Intune

############ Section 1 ############
# Check if the Az module is installed and install if not
# Be careful if using the -AllowClobber as it can step on other modules

Write-Host "Checking that the required Az module is installed. If not, we'll try to install it."
$azModule = Get-Module -Name Az -ListAvailable
if (!$azModule) {
    Write-Host "The Az module is not installed, installing it now..."
    Install-Module -Name "Az" -Force
    Import-Module Az
}

# Test if there is an existing Az context
$azContext = Get-AzContext -ErrorAction SilentlyContinue
if (!$azContext) {
    # If the context is null, sign in
    Write-Host "No existing Az context found. Please sign in to your Azure account."
    Connect-AzAccount
}

############ Section 2 ############
# Build the user and UPN

Write-Host "Prompting for required information. Default values will be displayed as (#)"
$firstName = Read-Host "Enter the user's first name." | ForEach-Object { $_ -creplace '\b\w', { $_.Value.ToUpper() } }
$lastName = Read-Host "Enter the user's surname name." | ForEach-Object { $_ -creplace '\b\w', { $_.Value.ToUpper() } }

# Default location is the US - just press enter
# If it needs to be the UK location - press 2
$location = "US"

# Prompt for UK
Clear-Host
$locationCheck = Read-Host "Setting user to United States location by default. Press 2 if their location should be the UK."
if ($locationCheck -eq '2') {
    $location = "UK"
}
Write-Host "Selected location: $location"

# Build UPN
$nickName = "$($lastName.ToLower())$($firstName.ToLower().Substring(0, 1))"
$upn = "$nickName@yourdomain.com"

# Prompt for temporary password (12 digit requirement)
$tempPassword = $null

Clear-Host
Write-Host "Prompting for a secure password now. This must be 12 digits long and include numbers, letters, symbols, etc."
while ($tempPassword -eq $null -or $tempPassword.Length -lt 12) {
    $tempPassword = Read-Host "Enter a 12-digit temporary password" -AsSecureString
    if ($tempPassword.Length -lt 12) {
        Write-Host "Password must be at least 12 digits, try again."
    }
}

############ Section 3 ############
# Prompt for license group
# The E1 group are users with email only
# The E3 Security group is the standard E3 with the E5 security addon
# The E5 group is the full E5 package

do {
    $groupSelection = Read-Host @"
Please select the appropriate license group (2):
Enter for default
1. E1 Users - Email Only
2. E3 Users - Email and Office
3. E5 Users - The kitchen sink
"@

    # Default to 2 on enter
    if ($groupSelection -eq '') {
        $groupSelection = 2
    }

    # Validate and default if invalid
    if ($groupSelection -notin ('1', '2', '3')) {
        Write-Host "Looks like that was an invalid option. Setting default to 2."
        $groupSelection = 2
    }
    else {
        $validSelection = $true
    }
} while (-not $validSelection)

# Convert the selection to the actual group
switch ($groupSelection) {
    1 { 
        $groupName = "E1License" 
        break
    }
    2 { 
        $groupName = "E3License" 
        break
    }
    3 { 
        $groupName = "E5License"
        break
    }
    default {
        $groupName = $null
        Write-Host "Invalid selection. Please enter 1, 2, or 3."
        break
    }
}

# Display the selection
Write-Host "Selected group: $groupName"

############ Section 4 ############
# Convert password and Create the user

# Convert secure string to plain text for the New-AzADUser cmdlet
$tempPWPlainText = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($tempPassword))

$PasswordProfile = @{
    Password                      = $tempPWPlainText
    ForceChangePasswordNextSignIn = $true
}

$newUserParams = @{
    UserPrincipalName  = $upn
    DisplayName        = "$firstName $lastName"
    GivenName          = $firstName
    Surname            = $lastName
    MailNickname       = $nickName
    UsageLocation      = $location
    UserType           = "Member"
    PasswordProfile    = $PasswordProfile
    AccountEnabled     = $true
}

$newUser = New-AzADUser @newUserParams

Import-Module MSOnline
Import-Module AzureAD
# Connect all the things
$yourName = Read-Host "Enter your UPN."

