GraphAPI.ps1

# This script contains functions for Graph API at https://graph.windows.net
# Office 365 / Azure AD v2, a.k.a. AzureAD module uses this API

function Get-AADUsers
{
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken,
        [Parameter(Mandatory=$False)]
        [String]$SearchString,
        [Parameter(Mandatory=$False)]
        [String]$UserPrincipalName
        
    )
    Process
    {
        if(![string]::IsNullOrEmpty($SearchString))
        {
            $queryString="`$filter=(startswith(displayName,'$SearchString') or startswith(userPrincipalName,'$SearchString'))"
        }
        elseif(![string]::IsNullOrEmpty($UserPrincipalName))
        {
            $queryString="`$filter=userPrincipalName eq '$UserPrincipalName'"
        }

        $results=Call-GraphAPI -AccessToken $AccessToken -Command users -QueryString $queryString

        return $results
    }
}

# Gets the tenant details 
function Get-TenantDetails
{
<#
    .SYNOPSIS
    Extract tenant details using the given Access Token

    .DESCRIPTION
    Extract tenant details using the given Access Token

    .Parameter AccessToken
    The Access Token. If not given, tries to use cached Access Token.
    
    .Example
    PS C:\>$token=Get-AADIntAccessTokenForAADGraph
    PS C:\>Get-AADIntTenantDetails -AccessToken $token

#>
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken
    )
    Process
    {
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net"

        # Call the API
        $response=Call-GraphAPI -AccessToken $AccessToken -Command tenantDetails 
        
        # Verbose
        Write-Verbose "TENANT INFORMATION: $($response.value | Out-String)"

        # Return
        $response
    }
}

# Gets the tenant devices
# Jun 24th 2020 
function Get-Devices
{
<#
    .SYNOPSIS
    Extracts tenant devices using the given Access Token

    .DESCRIPTION
    Extracts tenant devices using the given Access Token

    .Parameter AccessToken
    The Access Token. If not given, tries to use cached Access Token.
    
    .Example
    PS C:\>$token=Get-AADIntAccessTokenForAADGraph
    PS C:\>Get-AADIntDevices -AccessToken $token

#>
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken
    )
    Process
    {
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net"

        # Call the API
        $response=Call-GraphAPI -AccessToken $AccessToken -Command devices -QueryString "`$expand=registeredOwner"
        
        # Return
        $response
    }
}

# Gets detailed information about the given user
# Jun 24th 2020 
function Get-UserDetails
{
<#
    .SYNOPSIS
    Extracts detailed information of the given user

    .DESCRIPTION
    Extracts detailed information of the given user

    .Parameter AccessToken
    The Access Token. If not given, tries to use cached Access Token.

    .Parameter UserPrincipalName
    The user principal name of the user whose details is to be extracted
    
    .Example
    PS C:\>$token=Get-AADIntAccessTokenForAADGraph
    PS C:\>Get-AADIntUserDetails -AccessToken $token

