Connect-MgGraph -Scopes "User.ReadWrite.All","AuditLog.Read.All"

# Export all users with key properties
Get-MgUser -All -Property DisplayName,UserPrincipalName,AccountEnabled,UserType,CreatedDateTime,AssignedLicenses,Department,JobTitle |
  Select-Object DisplayName,UserPrincipalName,AccountEnabled,UserType,Department,JobTitle |
  Export-Csv -Path "AllUsers.csv" -NoTypeInformation

# Create a new cloud-only user
$PasswordProfile = @{
  Password                      = "TempP@ss2026!"
  ForceChangePasswordNextSignIn = $true
}
New-MgUser `
  -DisplayName "Jane Smith" `
  -UserPrincipalName "jane.smith@contoso.com" `
  -PasswordProfile $PasswordProfile `
  -AccountEnabled $true `
  -MailNickname "jane.smith" `
  -Department "Finance" `
  -JobTitle "Financial Analyst"

# Disable a user (blocks sign-in, preserves account and data)
Update-MgUser -UserId "jane.smith@contoso.com" -AccountEnabled $false

# Detect stale accounts (no sign-in for 90+ days, still enabled)
$Cutoff = (Get-Date).AddDays(-90).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgUser -All `
  -Filter "signInActivity/lastSignInDateTime le $Cutoff and accountEnabled eq true" `
  -Property DisplayName,UserPrincipalName,SignInActivity,AccountEnabled |
  Select-Object DisplayName,UserPrincipalName,@{N="LastSignIn";E={$_.SignInActivity.LastSignInDateTime}} |
  Export-Csv -Path "StaleUsers.csv" -NoTypeInformation

# Export all guest users for access review
Get-MgUser -All -Filter "userType eq 'Guest'" -Property DisplayName,UserPrincipalName,ExternalUserState,CreatedDateTime |
  Export-Csv -Path "GuestUsers.csv" -NoTypeInformation

Connect-MgGraph -Scopes "Group.ReadWrite.All","Directory.ReadWrite.All"

# Export all groups with type and membership info
Get-MgGroup -All -Property DisplayName,GroupTypes,SecurityEnabled,MailEnabled,MembershipRule,MembershipRuleProcessingState |
  Select-Object DisplayName,GroupTypes,SecurityEnabled,MailEnabled,MembershipRule |
  Export-Csv -Path "AllGroups.csv" -NoTypeInformation

# Create a static security group
New-MgGroup `
  -DisplayName "Finance Team" `
  -SecurityEnabled $true `
  -MailEnabled $false `
  -MailNickname "FinanceTeam"

# Create a Microsoft 365 Group (collaboration workspace)
New-MgGroup `
  -DisplayName "Project Phoenix" `
  -GroupTypes @("Unified") `
  -SecurityEnabled $false `
  -MailEnabled $true `
  -MailNickname "ProjectPhoenix"

# Create a dynamic security group (requires Entra ID P1)
New-MgGroup `
  -DisplayName "All Sales Users" `
  -SecurityEnabled $true `
  -MailEnabled $false `
  -MailNickname "AllSalesUsers" `
  -MembershipRule "(user.department -eq 'Sales') and (user.accountEnabled -eq true)" `
  -MembershipRuleProcessingState "On"

# Add a member to a static group
$Group = Get-MgGroup -Filter "DisplayName eq 'Finance Team'"
$User  = Get-MgUser  -Filter "UserPrincipalName eq 'user@contoso.com'"
New-MgGroupMember -GroupId $Group.Id -DirectoryObjectId $User.Id

# Find empty (orphan) groups
Get-MgGroup -All | ForEach-Object {
  $Count = (Get-MgGroupMember -GroupId $_.Id -All).Count
  if ($Count -eq 0) { Write-Host "EMPTY GROUP: $($_.DisplayName)" }
}

Connect-MgGraph -Scopes "Policy.ReadWrite.CrossTenantAccess","User.Read.All"

