperAddress = "10.20.255.254"
                }
            );
            ContentCachingShowAlerts                 = $true;
            ContentCachingType                       = "userContentOnly";
            Description                              = "Login window branding and content caching for managed Macs";
            DisplayName                              = "macOS Device Features";
            LoginWindowText                          = "Property of Contoso. Unauthorized use is prohibited.";
            LogOutDisabledWhileLoggedIn              = $false;
            MacOSSingleSignOnExtension               = MSFT_MicrosoftGraphMacOSSingleSignOnExtension{
                ActiveDirectorySiteCode                  = "EMEA-ZRH"
                BlockActiveDirectorySiteAutoDiscovery    = $false
                BlockAutomaticLogin                      = $false
                BundleIdAccessControlList                = @("com.microsoft.Outlook", "com.microsoft.teams2")
                CacheName                                = "CONTOSO.COM"
                Configurations                           = @(
                        MSFT_MicrosoftGraphKeyTypedValuePair{
                            Key       = "allowPasswordChange"
                            ODataType = "#microsoft.graph.keyBooleanValuePair"
                            Value     = $true
                        }
                    )
                CredentialBundleIdAccessControlList      = @("com.apple.Safari", "com.microsoft.edgemac")
                CredentialsCacheMonitored                = $true
                DomainRealms                             = @("contoso.com", "corp.contoso.com")
                Domains                                  = @("contoso.com", "corp.contoso.com")
                EnableSharedDeviceMode                   = $false
                ExtensionIdentifier                      = "com.microsoft.CompanyPortalMac.ssoextension"
                IsDefaultRealm                           = $true
                KerberosAppsInBundleIdACLIncluded        = $true
                ManagedAppsInBundleIdACLIncluded         = $true
                ModeCredentialUsed                       = "Password"
                ODataType                                = "#microsoft.graph.macOSAzureAdSingleSignOnExtension"
                PasswordBlockModification                = $false
                PasswordChangeUrl                        = "https://passwordreset.contoso.com"
                PasswordEnableLocalSync                  = $true
                PasswordExpirationDays                   = 90
                PasswordExpirationNotificationDays       = 14
                PasswordMinimumAgeDays                   = 1
                PasswordMinimumLength                    = 12
                PasswordPreviousPasswordBlockCount       = 5
                PasswordRequireActiveDirectoryComplexity = $true
                PasswordRequirementsDescription          = "At least 12 characters, with an upper case letter, a lower case letter and a number"
                PreferredKDCs                            = @("kdc01.contoso.com", "kdc02.contoso.com")
                Realm                                    = "CONTOSO.COM"
                RequireUserPresence                      = $true
                SignInHelpText                           = "Sign in with your Contoso account"
                TeamIdentifier                           = "UBF8T346G9"
                TlsForLDAPRequired                       = $true
                UrlPrefixes                              = @("https://intranet.contoso.com", "https://portal.contoso.com")
                UsernameLabelCustom                      = "Contoso account"
                UserPrincipalName                        = "mac.admin@$TenantId"
                UserSetupDelayed                         = $false
            };
            PowerOffDisabledWhileLoggedIn            = $false;
            RestartDisabled                          = $false;
            RestartDisabledWhileLoggedIn             = $false;
            RoleScopeTagIds                          = @("0");
            ScreenLockDisableImmediate               = $false;
            ShutDownDisabled                         = $false;
            ShutDownDisabledWhileLoggedIn            = $false;
            SingleSignOnExtension                    = MSFT_MicrosoftGraphSingleSignOnExtension{
                ActiveDirectorySiteCode                  = "EMEA-ZRH"
                BlockActiveDirectorySiteAutoDiscovery    = $false
                BlockAutomaticLogin                      = $false
                CacheName                                = "CONTOSO.COM"
                Configurations                           = @(
                        MSFT_MicrosoftGraphKeyTypedValuePair{
                            Key       = "allowPasswordChange"
                            ODataType = "#microsoft.graph.keyBooleanValuePair"
                            Value     = $true
                        }
                    )
                CredentialBundleIdAccessControlList      = @("com.apple.Safari", "com.microsoft.edgemac")
                DomainRealms                             = @("contoso.com", "corp.contoso.com")
                Domains                                  = @("contoso.com", "corp.contoso.com")
                ExtensionIdentifier                      = "com.microsoft.CompanyPortalMac.ssoextension"
                IsDefaultRealm                           = $true
                ODataType                                = "#microsoft.graph.credentialSingleSignOnExtension"
                PasswordBlockModification                = $false
                PasswordChangeUrl                        = "https://passwordreset.contoso.com"
                PasswordEnableLocalSync                  = $true
                PasswordExpirationDays                   = 90
                PasswordExpirationNotificationDays       = 14
                PasswordMinimumAgeDays                   = 1
                PasswordMinimumLength                    = 12
                PasswordPreviousPasswordBlockCount       = 5
                PasswordRequireActiveDirectoryComplexity = $true
                PasswordRequirementsDescription          = "At least 12 characters, with an upper case letter, a lower case letter and a number"
                Realm                                    = "CONTOSO.COM"
                RequireUserPresence                      = $true
                TeamIdentifier                           = "UBF8T346G9"
                UrlPrefixes                              = @("https://intranet.contoso.com", "https://portal.contoso.com")
                UserPrincipalName                        = "mac.admin@$TenantId"
            };
            SleepDisabled                            = $false;
            Ensure                                   = "Present";
            ApplicationId                            = $ApplicationId;
            TenantId                                 = $TenantId;
            CertificateThumbprint                    = $CertificateThumbprint;
        }
    }
}

Example 3

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        IntuneDeviceFeaturesConfigurationPolicyMacOS 'IntuneDeviceFeaturesConfigurationPolicyMacOS-Example'
        {
            DisplayName           = "macOS Device Features";
            Ensure                = "Absent";
            ApplicationId         = $ApplicationId;
            TenantId              = $TenantId;
            CertificateThumbprint = $CertificateThumbprint;
        }
    }
}