    odata.type                            : Microsoft.DirectoryServices.User
    objectType                            : User
    objectId                              : cd5676ad-ba80-4782-bdcb-ff5de37fc347
    deletionTimestamp                     : 
    acceptedAs                            : 
    acceptedOn                            : 
    accountEnabled                        : True
    ageGroup                              : 
    alternativeSecurityIds                : {}
    signInNames                           : {user@company.com}
    signInNamesInfo                       : {}
    appMetadata                           : 
    assignedLicenses                      : {@{disabledPlans=System.Object[]; skuId=c7df2760-2c81-4ef7-b578-5b5392b571df}, @{disabledPlans=System.Object[]; skuId=b05e124f-c7cc-45a0-a6aa-8cf78c946968}}
    assignedPlans                         : {@{assignedTimestamp=2019-12-02T07:41:59Z; capabilityStatus=Enabled; service=MultiFactorService; servicePlanId=8a256a2b-b617-496d-b51b-e76466e88db0}, @{assignedTimestamp=2019-12-02T07
                                            :41:59Z; capabilityStatus=Enabled; service=exchange; servicePlanId=34c0d7a0-a70f-4668-9238-47f9fc208882}, @{assignedTimestamp=2019-12-02T07:41:59Z; capabilityStatus=Enabled; service=P
                                            owerBI; servicePlanId=70d33638-9c74-4d01-bfd3-562de28bd4ba}, @{assignedTimestamp=2019-12-02T07:41:59Z; capabilityStatus=Enabled; service=WhiteboardServices; servicePlanId=4a51bca5-1ef
                                            f-43f5-878c-177680f191af}...}
    city                                  : 
    cloudAudioConferencingProviderInfo    : <acpList>
                                              <acpInformation default="true">
                                                <tollNumber>18728886261</tollNumber>
                                                <participantPassCode>0</participantPassCode>
                                                <domain>resources.lync.com</domain>
                                                <name>Microsoft</name>
                                                <url>https://dialin.lync.com/c73270cd-afd0-4f70-8328-747f36508d85</url>
                                              </acpInformation>
                                            </acpList>
    cloudMSExchRecipientDisplayType       : 1073741824
    cloudMSRtcIsSipEnabled                : True
    cloudMSRtcOwnerUrn                    : 
    ...


#>
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken,
        [Parameter(Mandatory=$True)]
        [String]$UserPrincipalName
    )
    Process
    {
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net"

        # Url encode for external users, replace # with %23
        $UserPrincipalName = $UserPrincipalName.Replace("#","%23")

        # Call the API
        $response=Call-GraphAPI -AccessToken $AccessToken -Command "users/$UserPrincipalName" 
        
        # Return
        $response
    }
}

# Gets tenant's Azure AD settings
# Jun 24th 2020 
function Get-Settings
{
<#
    .SYNOPSIS
    Extracts Azure AD settings

    .DESCRIPTION
    Extracts Azure AD settings

    .Parameter AccessToken
    The Access Token. If not given, tries to use cached Access Token.

    .Example
    PS C:\>$token=Get-AADIntAccessTokenForAADGraph
    PS C:\>Get-AADIntSettings -AccessToken $token

    id                                   displayName            templateId                           values                                                                                                                        
    --                                   -----------            ----------                           ------                                                                                                                        
    8b16b029-bb31-48c8-b4df-5ee419596688 Password Rule Settings 5cf42378-d67d-4f36-ba46-e8b86229381d {@{name=BannedPasswordCheckOnPremisesMode; value=Audit}, @{name=EnableBannedPasswordCheckOnPremises; value=True}, @{name=En...


#>
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken
    )
    Process
    {
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net"

        # Call the API
        $response=Call-GraphAPI -AccessToken $AccessToken -Command "settings"
        
        # Return
        $response
    }
}

# Gets tenant's OAuth grants
# Jun 24th 2020 
function Get-OAuthGrants
{
<#
    .SYNOPSIS
    Extracts Azure AD OAuth grants

    .DESCRIPTION
    Extracts Azure AD OAuth grants

    .Parameter AccessToken
    The Access Token. If not given, tries to use cached Access Token.

    .Example
    PS C:\>$token=Get-AADIntAccessTokenForAADGraph
    PS C:\>Get-AADIntOAuthGrants -AccessToken $token

    id                                   displayName            templateId                           values                                                                                                                        
    --                                   -----------            ----------                           ------                                                                                                                        
    8b16b029-bb31-48c8-b4df-5ee419596688 Password Rule Settings 5cf42378-d67d-4f36-ba46-e8b86229381d {@{name=BannedPasswordCheckOnPremisesMode; value=Audit}, @{name=EnableBannedPasswordCheckOnPremises; value=True}, @{name=En...


