EXOAddressBookPolicy error: Set-DynamicDistributionGroup cannot be created because function capacity 4096 has been exceeded for this scope

[techthoughts2]

Description of the issue

When updating from 1.24.207.2 to 1.24.214.2 we are now experiencing an error with the EXOAddressBookPolicy resource:

PowerShell DSC resource MSFT_EXOAddressBookPolicy  failed to execute Test-TargetResource functionality with error message: Function Set-DynamicDistributionGroup cannot be created because function capacity 4096 has been exceeded for this scope.
    + CategoryInfo          : InvalidOperation: (root/Microsoft/...gurationManager:String) [], CimException
    + FullyQualifiedErrorId : ProviderOperationExecutionFailure
    + PSComputerName        : localhost

We have tried increasing the function and variable count limits, but this has had no effect:

$Script:MaximumFunctionCount = 18000
$Script:MaximumVariableCount = 18000

Microsoft 365 DSC Version

V1.24.214.2

Which workloads are affected

Exchange Online

The DSC configuration

EXOAddressBookPolicy "EXOAddressBookPolicy-Company Address Lists" {
    AddressLists          = @("\All Distribution Lists");
    Ensure                = "Present";
    GlobalAddressList     = "\Default Global Address List";
    Name                  = "Company Address Lists";
    OfflineAddressBook    = "\Default Offline Address Book";
    RoomList              = "\All Rooms";
    ApplicationId         = $ApplicationId
    TenantId              = $TenantId
    CertificateThumbprint = $Thumbprint
}

Verbose logs showing the problem

ERBOSE: [WORKERNODE]: LCM:  [ Start  Resource ]  [[EXOAddressBookPolicy]EXOAddressBookPolicy-Name Address Lists::[Exchange]Exchange_Configuration]
VERBOSE: [WORKERNODE]: LCM:  [ Start  Test     ]  [[EXOAddressBookPolicy]EXOAddressBookPolicy-Name Address Lists::[Exchange]Exchange_Configuration]
VERBOSE: [WORKERNODE]:                            [[EXOAddressBookPolicy]EXOAddressBookPolicy-Name Address Lists::[Exchange]Exchange_Configuration] Testing Address Book Policy configuration for Amazon Address Lists
VERBOSE: [WORKERNODE]:                            [[EXOAddressBookPolicy]EXOAddressBookPolicy-Name Address Lists::[Exchange]Exchange_Configuration] Getting Address Book Policy configuration for Amazon Address Lists
DEBUG: [WORKERNODE]:                            [[EXOAddressBookPolicy]EXOAddressBookPolicy-Name Address Lists::[Exchange]Exchange_Configuration] ClientCertificateCredential.GetToken invoked. Scopes: [ https://graph.microsoft.com/.default ] ParentRequestId:
DEBUG: [WORKERNODE]:                            [[EXOAddressBookPolicy]EXOAddressBookPolicy-Name Address Lists::[Exchange]Exchange_Configuration] False MSAL 4.56.0.0 MSAL.Desktop 4.8 or later Windows Server 2022 Datacenter [2024-02-15 23:59:16Z -
xx111111-1x1x-11xx-1x1] MSAL MSAL.Desktop with assembly version '4.56.0.0'. CorrelationId(xx111111-1x1x-11xx-1x1)
DEBUG: [WORKERNODE]:                            [[EXOAddressBookPolicy]EXOAddressBookPolicy-Name Address Lists::[Exchange]Exchange_Configuration] False MSAL 4.56.0.0 MSAL.Desktop 4.8 or later Windows Server 2022 Datacenter [2024-02-15 23:59:16Z -
xx111111-1x1x-11xx-1x1] === AcquireTokenForClientParameters ===
SendX5C: False
ForceRefresh: False
DEBUG: [WORKERNODE]:                            [[EXOAddressBookPolicy]EXOAddressBookPolicy-Name Address Lists::[Exchange]Exchange_Configuration] False MSAL 4.56.0.0 MSAL.Desktop 4.8 or later Windows Server 2022 Datacenter [2024-02-15 23:59:16Z -
xx111111-1x1x-11xx-1x1]
=== Request Data ===
Authority Provided? - True
Scopes - https://graph.microsoft.com/.default
Extra Query Params Keys (space separated) -
ApiId - AcquireTokenForClient
IsConfidentialClient - True
SendX5C - False
LoginHint ? False
IsBrokerConfigured - False
HomeAccountId - False
CorrelationId - xx111111-1x1x-11xx-1x1
UserAssertion set: False
LongRunningOboCacheKey set: False
Region configured:
DEBUG: [WORKERNODE]:                            [[EXOAddressBookPolicy]EXOAddressBookPolicy-Name Address Lists::[Exchange]Exchange_Configuration] False MSAL 4.56.0.0 MSAL.Desktop 4.8 or later Windows Server 2022 Datacenter [2024-02-15 23:59:16Z -
xx111111-1x1x-11xx-1x1] === Token Acquisition (ClientCredentialRequest) started:
  Scopes: https://graph.microsoft.com/.default
 Authority Host: login.microsoftonline.com
DEBUG: [WORKERNODE]:                            [[EXOAddressBookPolicy]EXOAddressBookPolicy-Name Address Lists::[Exchange]Exchange_Configuration] False MSAL 4.56.0.0 MSAL.Desktop 4.8 or later Windows Server 2022 Datacenter [2024-02-15 23:59:16Z -
xx111111-1x1x-11xx-1x1] [Region discovery] Not using a regional authority.
DEBUG: [WORKERNODE]:                            [[EXOAddressBookPolicy]EXOAddressBookPolicy-Name Address Lists::[Exchange]Exchange_Configuration] False MSAL 4.56.0.0 MSAL.Desktop 4.8 or later Windows Server 2022 Datacenter [2024-02-15 23:59:16Z -
xx111111-1x1x-11xx-1x1] Access token is not expired. Returning the found cache entry. [Current time (02/15/2024 23:59:16) - Expiration Time (02/16/2024 00:52:08 +00:00) - Extended Expiration Time (02/16/2024 00:52:08 +00:00)]
DEBUG: [WORKERNODE]:                            [[EXOAddressBookPolicy]EXOAddressBookPolicy-Name Address Lists::[Exchange]Exchange_Configuration] False MSAL 4.56.0.0 MSAL.Desktop 4.8 or later Windows Server 2022 Datacenter [2024-02-15 23:59:16Z -
xx111111-1x1x-11xx-1x1]
 === Token Acquisition finished successfully:
DEBUG: [WORKERNODE]:                            [[EXOAddressBookPolicy]EXOAddressBookPolicy-Name Address Lists::[Exchange]Exchange_Configuration] False MSAL 4.56.0.0 MSAL.Desktop 4.8 or later Windows Server 2022 Datacenter [2024-02-15 23:59:16Z -
xx111111-1x1x-11xx-1x1]  AT expiration time: 2/16/2024 12:52:08 AM +00:00, scopes: https://graph.microsoft.com/.default. source: Cache
DEBUG: [WORKERNODE]:                            [[EXOAddressBookPolicy]EXOAddressBookPolicy-Name Address Lists::[Exchange]Exchange_Configuration] ClientCertificateCredential.GetToken succeeded. Scopes: [ https://graph.microsoft.com/.default ] ParentRequestId:  ExpiresOn:
2024-02-16T00:52:08.0000000+00:00
VERBOSE: [WORKERNODE]: LCM:  [ End    Test     ]  [[EXOAddressBookPolicy]EXOAddressBookPolicy-Name Address Lists::[Exchange]Exchange_Configuration] False in 8.9580 seconds.
VERBOSE: [WORKERNODE]: LCM:  [ *FAILED*Compare  ]     Completed processing compare operation. The operation returned False.
PowerShell DSC resource MSFT_EXOAddressBookPolicy  failed to execute Test-TargetResource functionality with error message: Function Set-DynamicDistributionGroup cannot be created because function capacity 4096 has been exceeded for this scope.
    + CategoryInfo          : InvalidOperation: (root/Microsoft/...gurationManager:String) [], CimException
    + FullyQualifiedErrorId : ProviderOperationExecutionFailure
    + PSComputerName        : localhost

