Prerequisites for M365 environment

# Import ExchangeOnline module and Graph module
Import-Module ExchangeOnlineManagement;Get-Module ExchangeOnlineManagement
Import-Module Microsoft.Graph;Get-Module Microsoft.Graph

# Load and connect to Microsoft Graph with administrator rights.
Connect-MgGraph -Scopes AppRoleAssignment.ReadWrite.All,Application.Read.All

# Retrieve the Service Principal corresponding to the "IDECSI - Platform" application.
$AzureADApp = Get-MgServicePrincipal -Filter "DisplayName eq 'IDECSI - Platform'"

# Exchange Online Connexion
# This prompts for user credentials. Please use an Exchange Admin account to connect.
Connect-ExchangeOnline

# Create an Exchange Service Principal linked to the Azure AD App
New-ServicePrincipal -AppId $AzureADApp.AppId -ObjectId $AzureADApp.Id -DisplayName "SP for Azure AD App IDECSI - Platform"

# Retrieve the new Service Principal object
$SP = Get-ServicePrincipal -Identity "SP for Azure AD App IDECSI - Platform"
Write-Host ($SP | Format-Table | Out-String)

# Define variables
# These variables store:
# * The name of the role group
$roleGroupName = "I2A"
# * The names of custom management roles to be created.
$roleName = "Mail Recipients - ViewOnly - I2A"
$roleName1 = "Remediation - I2A"
$roleName2 = "Remediation 2 - I2A"

# Create Role: "Mail Recipients - ViewOnly - I2A"
# Creates a new management role based on the "Mail Recipients" parent role.
New-ManagementRole $roleName -Parent "Mail Recipients"
Get-ManagementRoleEntry ($roleName + "\*")
$data2 = Get-ManagementRoleEntry ($roleName + "\*")
# This loop removes all cmdlets except those starting with "Get", effectively making the role read-only.
foreach($data in $data2)
{
$name = ""
$name = $data.Name
if($name -NotLike "Get*")
{
Remove-ManagementRoleEntry $roleName\$name -confirm:$false
Write-Host ("Done for $name")
}
}

# Create Role: "Remediation - I2A"
# Creates another role based on "Mail Recipients".
New-ManagementRole $roleName1 -Parent "Mail Recipients"
Get-ManagementRoleEntry ($roleName1 + "\*")
$entries = Get-ManagementRoleEntry ($roleName1 + "\*")
# This time, it keeps only specific "Remove" cmdlets (like Remove-MailboxPermission, etc.), making the role strictly focused on remediation tasks, like removing permissions or inbox rules.
foreach($entry in $entries)
{
$name = ""
$name = $entry.Name
if ($name -NotLike "Remove-MailboxPermission" -And $name -NotLike "Remove-InboxRule" -And $name -NotLike "Remove-MailboxFolderPermission" -And $name -NotLike "Remove-RecipientPermission" -And $name -NotLike "Remove-ADPermission")
{
Remove-ManagementRoleEntry $roleName1\$name -Confirm:$false
Write-Host ("Done for $name")
} 
}

# Create Role: "Remediation 2 - I2A"
# Creates a third custom role based on "Mail Recipient Creation".
New-ManagementRole $roleName2 -Parent "Mail Recipient Creation"
Get-ManagementRoleEntry ($roleName2 + "\*")
$entries = Get-ManagementRoleEntry ($roleName2 + "\*")
# This removes all cmdlets except Set-MailboxFolderPermission, allowing the role to only modify folder permissions, again focusing on a specific remediation use case.
foreach($entry in $entries)
{
$name = ""
$name = $entry.Name
if ($name -NotLike "Set-MailboxFolderPermission")
{
Remove-ManagementRoleEntry $roleName2\$name -Confirm:$false
Write-Host ("Done for $name")
} 
}

Get-ManagementRoleEntry ($roleName + "\*")
Get-ManagementRoleEntry ($roleName1 + "\*")
Get-ManagementRoleEntry ($roleName2 + "\*")

# Assign Roles to Role Group and Add Service Principal
# Creates a new role group named "I2A", includes:
# * Standard built-in roles (like audit and read-only)
# * The 3 custom roles we created
# * Assigns everything to the Service Principal
New-RoleGroup -Name $roleGroupName -Roles "Audit Logs","View-Only Configuration","View-Only Recipients",$roleName,$roleName1,$roleName2 -Members $SP.Identity

# Disconnect
# Ends the Exchange Online and Graph session properly.
Disconnect-ExchangeOnline
Disconnect-Graph