# Connect to Azure Active Directory
Connect-MsolService
#Exchange Online
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName $yourName -ShowProgress $true

# Confirm user input
$userName = Read-Host "Enter the username of the user to offboard"

Clear-Host
# Get user information
$user = Get-AzureADUser -ObjectId $userName
$manager = Get-AzureADUserManager -ObjectId $user.ObjectId
$managerUPN = $manager.UserPrincipalName
Write-Host "Full Name: $($user.DisplayName)"
Write-Host "Manager's UserPrincipalName: $($managerUPN)"

# Confirm offboarding
$confirmation = Read-Host "Enter Yes to offboard this user"
if ($confirmation -ne "Yes") {
    Write-Host "Offboarding cancelled"
    return
}

# Convert the user's mailbox to a shared mailbox
Write-Host "Converting user mailbox to a shared mailbox: $($user.UserPrincipalName)"
Set-Mailbox -Identity $userName -Type Shared
# Assign FullAccess permissions to the manager for the shared mailbox
Add-MailboxPermission -Identity "$($user.UserPrincipalName)\Mailbox" -User "$($manager.UserPrincipalName)\Mailbox" -AccessRights 'FullAccess'
Write-Host "Shared mailbox assigned to manager: $($managerUPN)"

# Get user group memberships
$groups = Get-AzureADUserMembership -ObjectId $user.ObjectId | Where-Object { $_.ObjectType -eq "Group" }

# Get user licenses
$licenses = Get-AzureADUserLicenseDetail -ObjectId $user.ObjectId

# Get user enterprise app assignments
$apps = Get-AzureADUserAppRoleAssignment -ObjectId $user.ObjectId

# Get user distribution list memberships
$distLists = Get-AzureADUserMembership -ObjectId $user.ObjectId | Where-Object { $_.ObjectType -eq "DistributionList" }

# Display user information
Write-Host "Group Memberships:"
foreach ($group in $groups) {
    Write-Host "- $($group.DisplayName)"
}
Write-Host "Licenses:"
foreach ($license in $licenses) {
    Write-Host "- $($license.SkuPartNumber)"
}
Write-Host "Enterprise App Assignments:"
foreach ($app in $apps) {
    Write-Host "- $($app.AppDisplayName) - $($app.DisplayName)"
}
Write-Host "Distribution List Memberships:"
foreach ($distList in $distLists) {
    Write-Host "- $($distList.DisplayName)"
}

# Confirm removal from groups
$removeGroups = Read-Host "Remove user from all groups (except Domain Users)? Enter Yes to confirm"
if ($removeGroups -eq "Yes") {
    foreach ($group in $groups) {
        if ($group.ObjectType -eq "MailEnabledSecurityGroup") {
            Write-Host "Skipping removal from mail-enabled security group: $($group.DisplayName)"
        }
        elseif ($group.ObjectType -eq "DistributionList") {
            # Remove the user from the distribution list
            Remove-DistributionGroupMember -Identity $group.DisplayName -Member $user.UserPrincipalName -Confirm:$false
            Write-Host "User $($user.DisplayName) removed from distribution list $($group.DisplayName)"
        }
        else {
            # Remove the user from other types of groups
            Remove-AzureADGroupMember -ObjectId $group.ObjectId -MemberId $user.ObjectId
            Write-Host "User $($user.DisplayName) removed from group $($group.DisplayName)"
        }
    }
}

if ($removeGroups -eq "Yes")

## Confirm removal of licenses
$removeLicenses = Read-Host "Remove all licenses? Enter Yes to confirm"
if ($removeLicenses -eq "Yes") {
    foreach ($license in $licenses) {
        $license.SkuId | ForEach-Object {
            $licenseDetail = Get-AzADSubscribedSku -SkuId $_
            if ($licenseDetail.AccountSkuId -ne "tenant:ENTERPRISEPACK") {
                Set-AzADUserLicense -ObjectId $user.ObjectId -RemoveLicenses @($licenseDetail.SkuId) -Verbose
                Write-Host "License $($licenseDetail.SkuPartNumber) removed from user $($user.DisplayName)"
            }
        }
    }
}

## Confirm removal from distribution lists
# This shouldnt be necessary anymore as the distribution list is being treated as a group, and removed there.
#$removeDistLists = Read-Host "Remove user from all distribution lists? Enter Yes to confirm"
#if ($removeDistLists -eq "Yes") {
#    foreach ($distList in $distLists) {
#        Remove-AzADGroupMember -ObjectId $distList.ObjectId -MemberId $user.ObjectId -Confirm:$false
#        Write-Host "User $($user.DisplayName) removed from distribution list $($distList.DisplayName)"
#    }
#}

# Log removed items
$logPath = "C:\logs\offboarding.log"
$currentTime = Get-Date
Add-Content $logPath "$currentTime - User $($user.DisplayName) offboarded"
Add-Content $logPath "Removed Groups:"
foreach ($group in $groups) {
    if ($group.DisplayName -ne "Domain Users") {
        Add-Content $logPath "- $($group.DisplayName)"
    }
}