starred/CIPP

Fork 0

mirror of https://github.com/KelvinTegelaar/CIPP.git synced 2026-04-25 00:06:06 +03:00

[GH-ISSUE #5410] [Bug]: Encrypted OMA-URI values in Intune device configuration policies are not handled #2610

New issue

Open

opened 2026-03-02 13:53:43 +03:00 by kerem · 2 comments

kerem commented

2026-03-02 13:53:43 +03:00

Owner

Originally created by @alexrsagen on GitHub (Feb 20, 2026).
Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/5410

Required confirmations before submitting

I can reproduce this issue on the latest released versions of both CIPP and CIPP-API.
I have searched existing issues (both open and closed) to avoid duplicates.
I am not requesting general support; this is an actual bug report.

Issue Description

CIPP currently does not seem to handle encrypted OMA setting values.

These are used by Intune with the "Custom" policy template, which allows you to manually configure policies using OMA-URI.

Using the "Custom" policy template is necessary for new features, features that aren't yet included in a more specific policy template or settings catalog, or sometimes even for fully supported features such as Assigned Access or Local group membership, where the Intune UI is either simply wrong or doesn't allow you to provide all values supported by the setting.

When you access a policy containing an encrypted OMA setting value, you will get the value PGEvPg== (base64 encoded value of <a/>). This is just a placeholder value. We need to get the real value via the Graph API using the secretReferenceValueId property instead, which CIPP currently does not do.

Graph API endpoint to get encrypted OMA setting values: https://learn.microsoft.com/en-us/graph/api/intune-deviceconfig-deviceconfiguration-getomasettingplaintextvalue?view=graph-rest-1.0
PowerShell cmdlet to get encrypted OMA setting values: https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.devicemanagement/get-mgdevicemanagementdeviceconfigurationomasettingplaintextvalue?view=graph-powershell-1.0

Steps to reproduce

In Intune, create a new device configuration policy
- Platform: Windows 10 and later
- Profile type: Templates
- Template name: Custom
- Name: CIPP-LocalUsersAndGroups-TestPolicy

Add a new OMA-URI setting to the configuration policy

Name: Local group membership
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/LocalUsersAndGroups/Configure
Data type: String (XML file)

Custom XML:

<GroupConfiguration>
    <!-- BUILTIN\Users -->
    <accessgroup desc="S-1-5-32-545">
        <group action="U"/>
        <!-- BUILTIN\Authenticated Users -->
        <remove member="S-1-5-11"/>
        <!-- BUILTIN\Interactive -->
        <remove member="S-1-5-4"/>
        <!-- BUILTIN\Administrators -->
        <add member="S-1-5-32-544"/>
    </accessgroup>
</GroupConfiguration>

In CIPP, go to Intune -> Device Management -> Configuration Policies, find the policy and select Actions -> Create template based on policy
In CIPP, go to Intune -> Device Management -> Policy Templates, find the policy template and select Actions -> Edit Template. Observe the OMA setting placeholder value.
In CIPP, go to Tenant Administration -> Standards & Drift -> Standards Management -> Templates and select Add a new template
Click Add Standard to Template, select Intune Template, select the previously template we created earlier based on Intune policy
Run the standard for a different tenant than the one the policy was exported from and check the logbook. Observe the error message listed under "Relevant Logs / Stack Trace".

Environment Type

Front End Version

v10.0.9

Back End Version

v10.0.9

Relevant Logs / Stack Trace

Failed added policy CIPP-LocalUsersAndGroups-TestPolicy. Error:

{
"_version": 3,
"Message": "SecretReferenceValueId invalid for create. - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: [guid] - Url: https://proxy.msub06.manage.microsoft.com/DeviceConfiguration_2602/StatelessDeviceConfigurationFEService/deviceManagement/deviceConfigurations?api-version=5026-01-10",
"CustomApiErrorPhrase": "",
"RetryAfter": null,
"ErrorSourceService": "",
"HttpHeaders": "{}"
}