#>
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken
    )
    Process
    {
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net"

        # Call the API
        $response=Call-GraphAPI -AccessToken $AccessToken -Command "oauth2PermissionGrants"
        
        # Return
        $response
    }
}

# Gets tenant's service principals
# Jun 24th 2020 
function Get-ServicePrincipals
{
<#
    .SYNOPSIS
    Extracts Azure AD service principals

    .DESCRIPTION
    Extracts Azure AD service principals. If client id(s) are provided, show detailed information.

    .Parameter AccessToken
    The Access Token. If not given, tries to use cached Access Token.

    .Parameter ClientIds
    List of client ids to get detailed information.

    .Example
    PS C:\>Get-AADIntAccessTokenForAADGraph -SaveToCache
    PS C:\>Get-AADIntServicePrincipals

    AccountEnabled        : true
    Addresses             :
    AppPrincipalId        : d32c68ad-72d2-4acb-a0c7-46bb2cf93873
    DisplayName           : Microsoft Activity Feed Service
    ObjectId              : 321e7bdd-d7b0-4a64-8eb3-38c259c1304a
    ServicePrincipalNames : ServicePrincipalNames
    TrustedForDelegation  : false

    AccountEnabled        : true
    Addresses             : Addresses
    AppPrincipalId        : 0000000c-0000-0000-c000-000000000000
    DisplayName           : Microsoft App Access Panel
    ObjectId              : a9e03f2f-4471-41f2-96c5-589d5d7117bc
    ServicePrincipalNames : ServicePrincipalNames
    TrustedForDelegation  : false

    AccountEnabled        : true
    Addresses             :
    AppPrincipalId        : dee7ba80-6a55-4f3b-a86c-746a9231ae49
    DisplayName           : Microsoft AppPlat EMA
    ObjectId              : ae0b81fc-c521-4bfd-9eaa-04c520b4b5fd
    ServicePrincipalNames : ServicePrincipalNames
    TrustedForDelegation  : false

    AccountEnabled        : true
    Addresses             : Addresses
    AppPrincipalId        : 65d91a3d-ab74-42e6-8a2f-0add61688c74
    DisplayName           : Microsoft Approval Management
    ObjectId              : d8ec5b95-e5f6-416e-8e7c-c6c52ec5a11f
    ServicePrincipalNames : ServicePrincipalNames
    TrustedForDelegation  : false
#>
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken,
        [Parameter(Mandatory=$False)]
        [String[]]$ClientIds
    )
    Process
    {
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net"

        # If client id(s) are provided, get only those (with extra information)
        if($ClientIds)
        {
            $body = @{
                "appIds" = $ClientIds
            }

            # Call the API
            Call-GraphAPI -AccessToken $AccessToken -Command "getServicePrincipalsByAppIds" -Body ($body | ConvertTo-Json) -Method Post -QueryString "`$Select="
        }
        else
        {
            # Call the Provisioning API
            Get-ServicePrincipals2 -AccessToken $AccessToken
        }

    }
}

# Gets tenant's conditional access policies
# Apr 8th 2021
function Get-ConditionalAccessPolicies
{
<#
    .SYNOPSIS
    Shows conditional access policies.

    .DESCRIPTION
    Shows conditional access policies.

    .Parameter AccessToken
    The Access Token. If not given, tries to use cached Access Token.

    .Example
    PS C:\>Get-AADIntAccessTokenForAADGraph -SaveToCache
    PS C:\>Get-AADIntConditionalAccessPolicies

    odata.type          : Microsoft.DirectoryServices.Policy
    objectType          : Policy
    objectId            : 1a6a3b84-7d6d-4398-9c26-50fab315be8b
    deletionTimestamp   : 
    displayName         : Default Policy
    keyCredentials      : {}
    policyType          : 18
    policyDetail        : {{"Version":0,"State":"Disabled"}}
    policyIdentifier    : 2022-11-18T00:16:20.2379877Z
    tenantDefaultPolicy : 18

