TenantAtlas/specs/025-policy-sets/plan.md

Plan: Policy Sets (Intune native bundling) (025)

Branch: feat/025-policy-sets
Date: 2026-01-04
Input: spec.md

Approach

1. Confirm Graph API surface:
   • resource: deviceAppManagement/policySets
   • item model + subresource path (/policySets/{id}/items)
   • assignments subresource (/policySets/{id}/assignments)
2. Add policySet to config/tenantpilot.php (category “Apps/MAM”, risk, restore mode).
3. Add contract entry in config/graph_contracts.php:
   • resource + type family
   • member hydration strategy for items (subresource)
   • assignments CRUD paths (if supported)
4. Extend snapshot capture to hydrate items (and assignments).
5. Implement restore preview “linking report”:
   • identify referenced object IDs inside items
   • attempt mapping by (type, displayName, externalId) where possible
   • surface missing dependencies and block execution by default
6. Add targeted Pest tests for sync + snapshot hydration + preview report.

Decisions / Notes

• Restore mode: default preview-only until a robust cross-tenant linking/mapping strategy exists.
• Policy Sets are not “settings restore”; they are primarily a relationship/linking restore step.