Environment Information + PowerShell Version

OsName               : Microsoft Windows Server 2022 Datacenter
OsOperatingSystemSKU : DatacenterServerEdition
OsArchitecture       : 64-bit
WindowsVersion       : 2009
WindowsBuildLabEx    : 20348.1.amd64fre.fe_release.210507-1500
OsLanguage           : en-US
OsMuiLanguages       : {en-US}



Name                           Value
----                           -----
PSVersion                      5.1.20348.2227
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.20348.2227
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

[techthoughts2]

This one is odd because I don't see Set-DynamicDistributionGroup referenced anywhere in the code-base.

Not sure what it's involvement is here.

This error is occurring on Test-DSCConfiguation so I wouldn't expect a Set command to be involved.

[andikrueger]

We investigated a similar issue within M365DSC a few week ago. See: https://github.com/microsoft/Microsoft365DSC/pull/3504

This here does look different. Are there plenty of other EXO Resource prior to this error happening? Could you duplicate the failing resource of your current configuration and run this within a new configuration for testing purposes?

The MaxFunctionCount issue occurs in cases when too many functions are exposed. I guess there are some "housekeeping" issues within the EXO session.

[NikCharlebois]

Let me look into it, at some point we were forcing the $Global:MaximumFunctionCount variable within the New-M365DSCConnection function to get around this. This is unfortunately a limitation of PowerShell 5. PowerShell 7 has no such limits.

[techthoughts2]

Downgrading to 1.24.207.2 resolved the issue for the time being.

Are there plenty of other EXO Resource prior to this error happening?

No, this is failing on the first EXO resource in the config.

[NikCharlebois]

I would be curious to see if you are getting this error with 1.24.221.1. We added and implicit call to increase the method limit.

[techthoughts2]

We tested today and this is resolved when trying 1.24.313.1.