    odata.type          : Microsoft.DirectoryServices.Policy
    objectType          : Policy
    objectId            : 7f6ac8e5-bd21-4091-ae4c-0e48e0f4db04
    deletionTimestamp   : 
    displayName         : Block NestorW
    keyCredentials      : {}
    policyType          : 18
    policyDetail        : {{"Version":1,"CreatedDateTime":"2022-11-18T00:16:19.461967Z","State":"Enabled
                          ","Conditions":{"Applications":{"Include":[{"Applications":["None"]}]},"Users"
                          :{"Include":[{"Users":["8ab3ed0d-6668-49f7-a108-c50bb230c870"]}]}},"Controls":
                          [{"Control":["Block"]}],"EnforceAllPoliciesForEas":true,"IncludeOtherLegacyCli
                          entTypeForEvaluation":true}}
    policyIdentifier    : 
    tenantDefaultPolicy : 
#>
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken
    )
    Process
    {
        # Return conditional access policies
        Get-AzureADPolicies -AccessToken $AccessToken | Where policyType -eq 18
    }
}

# Gets tenant's Azure AD Policies
# Nov 17th 2022
function Get-AzureADPolicies
{
<#
    .SYNOPSIS
    Shows Azure AD policies.

    .DESCRIPTION
    Shows Azure AD policies.

    .Parameter AccessToken
    The Access Token. If not given, tries to use cached Access Token.

    .Example
    PS C:\>Get-AADIntAccessTokenForAADGraph -SaveToCache
    PS C:\>Get-AADIntAzureADPolicies

    odata.type          : Microsoft.DirectoryServices.Policy
    objectType          : Policy
    objectId            : e35e4cd3-53f8-4d65-80bb-e3279c2c1b71
    deletionTimestamp   : 
    displayName         : On-Premise Authentication Flow Policy
    keyCredentials      : {**}
    policyType          : 8
    policyDetail        : {**}
    policyIdentifier    : 
    tenantDefaultPolicy : 8

    odata.type          : Microsoft.DirectoryServices.Policy
    objectType          : Policy
    objectId            : 259b810f-fb50-4e57-925b-ec2292c17883
    deletionTimestamp   : 
    displayName         : 2/5/2021 5:53:07 AM
    keyCredentials      : {}
    policyType          : 10
    policyDetail        : {{"SecurityPolicy":{"Version":0,"SecurityDefaults":{"IgnoreBaselineProtectionPolicies":true,"I
                          sEnabled":false}}}}
    policyIdentifier    : 
    tenantDefaultPolicy : 10
#>
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken
    )
    Process
    {
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net"
        
        # Call the API
        Call-GraphAPI -AccessToken $AccessToken -Command "policies" -Method Get
    }
}

# Gets tenant's Azure AD Policies
# Nov 17th 2022
function Set-AzureADPolicyDetails
{
<#
    .SYNOPSIS
    Sets Azure AD policy details.

    .DESCRIPTION
    Sets Azure AD policy details.

    .Parameter AccessToken
    The Access Token. If not given, tries to use cached Access Token.

    .PARAMETER ObjectId
    Object ID of the policy

    .PARAMETER PolicyDetail
    Policy details.

    .PARAMETER DisplayName
    New displayname of the policy

    .Example
    PS C:\>Get-AADIntAccessTokenForAADGraph -SaveToCache
    PS C:\>Set-AADIntAzureADPolicyDetail -ObjectId "e35e4cd3-53f8-4d65-80bb-e3279c2c1b71" -PolicyDetail '{{"SecurityPolicy":{"Version":0,"SecurityDefaults":{"IgnoreBaselineProtectionPolicies":true,"IsEnabled":false}}}}'

    .Example
    PS C:\>Get-AADIntAccessTokenForAADGraph -SaveToCache
    PS C:\>Set-AADIntAzureADPolicyDetail -ObjectId "e35e4cd3-53f8-4d65-80bb-e3279c2c1b71" -PolicyDetail '{{"SecurityPolicy":{"Version":0,"SecurityDefaults":{"IgnoreBaselineProtectionPolicies":true,"IsEnabled":false}}}}' -displayName "My Policy"

