Prerequisites for Detox

# Exchange Online Connexion
# This prompts for user credentials and connects to Exchange Online using those credentials.
$UserCredential = Get-Credential
Connect-ExchangeOnline -Credential $UserCredential

# Define variables
# These variables store:
# * The name of the service account
# * The name of the role group
# * The names of custom management roles to be created.
$serviceAccountName = "svc_lem"
$roleGroupName = "I2A"
$roleName = "Mail Recipients - ViewOnly - I2A"
$roleName1 = "Remediation - I2A"
$roleName2 = "Remediation 2 - I2A"

# Create Role: “Mail Recipients - ViewOnly - I2A”
# Creates a new management role based on the "Mail Recipients" parent role.
New-ManagementRole $roleName -Parent "Mail Recipients"
Get-ManagementRoleEntry ($roleName + "\*")
$data2 = Get-ManagementRoleEntry ($roleName + "\*")
# This loop removes all cmdlets except those starting with "Get", effectively making the role read-only.
foreach($data in $data2)
{
$name = ""
$name = $data.Name
if($name -NotLike "Get*")
{
Remove-ManagementRoleEntry $roleName\$name -confirm:$false
Write-Host ("done for $name")
}
}

# Create Role: “Remediation - I2A”
# Creates another role based on "Mail Recipients".
New-ManagementRole $roleName1 -Parent "Mail Recipients"
Get-ManagementRoleEntry ($roleName1 + "\*")
$entries = Get-ManagementRoleEntry ($roleName1 + "\*")
#This time, it keeps only specific "Remove" cmdlets (like Remove-MailboxPermission, etc.), making the role strictly focused on remediation tasks, like removing permissions or inbox rules.
foreach($entry in $entries)
{
$name = ""
$name = $entry.Name
if ($name -NotLike "Remove-MailboxPermission" -And $name -NotLike "Remove-InboxRule" -And $name -NotLike "Remove-MailboxFolderPermission" -And $name -NotLike "Remove-RecipientPermission" -And $name -NotLike "Remove-ADPermission")
{
Remove-ManagementRoleEntry $roleName1\$name -Confirm:$false
Write-Host ("done for $name")
} 
}

# Create Role: “Remediation 2 - I2A”
# Creates a third custom role based on "Mail Recipient Creation".
New-ManagementRole $roleName2 -Parent "Mail Recipient Creation"
Get-ManagementRoleEntry ($roleName2 + "\*")
$entries = Get-ManagementRoleEntry ($roleName2 + "\*")
#This removes all cmdlets except Set-MailboxFolderPermission, allowing the role to only modify folder permissions, again focusing on a specific remediation use case.
foreach($entry in $entries)
{
$name = ""
$name = $entry.Name
if ($name -NotLike "Set-MailboxFolderPermission")
{
Remove-ManagementRoleEntry $roleName2\$name -Confirm:$false
Write-Host ("done for $name")
} 
}

Get-ManagementRoleEntry ($roleName + "\*")
Get-ManagementRoleEntry ($roleName1 + "\*")
Get-ManagementRoleEntry ($roleName2 + "\*")

#Assign Roles to Role Group and Add Service Account
# Creates a new role group named "I2A", includes:
# * Standard built-in roles (like audit and read-only)
# * The 3 custom roles we created
# * Assigns everything to the svc_lem service account
New-RoleGroup -Name $roleGroupName -Roles "Audit Logs","View-Only Configuration","View-Only Recipients",$roleName,$roleName1,$roleName2 -Members $serviceAccountName

# Disconnect
# Ends the Exchange Online session cleanly.
Disconnect-ExchangeOnline