Create Account Protection policy

[iainfm]

Hi,

I'm trying to programmatically create a Local user group membership Account protection policy, but struggling to find any examples of how to achieve this. It even seems to have stumped ChatGPT, which offered some pretty good suggestions, but ultimately none worked.

Even if I could retrieve an existing policy, amend it, and create a new one based on it would be a huge help.

Any advice would be greatly appreciated!

[iainfm]

I've managed to make this work, with a mix of Edge network debugging and Graph Explorer. The issue seems to be that Graph Explorer and Graph X-Ray both create a $params array/hash that isn't accepted by New-MgDeviceManagementConfigurationPolicy, ie

$params = @{
    Name = "Device Admin - Iain McLaren on 34534534"
    Description = "SCTASK 01234567"
    Platforms = "windows10"
    Technologies = "mdm"
    RoleScopeTagIds = @(
	    "0"
    )
    Settings = @(
	    @{
		    "@odata.type" = "#microsoft.graph.deviceManagementConfigurationSetting"
		    SettingInstance = @{
			    "@odata.type" = "#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance"
			    SettingDefinitionId = "device_vendor_msft_policy_config_localusersandgroups_configure"
			    GroupSettingCollectionValue = @(
				    @{
					    Children = @(
						    @{
							    "@odata.type" = "#microsoft.graph.deviceManagementConfigurationGroupSettingCollectionInstance"
							    SettingDefinitionId = "device_vendor_msft_policy_config_localusersandgroups_configure_groupconfiguration_accessgroup"
							    GroupSettingCollectionValue = @(
								    @{
									    Children = @(
										    @{
<rest of code snipped>

This throws up an error that GroupSettingCollectionValue does not exist on type
'microsoft.management.services.api.deviceManagementConfigurationGroupSettingCollectionInstance'

Converting it to JSON (even with depth 100) gets it looking very similar to the JSON you can extract from the dev tools in Edge, but still didn't work.

So, I just took the Edge JSON extract and used that to code this: https://github.com/iainfm/AccountProtectionPolicy

Not sure if it's the right way to do it, but it works!