Baselining Identity Risk with Microsoft Graph PowerShell

# Read-only scopes for the whole baseline.
# User.Read.All          -> read user objects
# AuditLog.Read.All      -> read registration report and signInActivity
# Directory.Read.All     -> read directory roles and members
# RoleManagement.Read.Directory -> read role assignments
$readScopes = @(
  'User.Read.All',
  'AuditLog.Read.All',
  'Directory.Read.All',
  'RoleManagement.Read.Directory'
)

Connect-MgGraph -Scopes $readScopes -NoWelcome

# Confirm who you are and which scopes were granted:
$ctx = Get-MgContext
$ctx | Select-Object Account,TenantId,@{n='Scopes';e={($_.Scopes -join ', ')}}

# Elevate to write scopes ONLY for this seeding step.
Connect-MgGraph -Scopes 'User.ReadWrite.All','Directory.ReadWrite.All' -NoWelcome

# Resolve the tenant's default domain (for example contoso.onmicrosoft.com)
$domain = (Get-MgOrganization).VerifiedDomains |
          Where-Object { $_.IsDefault } |
          Select-Object -ExpandProperty Name
Write-Host "Default domain: $domain"

# Persona definitions. Passwords are temporary and must be changed at first sign-in.
$personas = @(
  @{ First='Aisha'; Last='Smith';  Alias='asmith';  Dept='Finance' },
  @{ First='Jay';   Last='Patel';  Alias='jpatel';  Dept='IT Operations' },
  @{ First='Lola';  Last='Okafor'; Alias='lokafor'; Dept='Cyber Security' },
  @{ First='Mark';  Last='Reeves'; Alias='mreeves'; Dept='Contractor (left)' }
)

foreach ($p in $personas) {
  $upn = "$($p.Alias)@$domain"
  $pwProfile = @{
    Password                      = 'N0rthgate!' + (Get-Random -Minimum 1000 -Maximum 9999)
    ForceChangePasswordNextSignIn = $true
  }
  New-MgUser -DisplayName "$($p.First) $($p.Last)" `
             -UserPrincipalName $upn `
             -MailNickname $p.Alias `
             -AccountEnabled `
             -PasswordProfile $pwProfile `
             -UsageLocation 'GB' `
             -Department $p.Dept | Out-Null
  Write-Host "Created $upn"
}

# Activate the 'User Administrator' directory role if it is not already active,
# then add jpatel. Role template IDs are fixed GUIDs published by Microsoft.
# fe930be7-5e62-47db-91af-98c3a49a38b1 = User Administrator

$roleTemplateId = 'fe930be7-5e62-47db-91af-98c3a49a38b1'

$role = Get-MgDirectoryRole -All | Where-Object { $_.RoleTemplateId -eq $roleTemplateId }
if (-not $role) {
  $role = New-MgDirectoryRole -RoleTemplateId $roleTemplateId
}

$jpatel = Get-MgUser -Filter "userPrincipalName eq 'jpatel@$domain'"

New-MgDirectoryRoleMemberByRef -DirectoryRoleId $role.Id -BodyParameter @{
  '@odata.id' = "https://graph.microsoft.com/v1.0/directoryObjects/$($jpatel.Id)"
}
Write-Host "jpatel added to $($role.DisplayName)"

# Reconnect read-only if you elevated in Phase B.
Connect-MgGraph -Scopes $readScopes -NoWelcome

# One row per user: MFA capability, SSPR status, and the methods they registered.
$reg = Get-MgReportAuthenticationMethodUserRegistrationDetail -All

$mfaCapable    = $reg | Where-Object { $_.IsMfaCapable }
$mfaNotCapable = $reg | Where-Object { -not $_.IsMfaCapable }
$ssprReg       = $reg | Where-Object { $_.IsSsprRegistered }

# SMS-reliant = has mobile phone method but no Authenticator push and no FIDO2 key.
# These are your migration targets for Lab 02.
$smsReliant = $reg | Where-Object {
  ($_.MethodsRegistered -contains 'mobilePhone') -and
  -not ($_.MethodsRegistered -contains 'microsoftAuthenticatorPush') -and
  -not ($_.MethodsRegistered -contains 'fido2SecurityKey')
}

$privReport = foreach ($role in (Get-MgDirectoryRole -All)) {
  $members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id -All
  foreach ($m in $members) {
    [pscustomobject]@{
      Role        = $role.DisplayName
      MemberType  = ($m.AdditionalProperties['@odata.type'] -replace '#microsoft.graph.','')
      DisplayName = $m.AdditionalProperties['displayName']
      Upn         = $m.AdditionalProperties['userPrincipalName']
    }
  }
}