Originally created by @alexrsagen on GitHub (Feb 20, 2026). Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/5410 ### Required confirmations before submitting - [x] **I can reproduce this issue on the latest released versions** of both CIPP and CIPP-API. - [x] **I have searched existing issues** (both open and closed) to avoid duplicates. - [x] I am **not** requesting general support; this is an actual bug report. ### Issue Description CIPP currently does not seem to handle encrypted OMA setting values. These are used by Intune with the "Custom" policy template, which allows you to manually configure policies using OMA-URI. Using the "Custom" policy template is necessary for new features, features that aren't yet included in a more specific policy template or settings catalog, or sometimes even for fully supported features such as Assigned Access or Local group membership, where the Intune UI is either simply wrong or doesn't allow you to provide all values supported by the setting. When you access a policy containing an encrypted OMA setting value, you will get the value `PGEvPg==` (base64 encoded value of `<a/>`). This is just a placeholder value. We need to get the real value via the Graph API using the `secretReferenceValueId` property instead, **which CIPP currently does not do**. - Graph API endpoint to get encrypted OMA setting values: https://learn.microsoft.com/en-us/graph/api/intune-deviceconfig-deviceconfiguration-getomasettingplaintextvalue?view=graph-rest-1.0 - PowerShell cmdlet to get encrypted OMA setting values: https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.devicemanagement/get-mgdevicemanagementdeviceconfigurationomasettingplaintextvalue?view=graph-powershell-1.0 ### Steps to reproduce 1. In Intune, create a new device configuration policy - Platform: Windows 10 and later - Profile type: Templates - Template name: Custom - Name: CIPP-LocalUsersAndGroups-TestPolicy 2. Add a new OMA-URI setting to the configuration policy - Name: Local group membership - OMA-URI: `./Device/Vendor/MSFT/Policy/Config/LocalUsersAndGroups/Configure` - Data type: String (XML file) - Custom XML: ```xml <GroupConfiguration>  <accessgroup desc="S-1-5-32-545"> <group action="U"/>  <remove member="S-1-5-11"/>  <remove member="S-1-5-4"/>  <add member="S-1-5-32-544"/> </accessgroup> </GroupConfiguration> ``` 3. In CIPP, go to Intune -> Device Management -> Configuration Policies, find the policy and select Actions -> Create template based on policy 4. In CIPP, go to Intune -> Device Management -> Policy Templates, find the policy template and select Actions -> Edit Template. Observe the OMA setting placeholder value. 5. In CIPP, go to Tenant Administration -> Standards & Drift -> Standards Management -> Templates and select Add a new template 6. Click Add Standard to Template, select Intune Template, select the previously template we created earlier based on Intune policy 7. Run the standard **for a different tenant than the one the policy was exported from** and check the logbook. Observe the error message listed under "Relevant Logs / Stack Trace". ### Environment Type Sponsored (paying) user ### Front End Version v10.0.9 ### Back End Version v10.0.9 ### Relevant Logs / Stack Trace Failed added policy CIPP-LocalUsersAndGroups-TestPolicy. Error: ```json { "_version": 3, "Message": "SecretReferenceValueId invalid for create. - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: [guid] - Url: https://proxy.msub06.manage.microsoft.com/DeviceConfiguration_2602/StatelessDeviceConfigurationFEService/deviceManagement/deviceConfigurations?api-version=5026-01-10", "CustomApiErrorPhrase": "", "RetryAfter": null, "ErrorSourceService": "", "HttpHeaders": "{}" } ```

kerem added the

bug

unconfirmed-by-user

not-assigned

labels

2026-03-02 13:53:43 +03:00

kerem commented

2026-03-02 13:53:44 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Feb 20, 2026):

Thank you for reporting a potential bug. If you would like to work on this bug, please comment:

I would like to work on this please!

Thank you for helping us maintain the project!

@github-actions[bot] commented on GitHub (Feb 20, 2026): Thank you for reporting a potential bug. If you would like to work on this bug, please comment: > I would like to work on this please! Thank you for helping us maintain the project!

kerem commented

2026-03-02 13:53:44 +03:00

Author

Owner

@alexrsagen commented on GitHub (Feb 20, 2026):

Here's an example of how to use the mentioned Graph API to extract the encrypted OMA setting values:

github.com/eneerge/Azure-Intune-Export-DeviceConfiguration-Decrypts@798ca7d04f/DeviceConfiguration_Export.ps1 (L152-L213)

@alexrsagen commented on GitHub (Feb 20, 2026): Here's an example of how to use the mentioned Graph API to extract the encrypted OMA setting values: https://github.com/eneerge/Azure-Intune-Export-DeviceConfiguration-Decrypts/blob/798ca7d04f38459d38e7b4334ae23e9d9c6b2a1b/DeviceConfiguration_Export.ps1#L152-L213

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/CIPP#2610

No description provided.

Rows
Columns