    
#>
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken,
        [Parameter(Mandatory=$True)]
        [Guid]$ObjectId,
        [Parameter(Mandatory=$True)]
        [String]$PolicyDetail,
        [Parameter(Mandatory=$False)]
        [String]$DisplayName
    )
    Process
    {
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net"
        
        $body = @{
            "policyDetail" = @($PolicyDetail)
        }
        if(![string]::IsNullOrEmpty($DisplayName))
        {
            $body["displayName"] = $DisplayName
        }

        # Call the API
        Call-GraphAPI -AccessToken $AccessToken -Command "policies/$($ObjectId)" -Method Patch -Body ($body | ConvertTo-Json)
    }
}

# Get Azure AD features
# Aug 23 2023
function Get-AzureADFeatures
{
<#
    .SYNOPSIS
    Show the status of Azure AD features.

    .DESCRIPTION
    Show the status of Azure AD features using Azure AD Graph internal API.
    Requires Global Administrator role
    
    .Parameter AccessToken
    Access Token

    .Example
    Get-AADIntAccessTokenForAADGraph -SaveToCache
    PS C:\>Get-AADIntAzureADFeatures 

    Feature                                             Enabled
    -------                                             -------
    AllowEmailVerifiedUsers                                True
    AllowInvitations                                       True
    AllowMemberUsersToInviteOthersAsMembers               False
    AllowUsersToChangeTheirDisplayName                    False
    B2CFeature                                            False
    BlockAllTenantAuth                                    False
    ConsentedForMigrationToPublicCloud                    False
    CIAMFeature                                           False
    CIAMTrialFeature                                      False
    CIAMTrialUpgrade                                      False
    EnableExchangeDualWrite                               False
    EnableHiddenMembership                                False
    EnableSharedEmailDomainApis                           False
    EnableWindowsLegacyCredentials                        False
    EnableWindowsSupplementalCredentials                  False
    ElevatedGuestsAccessEnabled                           False
    ExchangeDualWriteUsersV1                              False
    GuestsCanInviteOthersEnabled                           True
    InvitationsEnabled                                     True
    LargeScaleTenant                                      False
    TestTenant                                            False
    USGovTenant                                           False
    DisableOnPremisesWindowsLegacyCredentialsSync         False
    DisableOnPremisesWindowsSupplementalCredentialsSync   False
    RestrictPublicNetworkAccess                           False
    AutoApproveSameTenantRequests                         False
    RedirectPpeUsersToMsaInt                              False
    LegacyTlsExceptionForEsts                             False
    LegacyTlsBlockForEsts                                 False
    TenantAuthBlockReasonFraud                            False
    TenantAuthBlockReasonLifecycle                        False
    TenantExcludeDeprecateAADLicenses                     False
#>
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken
    )
    Begin
    {
        $features = @(
            "AllowEmailVerifiedUsers"
            "AllowInvitations"
            "AllowMemberUsersToInviteOthersAsMembers"
            "AllowUsersToChangeTheirDisplayName"
            "B2CFeature"
            "BlockAllTenantAuth"
            "ConsentedForMigrationToPublicCloud"
            "CIAMFeature"
            "CIAMTrialFeature"
            "CIAMTrialUpgrade"
            "EnableExchangeDualWrite"
            "EnableHiddenMembership"
            "EnableSharedEmailDomainApis"
            "EnableWindowsLegacyCredentials"
            "EnableWindowsSupplementalCredentials"
            "ElevatedGuestsAccessEnabled"
            "ExchangeDualWriteUsersV1"
            "GuestsCanInviteOthersEnabled"
            "InvitationsEnabled"
            "LargeScaleTenant"
            "TestTenant"
            "USGovTenant"
            "DisableOnPremisesWindowsLegacyCredentialsSync"
            "DisableOnPremisesWindowsSupplementalCredentialsSync"
            "RestrictPublicNetworkAccess"
            "AutoApproveSameTenantRequests"
            "RedirectPpeUsersToMsaInt"
            "LegacyTlsExceptionForEsts"
            "LegacyTlsBlockForEsts"
            "TenantAuthBlockReasonFraud"
            "TenantAuthBlockReasonLifecycle"
            "TenantExcludeDeprecateAADLicenses"
        )
    }
    Process
    {
        # Get from cache if not provided
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net"

