<# EasyLifeIT  |  Microsoft 365 security check  |  READ ONLY

   What this does
     Signs in to Microsoft Graph using read only permissions, counts a
     handful of configuration items, and prints a short summary as JSON.

   What it does not do
     It changes nothing in your tenant. It collects no names, no email
     addresses and no message content, only counts and settings. The
     summary stays on your machine unless you choose to paste it somewhere.

   Please read this script before you run it. You should never run anything
   from the internet that you have not looked at first. #>

$ErrorActionPreference = 'Stop'

function Invoke-Safe {
    param([scriptblock]$Block, $Default = $null)
    try { & $Block } catch { return $Default }
}

# Only the five Graph modules this script actually uses. Installing the whole
# Microsoft.Graph meta module pulls in about forty and can take fifteen minutes.
$needed = @(
    'Microsoft.Graph.Authentication',
    'Microsoft.Graph.Users',
    'Microsoft.Graph.Identity.DirectoryManagement',
    'Microsoft.Graph.Identity.SignIns',
    'Microsoft.Graph.Reports'
)

foreach ($m in $needed) {
    if (-not (Get-Module -ListAvailable -Name $m)) {
        Write-Host ("Installing {0} for your user account only." -f $m) -ForegroundColor Yellow
        Install-Module $m -Scope CurrentUser -Force -AllowClobber
    }
}

try {
    Connect-MgGraph -NoWelcome -Scopes @(
        'Directory.Read.All',
        'Policy.Read.All',
        'UserAuthenticationMethod.Read.All',
        'AuditLog.Read.All',
        'Reports.Read.All'
    )
} catch {
    Write-Host ''
    Write-Host 'Sign in did not complete.' -ForegroundColor Red
    Write-Host ''
    Write-Host 'If you saw a screen headed "Need admin approval", the read only permissions this'
    Write-Host 'script uses have not been approved in your tenant yet. Microsoft requires an'
    Write-Host 'administrator to approve its own Graph Command Line Tools application once,'
    Write-Host 'before anyone can use it. Ask a Global Administrator to run this script, or to'
    Write-Host 'approve that application, and afterwards a Global Reader account is enough.'
    return
}

$absent = @(
    'Get-MgUser',
    'Get-MgDirectoryRole',
    'Get-MgIdentityConditionalAccessPolicy',
    'Get-MgPolicyAuthorizationPolicy',
    'Get-MgReportAuthenticationMethodUserRegistrationDetail'
) | Where-Object { -not (Get-Command $_ -ErrorAction SilentlyContinue) }

if ($absent) {
    Write-Host ''
    Write-Host 'Some commands are missing, so parts of the check will be skipped:' -ForegroundColor Yellow
    $absent | ForEach-Object { Write-Host ("  {0}" -f $_) -ForegroundColor Yellow }
    Write-Host ''
}

$out = [ordered]@{
    schema    = 1
    generated = (Get-Date).ToUniversalTime().ToString('s') + 'Z'
}

# Accounts
$users = Invoke-Safe { @(Get-MgUser -All -Property Id, AccountEnabled, UserType) } @()
$out.usersTotal   = @($users).Count
$out.usersEnabled = @($users | Where-Object { $_.AccountEnabled }).Count
$out.guests       = @($users | Where-Object { $_.UserType -eq 'Guest' }).Count

# Multifactor authentication registration
$reg = Invoke-Safe { @(Get-MgReportAuthenticationMethodUserRegistrationDetail -All) } $null
if ($null -ne $reg -and @($reg).Count -gt 0) {
    $out.mfaChecked       = $true
    $out.mfaRegistered    = @($reg | Where-Object { $_.IsMfaRegistered }).Count
    $out.mfaNotRegistered = @($reg | Where-Object { -not $_.IsMfaRegistered }).Count
} else {
    $out.mfaChecked = $false
}

# Global administrators
$ga = Invoke-Safe {
    $role = Get-MgDirectoryRole -Filter "RoleTemplateId eq '62e90394-69f5-4237-9190-012177145e10'"
    if ($role) { @(Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id -All) } else { @() }
} @()
$out.globalAdmins = @($ga).Count

# Security defaults
$sd = Invoke-Safe { Get-MgPolicyIdentitySecurityDefaultEnforcementPolicy } $null
if ($null -ne $sd) { $out.securityDefaults = [bool]$sd.IsEnabled } else { $out.securityDefaults = $null }

# Conditional access
$ca = Invoke-Safe { @(Get-MgIdentityConditionalAccessPolicy -All) } $null
if ($null -ne $ca) {
    $out.caChecked    = $true
    $out.caTotal      = @($ca).Count
    $out.caEnabled    = @($ca | Where-Object { $_.State -eq 'enabled' }).Count
    $out.caReportOnly = @($ca | Where-Object { $_.State -eq 'enabledForReportingButNotEnforced' }).Count
    $out.caBlocksLegacyAuth = @($ca | Where-Object {
            $_.State -eq 'enabled' -and
            $_.GrantControls.BuiltInControls -contains 'block' -and
            ($_.Conditions.ClientAppTypes -contains 'exchangeActiveSync' -or
             $_.Conditions.ClientAppTypes -contains 'other')
        }).Count -gt 0
    $out.caRequiresMfa = @($ca | Where-Object {
            $_.State -eq 'enabled' -and
            $_.GrantControls.BuiltInControls -contains 'mfa' -and
            $_.Conditions.Users.IncludeUsers -contains 'All'
        }).Count -gt 0
} else {
    $out.caChecked = $false
}

# Default user permissions and guest invitations
$auth = Invoke-Safe { Get-MgPolicyAuthorizationPolicy } $null
if ($null -ne $auth) {
    $out.guestInviteSetting   = [string]$auth.AllowInvitesFrom
    $out.usersCanRegisterApps = [bool]$auth.DefaultUserRolePermissions.AllowedToCreateApps
}

# Accounts with no sign in for 90 days (needs Entra ID P1)
$out.staleAccounts = Invoke-Safe {
    $cut = (Get-Date).AddDays(-90)
    @(Get-MgUser -All -Property Id, AccountEnabled, SignInActivity |
        Where-Object {
            $_.AccountEnabled -and
            $_.SignInActivity.LastSignInDateTime -and
            $_.SignInActivity.LastSignInDateTime -lt $cut
        }).Count
} $null

Invoke-Safe { Disconnect-MgGraph | Out-Null } $null

$json = $out | ConvertTo-Json -Depth 4 -Compress
Write-Host ''
Write-Host '----- copy everything between the lines -----' -ForegroundColor Cyan
Write-Host $json
Write-Host '----- end -----' -ForegroundColor Cyan
$copied = Invoke-Safe {
    if ($IsMacOS)   { $json | /usr/bin/pbcopy; $true }
    elseif ($IsLinux) { $false }
    else            { Set-Clipboard -Value $json; $true }
} $false

if ($copied) {
    Write-Host ''
    Write-Host 'Also copied to your clipboard.' -ForegroundColor Green
}