# Install the Graph module if not already present
Install-Module Microsoft.Graph -Scope CurrentUser -Force

Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.ReadWrite.All"

# Create the user account
$PasswordProfile = @{
  Password = "TempP@ss2026!"
  ForceChangePasswordNextSignIn = $true
}

New-MgUser `
  -DisplayName "Jane Smith" `
  -UserPrincipalName "jsmith@contoso.com" `
  -MailNickname "jsmith" `
  -AccountEnabled `
  -PasswordProfile $PasswordProfile `
  -UsageLocation "GB" `
  -JobTitle "IT Engineer" `
  -Department "IT"

# Assign Microsoft 365 Business Premium licence (SPB SKU)
$Sku = Get-MgSubscribedSku | Where-Object {$_.SkuPartNumber -eq "SPB"}
$AddLicence = @{ SkuId = $Sku.SkuId }
Set-MgUserLicense -UserId "jsmith@contoso.com" -AddLicenses @($AddLicence) -RemoveLicenses @()

# Verify
Get-MgUser -UserId "jsmith@contoso.com" -Property DisplayName,UserPrincipalName,AssignedLicenses,AccountEnabled

Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.ReadWrite.All"

# CSV format: DisplayName,UPN,MailNickname,Department,JobTitle
$Users = Import-Csv -Path "C:\IT\NewUsers.csv"

foreach ($u in $Users) {
  $PasswordProfile = @{ Password = "Welcome1!"; ForceChangePasswordNextSignIn = $true }
  New-MgUser -DisplayName $u.DisplayName -UserPrincipalName $u.UPN -MailNickname $u.MailNickname `
    -AccountEnabled -PasswordProfile $PasswordProfile -UsageLocation "GB" `
    -Department $u.Department -JobTitle $u.JobTitle
  Write-Host "Created: $($u.UPN)" -ForegroundColor Green
}

# Export all licensed users org-wide
Get-MgUser -All -Property DisplayName,UserPrincipalName,AssignedLicenses,AccountEnabled,Department,JobTitle,UsageLocation |
  Where-Object {$_.AssignedLicenses.Count -gt 0} |
  Select-Object DisplayName,UserPrincipalName,AccountEnabled,Department,JobTitle,UsageLocation |
  Export-Csv -Path "LicensedUsersAudit.csv" -NoTypeInformation

Connect-MgGraph -Scopes "Group.ReadWrite.All","GroupMember.ReadWrite.All"

# Create a Microsoft 365 Group (Teams-connectable)
$Group = New-MgGroup `
  -DisplayName "Project Apollo" `
  -MailNickname "projectapollo" `
  -Description "Cross-functional project team for Apollo delivery" `
  -GroupTypes @("Unified") `
  -MailEnabled `
  -SecurityEnabled:$false

Write-Host "Group created: $($Group.Id)"

# Add owner
$Owner = Get-MgUser -Filter "UserPrincipalName eq 'pm@contoso.com'"
New-MgGroupOwner -GroupId $Group.Id -DirectoryObjectId $Owner.Id

# Add members
$Members = @("dev1@contoso.com", "dev2@contoso.com", "designer@contoso.com")
foreach ($m in $Members) {
  $User = Get-MgUser -Filter "UserPrincipalName eq '$m'"
  New-MgGroupMember -GroupId $Group.Id -DirectoryObjectId $User.Id
}

# List all members
Get-MgGroupMember -GroupId $Group.Id | ForEach-Object {
  Get-MgUser -UserId $_.Id | Select-Object DisplayName,UserPrincipalName
}

Connect-MgGraph -Scopes "RoleManagement.Read.Directory","User.Read.All"

# Audit all active admin role assignments
$Report = @()
$Roles = Get-MgDirectoryRole

foreach ($Role in $Roles) {
  $Members = Get-MgDirectoryRoleMember -DirectoryRoleId $Role.Id -ErrorAction SilentlyContinue
  foreach ($Member in $Members) {
    $User = Get-MgUser -UserId $Member.Id -ErrorAction SilentlyContinue
    if ($User) {
      $Report += [PSCustomObject]@{
        Role           = $Role.DisplayName
        AssignedTo     = $User.DisplayName
        UPN            = $User.UserPrincipalName
        AccountEnabled = $User.AccountEnabled
      }
    }
  }
}

# Display and export
$Report | Sort-Object Role,AssignedTo | Format-Table -AutoSize
$Report | Export-Csv -Path "AdminRoleAudit.csv" -NoTypeInformation
Write-Host "Total privileged assignments: $($Report.Count)"

