Update-M365DSCModule, Update-M365DSCDependencies: Make Scope available

[fasteiner]

Description of the issue

The user might not be able to install modules as administrator, hence it would be wise to enable the option to specify the Scope:
Instead of:

Install-Module $dependency.ModuleName -RequiredVersion $dependency.RequiredVersion -AllowClobber -Force -Scope 'AllUsers'

Use:

[CmdletBinding()]
    param
    (
        [Parameter()]
        [Switch]
        $Force,

        [Parameter()]
        [Switch]
        $ValidateOnly,
        $Scope = "AllUsers"
    )
....
Install-Module $dependency.ModuleName -RequiredVersion $dependency.RequiredVersion -AllowClobber -Force -Scope '$Scope'

Microsoft 365 DSC Version

V1.23.823.1

Which workloads are affected

other

The DSC configuration

not relevant, it is a problem with the module dependency update

Verbose logs showing the problem

Import-Module reversedsc
subotitsch  ~\Documents\GIT\service-request-automation\feature  feature/ITOPSCONFI-2791-cloud-only-user-workflow  Update-M365DSCModule

Scanning Dependencies [Processing ]
Could not update or import {Microsoft.Graph.Beta.DeviceManagement}

Error-Mesage: Cannot update the dependencies for Microsoft365DSC. You need to run this command as a local administrator.

Scanning Dependencies [Processing ]
Could not update or import {Microsoft.Graph.Beta.Devices.CorporateManagement}

Error-Mesage: Cannot update the dependencies for Microsoft365DSC. You need to run this command as a local administrator.

Scanning Dependencies [Processing ]
Could not update or import {Microsoft.Graph.Beta.DeviceManagement.Administration}

Error-Mesage: Cannot update the dependencies for Microsoft365DSC. You need to run this command as a local administrator.

Scanning Dependencies [Processing ]
Could not update or import {Microsoft.Graph.Beta.DeviceManagement.Enrollment}

Error-Mesage: Cannot update the dependencies for Microsoft365DSC. You need to run this command as a local administrator.

Scanning Dependencies [Processing ]
Could not update or import {Microsoft.Graph.Beta.Identity.DirectoryManagement}

Error-Mesage: Cannot update the dependencies for Microsoft365DSC. You need to run this command as a local administrator.

Scanning Dependencies [Processing ]
Could not update or import {Microsoft.Graph.Beta.Identity.Governance}

Error-Mesage: Cannot update the dependencies for Microsoft365DSC. You need to run this command as a local administrator.

Scanning Dependencies [Processing ]
Could not update or import {Microsoft.Graph.Beta.Identity.SignIns}

Error-Mesage: Cannot update the dependencies for Microsoft365DSC. You need to run this command as a local administrator.

Scanning Dependencies [Processing ]
Could not update or import {Microsoft.Graph.Beta.Teams}

Error-Mesage: Cannot update the dependencies for Microsoft365DSC. You need to run this command as a local administrator.

Scanning Dependencies [Processing ]
Could not update or import {Microsoft.Graph.Beta.DirectoryObjects}

Error-Mesage: Cannot update the dependencies for Microsoft365DSC. You need to run this command as a local administrator.

Scanning Dependencies [Processing ]
Could not update or import {PnP.PowerShell}

Error-Mesage: Cannot update the dependencies for Microsoft365DSC. You need to run this command as a local administrator.

Scanning Dependencies [Processing ]
Could not update or import {ReverseDSC}

Error-Mesage: Cannot update the dependencies for Microsoft365DSC. You need to run this command as a local administrator.

Uninstalling PnP.PowerShell Version {2.2.0}

Scanning Dependencies [Processing ]
Uninstalling ReverseDSC Version {2.0.0.18}

Scanning Dependencies [Processing ]
Checking Microsoft.Graph.Authentication

Scanning Dependencies [Processing ]
Uninstalling Microsoft.Graph.Authentication version {2.1.0}

Scanning Dependencies [Processing ]

Environment Information + PowerShell Version

OsName               : Microsoft Windows 10 Enterprise
OsOperatingSystemSKU : EnterpriseEdition
OsArchitecture       : 64-Bit
WindowsVersion       : 2009
WindowsBuildLabEx    : 19041.1.amd64fre.vb_release.191206-1406
OsLanguage           : en-US
OsMuiLanguages       : {en-US, de-DE}


Name                           Value
----                           -----
PSVersion                      7.3.6
PSEdition                      Core
GitCommitId                    7.3.6
OS                             Microsoft Windows 10.0.19045
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

[ykuijs]

Please keep in mind:
Installing the modules in the CurrentUser scope has a major downside: It works fine for an export, but doesn't work for a config deployment. A config deployment is executed by the LCM, which is running as System by default. So if you install the modules in your user scope, the LCM is unable to access these.

[fasteiner]

@ykuijs
You can as well deploy configurations without LCM using "Invoke-DscResource", therefore I would leave it open to the users how they want to install the Module, otherwise some might consider replicating the functionalities on their own instead.

Especially when you look at automation that uses DSC to provision resources with parameters, you do not want to run it in admin context, as it is simply not required:

....
$groupParams = @{
        Name       = 'AADGroup'
        Property   = @{
            Description           = $json.description
            DisplayName           = $DisplayName
            Ensure                = ($json.requestType -notlike "Delete*")? ("Present") : ("Absent")
            Members               = $groupMembers
            SecurityEnabled       = (!$mail)
            MailEnabled           = ($mail) ? ($true) : ($false)
            MailNickname          = $mail ? $mail.Split("@")[0]: "00000000-0000-0000-0000-000000000000"
            ApplicationId         = $env:APPREGID
            TenantId              = $env:AzureTenant
            CertificateThumbprint = $thumbprint
        }
        ModuleName = 'Microsoft365DSC'
    }
    $state = Invoke-DscResource @groupParams -Method Test
    if (-not $state.InDesiredState) {
        Invoke-DscResource @groupParams -Method Set | Out-Null
    }
....