Describe the bug
When running IntuneCD-startupdate with the -u flag, changes made exclusively to the assignments block of a Settings Catalog YAML file are silently not applied to Intune. The policy settings are compared correctly and "No changes found" is logged, but the updated assignments are never pushed despite -u being specified.
Two scenarios are affected:
- Removal-only assignment change (e.g. removing an exclusion group): update_assignment in BaseGraphModule.py only returns data when iterable_item_added is non-empty. A pure removal produces no iterable_item_added entries → function returns None → no API call is made.
- Replacement of one assignment type with another (e.g. group → allDevices): get_object_assignment strips groupId from Intune-side data before comparison. This causes DeepDiff to classify the change as values_changed rather than iterable_item_added, again resulting in added being empty → None returned.
Both paths silently return None with no log output indicating that an assignment update was skipped.
To Reproduce
- Have a Settings Catalog policy in Intune assigned to a specific group.
- In the repo YAML, change the assignment to allDevicesAssignmentTarget (or remove an exclusion group assignment).
- Run IntuneCD-startupdate -m 1 -p -u
- Observe: log shows "No changes found" for the policy, Intune assignment is unchanged.
Expected behavior
With -u specified, any assignment change in the YAML — including removals and type replacements — should be detected and applied to Intune, independent of whether settings changed.
Run type:
- Mode: 1
- Client: Pipeline (TeamCity, Docker)
- Version: 2.6.0
Additional context
Root cause is in two places:
- src/IntuneCD/update/Intune/SettingsCatalog.py line 29–31: exclude_paths = ["root['assignments']"] correctly excludes assignments from settings diff, but the assignment handling path (handle_assignments) then relies on update_assignment which has the bugs below.
- src/IntuneCD/intunecdlib/BaseGraphModule.py lines 855–868: update_assignment only calls return repo_data when added is non-empty. Removal-only diffs never set added, so the function silently returns None.
- src/IntuneCD/intunecdlib/BaseGraphModule.py lines 673–684: get_object_assignment removes groupId from Intune assignment data before diff comparison, which can prevent DeepDiff from generating iterable_item_added entries for type-change scenarios, hitting the same dead path.
Identified with Claude Sonnet 4.5 medium effort
Describe the bug
When running IntuneCD-startupdate with the
-uflag, changes made exclusively to the assignments block of a Settings Catalog YAML file are silently not applied to Intune. The policy settings are compared correctly and "No changes found" is logged, but the updated assignments are never pushed despite -u being specified.Two scenarios are affected:
Both paths silently return None with no log output indicating that an assignment update was skipped.
To Reproduce
Expected behavior
With -u specified, any assignment change in the YAML — including removals and type replacements — should be detected and applied to Intune, independent of whether settings changed.
Run type:
Additional context
Root cause is in two places:
Identified with Claude Sonnet 4.5 medium effort