Connect-ExchangeOnline

# Create the room mailbox
New-Mailbox -Room -Name "Meeting Room 3A" -DisplayName "Meeting Room 3A" `
  -Alias "meetingroom3a" -PrimarySmtpAddress "room3a@contoso.com"

# Configure auto-booking: accept when available, max 4hr, capacity 12
Set-CalendarProcessing -Identity "room3a@contoso.com" `
  -AutomateProcessing AutoAccept `
  -AddOrganizerToSubject $true `
  -DeleteComments $false `
  -MaximumDurationInMinutes 240 `
  -AllowConflicts $false `
  -BookingWindowInDays 180

Set-Mailbox -Identity "room3a@contoso.com" -ResourceCapacity 12

# List all room mailboxes with capacity
Get-Mailbox -RecipientTypeDetails RoomMailbox |
  Select-Object DisplayName,PrimarySmtpAddress,ResourceCapacity | Format-Table -AutoSize

Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.Read.All"

# List all available SKUs and consumption
Get-MgSubscribedSku | Select-Object SkuPartNumber,SkuId,ConsumedUnits,
  @{N="TotalUnits";E={$_.PrepaidUnits.Enabled}},
  @{N="Available";E={$_.PrepaidUnits.Enabled - $_.ConsumedUnits}} | Format-Table -AutoSize

# Assign Business Premium to a user
$BPSku = Get-MgSubscribedSku | Where-Object {$_.SkuPartNumber -eq "SPB"}
Set-MgUserLicense -UserId "jsmith@contoso.com" -AddLicenses @(@{SkuId=$BPSku.SkuId}) -RemoveLicenses @()

# Swap licence: remove Business Standard, add Business Premium atomically
$OldSku = Get-MgSubscribedSku | Where-Object {$_.SkuPartNumber -eq "O365_BUSINESS_PREMIUM"}
$NewSku = Get-MgSubscribedSku | Where-Object {$_.SkuPartNumber -eq "SPB"}
Set-MgUserLicense -UserId "jsmith@contoso.com" -AddLicenses @(@{SkuId=$NewSku.SkuId}) -RemoveLicenses @($OldSku.SkuId)

# Remove all licences from a user (e.g. off-boarding)
$User = Get-MgUser -UserId "leaver@contoso.com" -Property AssignedLicenses
$RemoveIds = $User.AssignedLicenses | Select-Object -ExpandProperty SkuId
Set-MgUserLicense -UserId "leaver@contoso.com" -AddLicenses @() -RemoveLicenses $RemoveIds

Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All"

# Find licensed users who have not signed in for 90+ days
$CutoffDate = (Get-Date).AddDays(-90).ToString("yyyy-MM-dd")

Get-MgUser -All -Property DisplayName,UserPrincipalName,AssignedLicenses,AccountEnabled,SignInActivity |
  Where-Object {
    $_.AssignedLicenses.Count -gt 0 -and
    $_.AccountEnabled -eq $true -and
    ($_.SignInActivity.LastSignInDateTime -lt $CutoffDate -or $_.SignInActivity.LastSignInDateTime -eq $null)
  } |
  Select-Object DisplayName,UserPrincipalName,
    @{N="LastSignIn";E={$_.SignInActivity.LastSignInDateTime}},
    @{N="LicenceCount";E={$_.AssignedLicenses.Count}} |
  Export-Csv -Path "LicenceWasteAudit.csv" -NoTypeInformation

Write-Host "Stale licensed accounts exported to LicenceWasteAudit.csv"

Connect-MgGraph -Scopes "Domain.ReadWrite.All"

# Add the domain to the tenant
New-MgDomain -Id "newdomain.com"

# Retrieve DNS verification records
$Domain = Get-MgDomain -DomainId "newdomain.com"
Get-MgDomainVerificationDnsRecord -DomainId "newdomain.com" |
  Select-Object RecordType,@{N="Value";E={$_.AdditionalProperties.text}},Label,Ttl

# After adding the TXT record to DNS, confirm verification
Confirm-MgDomain -DomainId "newdomain.com"

# Check domain status
Get-MgDomain -DomainId "newdomain.com" | Select-Object Id,IsVerified,IsDefault,SupportedServices

# Set as default domain for new users
Update-MgDomain -DomainId "newdomain.com" -IsDefault

Connect-MgGraph -Scopes "Reports.Read.All"