# Get default cross-tenant access policy
$Default = Get-MgPolicyCrossTenantAccessPolicyDefault
Write-Host "B2B Collaboration Inbound:  $($Default.B2BCollaborationInbound.UsersAndGroups.AccessType)"
Write-Host "B2B Collaboration Outbound: $($Default.B2BCollaborationOutbound.UsersAndGroups.AccessType)"

# Get all specific partner tenant configurations
Get-MgPolicyCrossTenantAccessPolicyPartner | Select-Object TenantId,IsServiceProvider | Format-Table -AutoSize

# Set guest invite restriction to admins + Guest Inviter role only
# Options: none | adminsAndGuestInviters | adminsGuestInvitersAndAllMembers | everyone
Update-MgPolicyAuthorizationPolicy -AllowInvitesFrom "adminsAndGuestInviters"

# Audit all guest users with sign-in activity
Get-MgUser -All -Filter "userType eq 'Guest'" `
  -Property DisplayName,UserPrincipalName,ExternalUserState,CreatedDateTime,SignInActivity |
  Select-Object DisplayName,UserPrincipalName,ExternalUserState,CreatedDateTime,
    @{N="LastSignIn";E={$_.SignInActivity.LastSignInDateTime}} |
  Export-Csv -Path "GuestUserAudit.csv" -NoTypeInformation

Connect-MgGraph -Scopes "Device.ReadWrite.All"

# Export all registered devices
Get-MgDevice -All -Property DisplayName,DeviceId,OperatingSystem,OperatingSystemVersion,IsManaged,IsCompliant,TrustType,ApproximateLastSignInDateTime,AccountEnabled |
  Select-Object DisplayName,DeviceId,OperatingSystem,OperatingSystemVersion,IsManaged,IsCompliant,TrustType,ApproximateLastSignInDateTime |
  Export-Csv -Path "AllDevices.csv" -NoTypeInformation

# Find stale devices (not signed in for 90+ days)
$Cutoff = (Get-Date).AddDays(-90)
Get-MgDevice -All -Property DisplayName,DeviceId,OperatingSystem,ApproximateLastSignInDateTime,AccountEnabled |
  Where-Object {$_.ApproximateLastSignInDateTime -lt $Cutoff -and $_.AccountEnabled -eq $true} |
  Export-Csv -Path "StaleDevices.csv" -NoTypeInformation

# Count devices by join type (TrustType)
# Workplace=Entra Registered, AzureAd=Entra Joined, ServerAd=Hybrid Joined
Get-MgDevice -All -Property TrustType |
  Group-Object TrustType |
  Select-Object Name,Count | Format-Table -AutoSize

# Disable then delete a stale device
$Device = Get-MgDevice -Filter "DisplayName eq 'STALE-LAPTOP-01'" | Select-Object -First 1
Update-MgDevice -DeviceId $Device.Id -AccountEnabled $false
Remove-MgDevice -DeviceId $Device.Id

Connect-MgGraph -Scopes "RoleManagement.Read.Directory","User.Read.All","AuditLog.Read.All"

# Audit all active directory role assignments
$RoleReport = @()
Get-MgDirectoryRole -All | ForEach-Object {
  $Role = $_
  $Members = Get-MgDirectoryRoleMember -DirectoryRoleId $Role.Id -All
  foreach ($Member in $Members) {
    $User = Get-MgUser -UserId $Member.Id -ErrorAction SilentlyContinue
    $RoleReport += [PSCustomObject]@{
      Role       = $Role.DisplayName
      MemberName = $User.DisplayName
      MemberUPN  = $User.UserPrincipalName
    }
  }
}
$RoleReport | Export-Csv -Path "AllRoleAssignments.csv" -NoTypeInformation

