DSCResources/MSFT_IntuneAccountProtectionPolicy/MSFT_IntuneAccountProtectionPolicy.schema.mof
|
[ClassVersion("1.0.0.0")]
class MSFT_IntuneAccountProtectionPolicyAssignments { [Write, Description("The type of the target assignment."), ValueMap{"#microsoft.graph.groupAssignmentTarget", "#microsoft.graph.allLicensedUsersAssignmentTarget", "#microsoft.graph.allDevicesAssignmentTarget", "#microsoft.graph.exclusionGroupAssignmentTarget", "#microsoft.graph.configurationManagerCollectionAssignmentTarget"}, Values{"#microsoft.graph.groupAssignmentTarget", "#microsoft.graph.allLicensedUsersAssignmentTarget", "#microsoft.graph.allDevicesAssignmentTarget", "#microsoft.graph.exclusionGroupAssignmentTarget", "#microsoft.graph.configurationManagerCollectionAssignmentTarget"}] String dataType; [Write, Description("The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude."), ValueMap{"none", "include", "exclude"}, Values{"none", "include", "exclude"}] String deviceAndAppManagementAssignmentFilterType; [Write, Description("The Id of the filter for the target assignment.")] String deviceAndAppManagementAssignmentFilterId; [Write, Description("The group Id that is the target of the assignment.")] String groupId; [Write, Description("The group Display Name that is the target of the assignment.")] String groupDisplayName; [Write, Description("The collection Id that is the target of the assignment.(ConfigMgr)")] String collectionId; }; [ClassVersion("1.0.0.0"), FriendlyName("IntuneAccountProtectionPolicy")] class MSFT_IntuneAccountProtectionPolicy : OMI_BaseResource { [Write, Description("Identity of the account protection policy.")] String Identity; [Key, Description("Display name of the account protection rules policy.")] String DisplayName; [Write, Description("Description of the account protection rules policy.")] String Description; [Write, Description("Assignments of the Intune Policy."), EmbeddedInstance("MSFT_IntuneAccountProtectionPolicyAssignments")] String Assignments[]; [Write, Description("Block Windows Hello for Business."), ValueMap{"notConfigured", "true", "false"}, Values{"notConfigured", "true", "false"}] String WindowsHelloForBusinessBlocked; [Write, Description("Minimum PIN length must be between 4 and 127. (4-127)")] UInt32 PinMinimumLength; [Write, Description("Maximum PIN length must be between 4 and 127. (4-127)")] UInt32 PinMaximumLength; [Write, Description("If required, user PIN must include at least one lowercase letter."), ValueMap{"notConfigured", "blocked", "required", "allowed"}, Values{"notConfigured", "blocked", "required", "allowed"}] String PinLowercaseCharactersUsage; [Write, Description("If required, user PIN must include at least one uppercase letter."), ValueMap{"notConfigured", "blocked", "required", "allowed"}, Values{"notConfigured", "blocked", "required", "allowed"}] String PinUppercaseCharactersUsage; [Write, Description("If required, user PIN must include at least one special character."), ValueMap{"notConfigured", "blocked", "required", "allowed"}, Values{"notConfigured", "blocked", "required", "allowed"}] String PinSpecialCharactersUsage; [Write, Description("If configured, the user will be forced to change their PIN after the set number of days. (0, 730), 0 = Never")] UInt32 PinExpirationInDays; [Write, Description("If configured, the user will not be able to reuse this number of previous PINs. (0, 50), 0 = Do not remember.")] UInt32 PinPreviousBlockCount; [Write, Description("If enabled, the PIN recovery secret will be stored on the device and the user can change their PIN if needed. If disabled or not configured, the recovery secret will not be created or stored.")] Boolean PinRecoveryEnabled; [Write, Description("If you enable this policy setting, only devices with a usable TPM provision Windows Hello for Business. If you disable or do not configure this policy setting, the TPM is still preferred, but all devices provision Windows Hello for Business.")] Boolean SecurityDeviceRequired; [Write, Description("If allowed, Windows Hello for Business can authenticate using gestures, such as face and fingerprint. Users must still configure a PIN in case of failure.")] Boolean UnlockWithBiometricsEnabled; [Write, Description("If enabled, devices will use enhanced anti-spoofing, when available. If not configured, the client configuration for anti-spoofing will be honored.")] Boolean EnhancedAntiSpoofingForFacialFeaturesEnabled; [Write, Description("If configured, Windows Hello for Business can use certificates to authenticate to on-premise resources.")] Boolean UseCertificatesForOnPremisesAuthEnabled; [Write, Description("Enable Windows Hello security key as a logon credential for all PCs in the tenant.")] Boolean UseSecurityKeyForSignin; [Write, Description("Setting this Disable will disable the use of Credential Guard, which is the Windows default. Setting this to Enable with UEFI lock will enable Credential Guard and not allow it to be disabled remotely, as the UEFI persisted configuration must be manually cleared. Setting this to Enable without UEFI lock will enable Credential Guard and allow it to be turned off without physical access to the machine."), ValueMap{"notConfigured", "disable", "enableWithUEFILock", "enableWithoutUEFILock"}, Values{"notConfigured", "disable", "enableWithUEFILock", "enableWithoutUEFILock"}] String DeviceGuardLocalSystemAuthorityCredentialGuardSettings; [Write, Description("Present ensures the site collection exists, absent ensures it is removed"), ValueMap{"Present", "Absent"}, Values{"Present", "Absent"}] string Ensure; [Write, Description("Credentials of the Intune Admin"), EmbeddedInstance("MSFT_Credential")] string Credential; [Write, Description("Id of the Azure Active Directory application to authenticate with.")] String ApplicationId; [Write, Description("Name of the Azure Active Directory tenant used for authentication. Format contoso.onmicrosoft.com")] String TenantId; [Write, Description("Secret of the Azure Active Directory tenant used for authentication."), EmbeddedInstance("MSFT_Credential")] String ApplicationSecret; [Write, Description("Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication.")] String CertificateThumbprint; [Write, Description("Managed ID being used for authentication.")] Boolean ManagedIdentity; }; |