# Export Teams user activity (last 30 days) to CSV
Invoke-MgGraphRequest -Method GET "https://graph.microsoft.com/v1.0/reports/getTeamsUserActivityUserDetail(period='D30')" `
  -OutputFilePath "C:\Reports\TeamsActivity30d.csv"

# Export Exchange email activity (last 30 days)
Invoke-MgGraphRequest -Method GET "https://graph.microsoft.com/v1.0/reports/getEmailActivityUserDetail(period='D30')" `
  -OutputFilePath "C:\Reports\EmailActivity30d.csv"

# Export OneDrive usage by user (last 30 days)
Invoke-MgGraphRequest -Method GET "https://graph.microsoft.com/v1.0/reports/getOneDriveUsageAccountDetail(period='D30')" `
  -OutputFilePath "C:\Reports\OneDriveUsage30d.csv"

# Get M365 Apps activation counts
Invoke-MgGraphRequest -Method GET "https://graph.microsoft.com/v1.0/reports/getOffice365ActivationsUserDetail" `
  -OutputFilePath "C:\Reports\AppsActivations.csv"

Write-Host "All usage reports exported to C:\Reports\"

Connect-MgGraph -Scopes "ServiceHealth.Read.All"

# Get health overview for all M365 services
Get-MgServiceAnnouncementHealthOverview |
  Select-Object Service,Status |
  Sort-Object Status,Service |
  Format-Table -AutoSize

# Get all active incidents and advisories
Get-MgServiceAnnouncementIssue -Filter "Status ne 'resolved'" |
  Select-Object Title,Service,ImpactDescription,Status,StartDateTime |
  Sort-Object StartDateTime -Descending |
  Format-Table -AutoSize

# Get recent Message center posts (last 30 days)
$Since = (Get-Date).AddDays(-30).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgServiceAnnouncementMessage -Filter "LastModifiedDateTime ge $Since" |
  Select-Object Title,Category,Severity,ActionRequiredByDateTime,LastModifiedDateTime |
  Sort-Object LastModifiedDateTime -Descending |
  Format-Table -AutoSize

# Export action-required posts only
Get-MgServiceAnnouncementMessage -Filter "ActionRequiredByDateTime ne null" |
  Select-Object Title,Category,ActionRequiredByDateTime,LastModifiedDateTime |
  Export-Csv -Path "ActionRequired_MessageCenter.csv" -NoTypeInformation

Connect-MgGraph -Scopes "Domain.Read.All"

# List all verified domains in the tenant
Get-MgDomain | Select-Object Id,IsVerified,IsDefault,SupportedServices | Format-Table -AutoSize

# Get all required service DNS records for a domain
Get-MgDomainServiceConfigurationRecord -DomainId "contoso.com" |
  Select-Object RecordType,
    @{N="Label";E={$_.Label}},
    @{N="Ttl";E={$_.Ttl}},
    @{N="Value";E={
      if ($_.AdditionalProperties.mailExchange) { $_.AdditionalProperties.mailExchange }
      elseif ($_.AdditionalProperties.canonicalName) { $_.AdditionalProperties.canonicalName }
      elseif ($_.AdditionalProperties.text) { $_.AdditionalProperties.text }
      elseif ($_.AdditionalProperties.nameTarget) { $_.AdditionalProperties.nameTarget }
    }} |
  Format-Table -AutoSize

# Check DKIM signing configuration in Exchange Online
Connect-ExchangeOnline
Get-DkimSigningConfig -DomainName "contoso.com" |
  Select-Object Domain,Enabled,Status,Selector1CNAME,Selector2CNAME

Connect-MgGraph -Scopes "Policy.Read.All","Policy.ReadWrite.ConditionalAccess","UserAuthenticationMethod.Read.All"

# Check Security Defaults status
$SecDefaults = Get-MgPolicyIdentitySecurityDefaultEnforcementPolicy
Write-Host "Security Defaults Enabled: $($SecDefaults.IsEnabled)" -ForegroundColor $(if ($SecDefaults.IsEnabled) {"Green"} else {"Red"})

# Enable Security Defaults (if no Conditional Access policies exist)
Update-MgPolicyIdentitySecurityDefaultEnforcementPolicy -IsEnabled $true

# Report on MFA registration per user
Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
  Select-Object UserPrincipalName,
    IsMfaRegistered,
    IsMfaCapable,
    IsPasswordlessCapable,
    MethodsRegistered |
  Export-Csv -Path "MFARegistrationReport.csv" -NoTypeInformation

Write-Host "MFA registration report exported."