# Count permanent Global Admins (flag if more than 5)
$GARole = Get-MgDirectoryRole -Filter "DisplayName eq 'Global Administrator'"
$GACount = (Get-MgDirectoryRoleMember -DirectoryRoleId $GARole.Id -All).Count
Write-Host "Permanent Global Admins: $GACount  (Recommended: 5 or fewer)"

# Check MFA registration for all admins
Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
  Where-Object {$_.IsAdmin -eq $true} |
  Select-Object UserDisplayName,UserPrincipalName,IsMfaRegistered,IsPasswordlessCapable,MethodsRegistered |
  Format-Table -AutoSize

Connect-MgGraph -Scopes "Policy.Read.ConditionalAccess","Policy.ReadWrite.ConditionalAccess"

# Get all CA policies with state
Get-MgIdentityConditionalAccessPolicy -All |
  Select-Object DisplayName,State,CreatedDateTime,ModifiedDateTime |
  Sort-Object State,DisplayName |
  Format-Table -AutoSize

# Export CA policy audit report
Get-MgIdentityConditionalAccessPolicy -All |
  Select-Object DisplayName,State,Id,
    @{N="IncludeUsers";E={$_.Conditions.Users.IncludeUsers}},
    @{N="IncludeApps";E={$_.Conditions.Applications.IncludeApplications}} |
  Export-Csv -Path "CAPolicies.csv" -NoTypeInformation

# Find policies still in Report-only (not yet enforced)
Get-MgIdentityConditionalAccessPolicy -All |
  Where-Object {$_.State -eq "enabledForReportingButNotEnforced"} |
  Select-Object DisplayName,State,ModifiedDateTime |
  Format-Table -AutoSize

# Get all named locations (trusted IPs and countries)
Get-MgIdentityConditionalAccessNamedLocation -All |
  Select-Object DisplayName,OdataType,IsTrusted |
  Format-Table -AutoSize

Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All","Reports.Read.All"

# Get MFA registration status for all users
$MFAReport = Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
  Select-Object UserDisplayName,UserPrincipalName,IsAdmin,IsMfaRegistered,IsMfaCapable,IsPasswordlessCapable,IsSsprRegistered,MethodsRegistered

# Export full MFA registration report
$MFAReport | Export-Csv -Path "MFARegistrationReport.csv" -NoTypeInformation

# Users with NO MFA registered (sorted admins first — highest risk)
$MFAReport | Where-Object {$_.IsMfaRegistered -eq $false} |
  Select-Object UserDisplayName,UserPrincipalName,IsAdmin |
  Sort-Object IsAdmin -Descending |
  Format-Table -AutoSize

# Summary dashboard
Write-Host "Total Users:          $($MFAReport.Count)"
Write-Host "MFA Registered:       $(($MFAReport | Where-Object {$_.IsMfaRegistered}).Count)"
Write-Host "No MFA Registered:    $(($MFAReport | Where-Object {-not $_.IsMfaRegistered}).Count)"
Write-Host "Passwordless Capable: $(($MFAReport | Where-Object {$_.IsPasswordlessCapable}).Count)"

Connect-MgGraph -Scopes "IdentityRiskyUser.ReadWrite.All","IdentityRiskEvent.Read.All"

# Get all risky users (Entra ID P2 required)
Get-MgRiskyUser -All |
  Select-Object UserDisplayName,UserPrincipalName,RiskLevel,RiskState,RiskDetail,RiskLastUpdatedDateTime |
  Sort-Object RiskLevel -Descending |
  Format-Table -AutoSize

# Export high-risk users for immediate incident response
Get-MgRiskyUser -All -Filter "riskLevel eq 'high'" |
  Export-Csv -Path "HighRiskUsers.csv" -NoTypeInformation

# Confirm a user as compromised (forces password reset + revokes sessions)
$RiskyUser = Get-MgRiskyUser -Filter "UserPrincipalName eq 'compromised@contoso.com'"
Invoke-MgConfirmRiskyUserCompromised -UserIds @($RiskyUser.Id)
Write-Host "User confirmed compromised. Password reset required on next sign-in."

