[Feature] - Missing auditRuleInformation causes mismatch with monitoring tools

[jackluz84]

Baseline Info (please complete the following information):

• OS: [e.g. Windows]
• Version: [e.g. 3.6] - version 3.6 policies tested

Describe the bug
These existing .json files in this repo do not reflect recent changes in graph. For example, STIG audit baseline features. To be more specific, the stored .json policies in this repo do not have auditRuleInformation. When assigned, this line is appended for each setting. This causes M365 policy management tools to report drift/mismatch (e.g. Nerdio Manager and Inforcer).

solution: The policies need to be updated to reflect the latest intune/graph changes.

To Reproduce
Steps to reproduce the behaviour:
Sync this repo. Assign one of the itnune policies. compare the differences between the GH source .json policy and the .json that lands in the tenant. you will see auditRuleInformation added to the destination tenant polciy and these are absent in these policies here.

Expected behaviour
Policies should match aside from a few little expected metadata changes (usual noise)

Screenshots

Additional context
I tested with both Win - OIB - SC - Microsoft Edge - D - Updates - v3.6 and Win - OIB - ES - Attack Surface Reduction - D - ASR Rules (Audit Mode) - v3.1 and observed the same results.

this repo just has to catch up to some recent changes.

[SkipToTheEndpoint]

Hey @jackluz84

Thanks for raising this. I think this is partially due to me using IntuneManagement to do policy export and the format and it puts policies in is somewhat custom to it. I did just try a brand new export of a policy now using it and it does seem that auditRuleInformation seems to be a default property it's pulling back.

I'm conflicted as to how to deal with this. Graph is a constantly moving goalpost and Microsoft regularly mess about with properties, so doing a full re-export of policies is potentially only a temporary fix until something else crops up, and makes repo change tracking really dirty.
Additionally, trying to cater to specific commercial tools isn't really a path I want to go down either, and it sounds like (IMO) they're doing a somewhat lazy drift comparison if they're suddenly flagging a property of a feature that itself is only available in US GCC High tenants.

I'll leave this open for the time being to see if anyone else has any thoughts, but I am going to reclassify this as a Feature Request rather than a bug.