        $retVal = @()

        # Loop through the features
        foreach($feature in $features)
        {
            try
            {
                $value = Get-AzureADFeature -AccessToken $AccessToken -Feature $feature

                $retVal += [pscustomobject][ordered]@{
                    "Feature" = $feature
                    "Enabled" = $value
                }
            }
            catch
            {
            }
        }

        $retVal
        
        
    }
}

# Get Azure AD feature status
# Aug 23 2023
function Get-AzureADFeature
{
<#
    .SYNOPSIS
    Show the status of given Azure AD feature.

    .DESCRIPTION
    Show the status of given Azure AD feature using Azure AD Graph internal API.
    Requires Global Administrator role
    
    .Parameter AccessToken
    Access Token

    .PARAMETER Feature
    The name of the feature. Should be one of:

    AllowEmailVerifiedUsers
    AllowInvitations
    AllowMemberUsersToInviteOthersAsMembers
    AllowUsersToChangeTheirDisplayName
    B2CFeature
    BlockAllTenantAuth
    ConsentedForMigrationToPublicCloud
    CIAMFeature
    CIAMTrialFeature
    CIAMTrialUpgrade
    EnableExchangeDualWrite
    EnableHiddenMembership
    EnableSharedEmailDomainApis
    EnableWindowsLegacyCredentials
    EnableWindowsSupplementalCredentials
    ElevatedGuestsAccessEnabled
    ExchangeDualWriteUsersV1
    GuestsCanInviteOthersEnabled
    InvitationsEnabled
    LargeScaleTenant
    TestTenant
    USGovTenant
    DisableOnPremisesWindowsLegacyCredentialsSync
    DisableOnPremisesWindowsSupplementalCredentialsSync
    RestrictPublicNetworkAccess
    AutoApproveSameTenantRequests
    RedirectPpeUsersToMsaInt
    LegacyTlsExceptionForEsts
    LegacyTlsBlockForEsts
    TenantAuthBlockReasonFraud
    TenantAuthBlockReasonLifecycle
    TenantExcludeDeprecateAADLicenses

    .Example
    Get-AADIntAccessTokenForAADGraph -SaveToCache
    PS C:\>Get-AADIntAzureADFeature -Feature "B2CFeature"

    True
#>
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken,
        [ValidateSet('AllowEmailVerifiedUsers','AllowInvitations','AllowMemberUsersToInviteOthersAsMembers','AllowUsersToChangeTheirDisplayName','B2CFeature','BlockAllTenantAuth','ConsentedForMigrationToPublicCloud','CIAMFeature','CIAMTrialFeature','CIAMTrialUpgrade','EnableExchangeDualWrite','EnableHiddenMembership','EnableSharedEmailDomainApis','EnableWindowsLegacyCredentials','EnableWindowsSupplementalCredentials','ElevatedGuestsAccessEnabled','ExchangeDualWriteUsersV1','GuestsCanInviteOthersEnabled','InvitationsEnabled','LargeScaleTenant','TestTenant','USGovTenant','DisableOnPremisesWindowsLegacyCredentialsSync','DisableOnPremisesWindowsSupplementalCredentialsSync','RestrictPublicNetworkAccess','AutoApproveSameTenantRequests','RedirectPpeUsersToMsaInt','LegacyTlsExceptionForEsts','LegacyTlsBlockForEsts','TenantAuthBlockReasonFraud','TenantAuthBlockReasonLifecycle','TenantExcludeDeprecateAADLicenses')]
        [Parameter(Mandatory=$True)]
        [String]$Feature
    )
    Process
    {
        # Get from cache if not provided
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net"