# Dismiss risk for false positive after investigation
$RiskyUser2 = Get-MgRiskyUser -Filter "UserPrincipalName eq 'falsepositive@contoso.com'"
Invoke-MgDismissRiskyUser -UserIds @($RiskyUser2.Id)

# Get all risk detections for SIEM export
Get-MgRiskDetection -All -Top 50 |
  Select-Object UserDisplayName,DetectionTimingType,RiskEventType,RiskLevel,IpAddress,Location |
  Format-Table -AutoSize

Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory","RoleEligibilitySchedule.ReadWrite.Directory"

# Get all PIM eligible role assignments
Get-MgRoleManagementDirectoryRoleEligibilityScheduleInstance -All |
  ForEach-Object {
    $Principal = Get-MgUser -UserId $_.PrincipalId -ErrorAction SilentlyContinue
    $Role      = Get-MgRoleManagementDirectoryRoleDefinition -UnifiedRoleDefinitionId $_.RoleDefinitionId
    [PSCustomObject]@{
      User      = $Principal.UserPrincipalName
      Role      = $Role.DisplayName
      StartTime = $_.StartDateTime
      EndTime   = $_.EndDateTime
    }
  } | Format-Table -AutoSize

# Get all currently ACTIVE PIM activations
Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance -All |
  Where-Object {$_.AssignmentType -eq "Activated"} |
  ForEach-Object {
    $Principal = Get-MgUser -UserId $_.PrincipalId -ErrorAction SilentlyContinue
    $Role      = Get-MgRoleManagementDirectoryRoleDefinition -UnifiedRoleDefinitionId $_.RoleDefinitionId
    [PSCustomObject]@{ User=$Principal.UserPrincipalName; Role=$Role.DisplayName; Start=$_.StartDateTime; End=$_.EndDateTime }
  } | Format-Table -AutoSize

# Self-activate a PIM eligible role for a time-limited task
$Params = @{
  Action           = "selfActivate"
  PrincipalId      = "your-user-object-id"
  RoleDefinitionId = "role-definition-id"
  DirectoryScopeId = "/"
  Justification    = "Password reset task - INC001234"
  ScheduleInfo     = @{
    StartDateTime = Get-Date
    Expiration    = @{ Type = "AfterDuration"; Duration = "PT4H" }
  }
}
New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -BodyParameter $Params
Write-Host "PIM role activation requested for 4 hours."

Connect-MgGraph -Scopes "AuditLog.Read.All"

# Get sign-in failures in the last 24 hours
$Since = (Get-Date).AddHours(-24).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogSignIn `
  -Filter "createdDateTime ge $Since and status/errorCode ne 0" `
  -All -Top 200 |
  Select-Object UserDisplayName,UserPrincipalName,AppDisplayName,
    @{N="ErrorCode";E={$_.Status.ErrorCode}},
    @{N="FailureReason";E={$_.Status.FailureReason}},
    IpAddress,CreatedDateTime |
  Export-Csv -Path "SignInFailures24h.csv" -NoTypeInformation

# Get audit log for user management events (last 7 days)
$Since7 = (Get-Date).AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogDirectoryAudit `
  -Filter "activityDateTime ge $Since7 and category eq 'UserManagement'" `
  -All -Top 500 |
  Select-Object ActivityDisplayName,ActivityDateTime,
    @{N="InitiatedBy";E={$_.InitiatedBy.User.UserPrincipalName}},
    @{N="Target";E={$_.TargetResources[0].UserPrincipalName}},Result |
  Export-Csv -Path "UserManagementAudit.csv" -NoTypeInformation

# Top 10 users with most sign-in failures (brute force detection)
Get-MgAuditLogSignIn -Filter "createdDateTime ge $Since7 and status/errorCode ne 0" -All |
  Group-Object UserPrincipalName |
  Sort-Object Count -Descending |
  Select-Object Name,Count -First 10 |
  Format-Table -AutoSize