Photo by Will Myers on Unsplash

Microsoft 365 DSC

Outliers

Article from ADMIN 73/2023

By Nico Thiemer

The declarative PowerShell Desired State Configuration extension supports easy and transparent configuration of systems and applications. We describe the fairly complex initial setup and use of the Microsoft 365 Desired State Configuration.

In the Microsoft 365 environment, with its variety of configurations and multiple tenants to manage, Desired State Configuration (DSC) is an ideal way to track changes and reset a configuration to the desired state. Microsoft provides a great deal of information about the project [1], but in my experience, some of it is outdated. This article refers to the version available March 2022.

Preparations for DSC

Before setting up Microsoft 365 DSC (M365DSC), you need to create an Azure Active Directory (Azure AD) application that you will use later to authenticate the PowerShell script. Alternatively, you could log in with a username and password; I will look at the advantages and disadvantages of these methods in detail.

When authenticating with an Azure AD application, you use either a certificate you create yourself or a client secret. This example uses a certificate because it is the approach currently recommended by Microsoft. In the course of creating the Azure AD application, the certificate is stored in the certificate store of the currently logged in user – authentication only works for this user.

Working with SharePoint Online is essential in Microsoft 365, so most administrators use the PowerShell Office PnP module. Other approaches use the Azure AD web portal. However, I'll take the Office PnP route to create the Azure AD application. If you don't have the module installed, the following commands install it and grant the necessary rights to the PnP management shell in an administrative PowerShell:

Install-module PnP.PowerShell
Register-PnPManagementShellAccess

Then, create the Azure AD application with:

Register-PnPAzureADApp -ApplicationName DSCAuthApp -Tenant <tenant name on>.microsoft.com-OutPath c:\DSC-CertificatePassword (ConvertTo-SecureString -String

...

Use Express-Checkout link below to read the full article (PDF).