        $body = @{
            "directoryFeature" = $feature
        }

        # Call the API
        try
        {
            $response = Call-GraphAPI -AccessToken $AccessToken -Command "isDirectoryFeatureEnabled" -Method Post -Body ($body | ConvertTo-Json)

            $enabled = $false;

            # For some reason True is returned as boolean but False as object with value attribute
            if($response -isnot [boolean])
            {
                $enabled = $response.Value
            }
            else
            {
                $enabled = $response
            }
            
            return $enabled
        }
        catch
        {
            $stream = $_.Exception.Response.GetResponseStream()
            $responseBytes = New-Object byte[] $stream.Length

            $stream.Position = 0
            $stream.Read($responseBytes,0,$stream.Length) | Out-Null
            
            $response = [text.encoding]::UTF8.GetString($responseBytes) | ConvertFrom-Json
            
            throw $response.'odata.error'.message.value
        }
    }
}

# Enable or Disable Azure AD feature
# Aug 23 2023
function Set-AzureADFeature
{
<#
    .SYNOPSIS
    Enables or disables the given Azure AD feature.

    .DESCRIPTION
    Enables or disables the given Azure AD feature using Azure AD Graph internal API.
    Requires Global Administrator role
    
    .Parameter AccessToken
    Access Token

    .PARAMETER Feature
    The name of the feature. Should be one of:

    AllowEmailVerifiedUsers
    AllowInvitations
    AllowMemberUsersToInviteOthersAsMembers
    AllowUsersToChangeTheirDisplayName
    B2CFeature
    BlockAllTenantAuth
    ConsentedForMigrationToPublicCloud
    CIAMFeature
    CIAMTrialFeature
    CIAMTrialUpgrade
    EnableExchangeDualWrite
    EnableHiddenMembership
    EnableSharedEmailDomainApis
    EnableWindowsLegacyCredentials
    EnableWindowsSupplementalCredentials
    ElevatedGuestsAccessEnabled
    ExchangeDualWriteUsersV1
    GuestsCanInviteOthersEnabled
    InvitationsEnabled
    LargeScaleTenant
    TestTenant
    USGovTenant
    DisableOnPremisesWindowsLegacyCredentialsSync
    DisableOnPremisesWindowsSupplementalCredentialsSync
    RestrictPublicNetworkAccess
    AutoApproveSameTenantRequests
    RedirectPpeUsersToMsaInt
    LegacyTlsExceptionForEsts
    LegacyTlsBlockForEsts
    TenantAuthBlockReasonFraud
    TenantAuthBlockReasonLifecycle
    TenantExcludeDeprecateAADLicenses

    .Example
    Get-AADIntAccessTokenForAADGraph -SaveToCache
    PS C:\>Set-AADIntAzureADFeature -Feature "B2CFeature" -Enable $true

    Feature      Enabled
    -------      -------
    B2CFeature      True

    .Example
    Get-AADIntAccessTokenForAADGraph -SaveToCache
    PS C:\>Set-AADIntAzureADFeature -Feature "B2CFeature" -Enable $false