$privReport | Sort-Object Role | Format-Table -AutoSize

$props = 'id','displayName','userPrincipalName','accountEnabled',
         'createdDateTime','userType','signInActivity'

$allUsers = Get-MgUser -All -Property $props

$cutoff = (Get-Date).AddDays(-90)

$dormant = $allUsers | Where-Object {
  $_.AccountEnabled -and
  (
    $null -eq $_.SignInActivity -or
    $null -eq $_.SignInActivity.LastSignInDateTime -or
    $_.SignInActivity.LastSignInDateTime -lt $cutoff
  )
}

$guests = $allUsers | Where-Object { $_.UserType -eq 'Guest' }

$dormant |
  Select-Object DisplayName,UserPrincipalName,
    @{n='LastSignIn';e={$_.SignInActivity.LastSignInDateTime}},
    @{n='AgeDays';e={ if($_.SignInActivity.LastSignInDateTime){[int]((Get-Date)-$_.SignInActivity.LastSignInDateTime).TotalDays} else {'never'} }} |
  Sort-Object AgeDays -Descending |
  Format-Table -AutoSize

#requires -Version 7.0
# Northgate Financial - read-only identity risk baseline.
# Produces CSV evidence and a console summary. Changes nothing in the tenant.

$readScopes = @('User.Read.All','AuditLog.Read.All',
                'Directory.Read.All','RoleManagement.Read.Directory')
Connect-MgGraph -Scopes $readScopes -NoWelcome

$stamp  = Get-Date -Format 'yyyyMMdd-HHmm'
$outDir = Join-Path (Get-Location) "NorthgateBaseline-$stamp"
New-Item -ItemType Directory -Path $outDir -Force | Out-Null

# --- Registration (MFA / SSPR) ---
$reg = Get-MgReportAuthenticationMethodUserRegistrationDetail -All
$mfaCapable = $reg | Where-Object { $_.IsMfaCapable }
$smsReliant = $reg | Where-Object {
  ($_.MethodsRegistered -contains 'mobilePhone') -and
  -not ($_.MethodsRegistered -contains 'microsoftAuthenticatorPush') -and
  -not ($_.MethodsRegistered -contains 'fido2SecurityKey')
}
$reg | Select-Object UserPrincipalName,IsAdmin,IsMfaCapable,IsMfaRegistered,
        IsSsprRegistered,@{n='Methods';e={$_.MethodsRegistered -join ';'}} |
  Export-Csv (Join-Path $outDir 'registration.csv') -NoTypeInformation

# --- Privileged roles ---
$priv = foreach ($role in (Get-MgDirectoryRole -All)) {
  foreach ($m in (Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id -All)) {
    [pscustomobject]@{
      Role=$role.DisplayName
      MemberType=($m.AdditionalProperties['@odata.type'] -replace '#microsoft.graph.','')
      DisplayName=$m.AdditionalProperties['displayName']
      Upn=$m.AdditionalProperties['userPrincipalName']
    }
  }
}
$priv | Export-Csv (Join-Path $outDir 'privileged-roles.csv') -NoTypeInformation

# --- Dormancy and guests ---
$props = 'id','displayName','userPrincipalName','accountEnabled',
         'createdDateTime','userType','signInActivity'
$users  = Get-MgUser -All -Property $props
$cutoff = (Get-Date).AddDays(-90)
$dormant = $users | Where-Object {
  $_.AccountEnabled -and
  ($null -eq $_.SignInActivity.LastSignInDateTime -or
   $_.SignInActivity.LastSignInDateTime -lt $cutoff)
}
$guests  = $users | Where-Object { $_.UserType -eq 'Guest' }
$dormant | Select-Object DisplayName,UserPrincipalName,
  @{n='LastSignIn';e={$_.SignInActivity.LastSignInDateTime}} |
  Export-Csv (Join-Path $outDir 'dormant.csv') -NoTypeInformation

# --- Summary ---
$total = $users.Count
$summary = [ordered]@{
  'Report generated'      = (Get-Date).ToString('u')
  'Total users'           = $total
  'MFA-capable'           = "$($mfaCapable.Count) ($([math]::Round(($mfaCapable.Count/[math]::Max($total,1))*100))%)"
  'SMS-reliant (migrate)' = $smsReliant.Count
  'Privileged assignments'= $priv.Count
  'Dormant (90d+)'        = $dormant.Count
  'Guest accounts'        = $guests.Count
  'Evidence folder'       = $outDir
}
"`n===== NORTHGATE IDENTITY RISK BASELINE =====" | Write-Host -ForegroundColor Cyan
$summary.GetEnumerator() | ForEach-Object {
  '{0,-24}: {1}' -f $_.Key, $_.Value | Write-Host
}