From ead650d3261a090448468d40b7d4aa206cd11b26 Mon Sep 17 00:00:00 2001
From: Marco Wende <marco.wende@wende.it>
Date: Wed, 23 Sep 2026 09:05:34 +0200
Subject: [PATCH] Policies: Admin-Vorlagen-Export ohne verschachtelten $expand
 (MaxExpansionDepth=1)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Graph lehnt definitionValues?$expand=...,presentationValues($expand=presentation)
mit 400 ab ("$expand path too deep, max 1"). Jetzt definitionValues nur mit
'definition' expandieren (Tiefe 1) und presentationValues je definitionValue
separat mit 'presentation' nachladen (jeweils Tiefe 1). Liefert dieselben Daten
für den Re-Import (definition.id, presentation.id, value/values).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/PolicyIO.ps1 | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/PolicyIO.ps1 b/src/PolicyIO.ps1
index 24552b4..f7d1c2c 100644
--- a/src/PolicyIO.ps1
+++ b/src/PolicyIO.ps1
@@ -236,10 +236,24 @@ function Get-GraphPolicyDetail {
     # (definitionValues inkl. Definition + Presentation-Werten) separat expandieren.
     # -AsRawJson durchgaengig: bewahrt Ein-Element-Collections als Array (PS-5.1-
     # Hashtable-Modus wuerde sie skalarisieren -> 400 beim Re-Import).
+    # WICHTIG: presentationValues($expand=presentation) waere ein VERSCHACHTELTER
+    # Expand (Tiefe 2) -> Graph lehnt mit 400 ab ("$expand path too deep, max 1").
+    # Deshalb definitionValues nur mit 'definition' expandieren (Tiefe 1) und die
+    # presentationValues je definitionValue separat mit 'presentation' nachladen.
     if ($cfg.Key -eq 'administrativetemplate') {
-        $base = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$Id" -Method GET -AsRawJson
-        $dvUri = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$Id/definitionValues?`$expand=definition(`$select=id,classType,displayName,policyType,version),presentationValues(`$expand=presentation)"
+        $cfgRoot = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$Id"
+        $base = Invoke-MgGraphRequestRetry -Uri $cfgRoot -Method GET -AsRawJson
+        $dvUri = "$cfgRoot/definitionValues?`$expand=definition(`$select=id,classType,displayName,policyType,version)"
         $dvs = @(Get-GraphPaged -Uri $dvUri -AsRawJson)
+        foreach ($dv in $dvs) {
+            if (-not $dv) { continue }
+            $dvId = [string](Get-PolicyProp $dv 'id')
+            if (-not $dvId) { continue }
+            $pvUri = "$cfgRoot/definitionValues/$dvId/presentationValues?`$expand=presentation"
+            $pvs = @(Get-GraphPaged -Uri $pvUri -AsRawJson)
+            if ($dv -is [System.Collections.IDictionary]) { $dv['presentationValues'] = $pvs }
+            else { $dv | Add-Member -NotePropertyName presentationValues -NotePropertyValue $pvs -Force }
+        }
         if ($base -is [System.Collections.IDictionary]) { $base['definitionValues'] = $dvs }
         else { $base | Add-Member -NotePropertyName definitionValues -NotePropertyValue $dvs -Force }
         return $base