    Feature      Enabled
    -------      -------
    B2CFeature     False
#>
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken,
        [ValidateSet('AllowEmailVerifiedUsers','AllowInvitations','AllowMemberUsersToInviteOthersAsMembers','AllowUsersToChangeTheirDisplayName','B2CFeature','BlockAllTenantAuth','ConsentedForMigrationToPublicCloud','CIAMFeature','CIAMTrialFeature','CIAMTrialUpgrade','EnableExchangeDualWrite','EnableHiddenMembership','EnableSharedEmailDomainApis','EnableWindowsLegacyCredentials','EnableWindowsSupplementalCredentials','ElevatedGuestsAccessEnabled','ExchangeDualWriteUsersV1','GuestsCanInviteOthersEnabled','InvitationsEnabled','LargeScaleTenant','TestTenant','USGovTenant','DisableOnPremisesWindowsLegacyCredentialsSync','DisableOnPremisesWindowsSupplementalCredentialsSync','RestrictPublicNetworkAccess','AutoApproveSameTenantRequests','RedirectPpeUsersToMsaInt','LegacyTlsExceptionForEsts','LegacyTlsBlockForEsts','TenantAuthBlockReasonFraud','TenantAuthBlockReasonLifecycle','TenantExcludeDeprecateAADLicenses')]
        [Parameter(Mandatory=$True)]
        [String]$Feature,
        [Parameter(Mandatory=$True)]
        [bool]$Enabled
    )
    Process
    {
        # Get from cache if not provided
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net"

        $isEnabled = Get-AzureADFeature -Feature $feature -AccessToken $AccessToken

        if($Enabled)
        {
            # Check if already enabled
            if($isEnabled)
            {
                Write-Warning "Feature $feature is already enabled."
                return
            }
            $command = "enableDirectoryFeature"
        }
        else
        {
            # Check if already disabled
            if(!$isEnabled)
            {
                Write-Warning "Feature $feature is already disabled."
                return
            }
            $command = "disableDirectoryFeature"
        }

        $body = @{
            "directoryFeature" = $feature
        }

        # Call the API
        try
        {
            Call-GraphAPI -AccessToken $AccessToken -Command $command -Method Post -Body ($body | ConvertTo-Json)
        }
        catch
        {
            $stream = $_.Exception.Response.GetResponseStream()
            $responseBytes = New-Object byte[] $stream.Length

            $stream.Position = 0
            $stream.Read($responseBytes,0,$stream.Length) | Out-Null
            
            $response = [text.encoding]::UTF8.GetString($responseBytes) | ConvertFrom-Json
            
            throw $response.'odata.error'.message.value
        }

        
        [pscustomobject][ordered]@{
            "Feature" = $feature
            "Enabled" = Get-AzureADFeature -AccessToken $AccessToken -Feature $feature
        }
        
    }
}


# Adds Microsoft.Azure.SyncFabric service principal
# Dec 4th 2023
function Add-SyncFabricServicePrincipal
{
<#
    .SYNOPSIS
    Adds Microsoft.Azure.SyncFabric service principal needed to create BPRTs.

    .DESCRIPTION
    Adds Microsoft.Azure.SyncFabric service principal needed to create BPRTs. 
    
    Requires Application Administrator, Cloud Application Administrator, Directory Synchronization Accounts, Hybrid Identity Administrator, or Global Administrator permissions.

    .Parameter AccessToken
    The Access Token. If not given, tries to use cached Access Token.

    .Example
    PS C:\>Get-AADIntAccessTokenForAADGraph -SaveToCache
    PS C:\>Add-AADIntSyncFabricServicePrincipal

    DisplayName                AppId                                ObjectId                            
    -----------                -----                                --------                            
    Microsoft.Azure.SyncFabric 00000014-0000-0000-c000-000000000000 138018f7-6aa2-454c-a103-a7e682e17d6b
#>
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken
    )
    Process
    {
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net"

        
        $body = @{
            "accountEnabled"            = "True"
	        "appId"                     = "00000014-0000-0000-c000-000000000000"
	        "appRoleAssignmentRequired" = $false
	        "displayName"               = "Microsoft.Azure.SyncFabric"
	        "tags"                      = @( "WindowsAzureActiveDirectoryIntegratedApp" )
        }

        # Call the API
        $result = Call-GraphAPI -AccessToken $AccessToken -Command "servicePrincipals" -Body ($body | ConvertTo-Json) -Method Post

        if($result)
        {
            [pscustomobject]@{
                "DisplayName" = $result.displayName
                "AppId"       = $result.appId
                "ObjectId"    = $result.objectId
            }
        }
        

    }
}