Prerequisites for Picture

# Import ExchangeOnline module and Graph module
Import-Module ExchangeOnlineManagement;Get-Module ExchangeOnlineManagement
Import-Module Microsoft.Graph;Get-Module Microsoft.Graph

# Load and connect to Microsoft Graph with administrator rights.
Connect-MgGraph -Scopes AppRoleAssignment.ReadWrite.All,Application.Read.All

# Retrieve the Service Principal corresponding to the "IDECSI - Platform" application.
$AzureADApp = Get-MgServicePrincipal -Filter "DisplayName eq 'IDECSI - Platform - Picture'"

# Exchange Online Connexion
# This prompts for user credentials. Please use an Exchange Admin account to connect.
Connect-ExchangeOnline

# Create an Exchange Service Principal linked to the Azure AD App
New-ServicePrincipal -AppId $AzureADApp.AppId -ObjectId $AzureADApp.Id -DisplayName "SP for Azure AD App IDECSI - Platform - Picture"

# Retrieve the new Service Principal object
$SP = Get-ServicePrincipal -Identity "SP for Azure AD App IDECSI - Platform - Picture"
Write-Host ($SP | Format-Table | Out-String)

# Define variables
# These variables store:
# * The name of the role group
$roleGroupName = "I2A"
# * The names of custom management roles to be created.
$roleName = "Mail Recipients - ViewOnly - I2A"

# Create Role: "Mail Recipients - ViewOnly - I2A"
# Creates a new management role based on the "Mail Recipients" parent role.
New-ManagementRole $roleName -Parent "Mail Recipients"
Get-ManagementRoleEntry ($roleName + "\*")
$data2 = Get-ManagementRoleEntry ($roleName + "\*")
# This loop removes all cmdlets except those starting with "Get", effectively making the role read-only.
foreach($data in $data2)
{
$name = ""
$name = $data.Name
if($name -NotLike "Get*")
{
Remove-ManagementRoleEntry $roleName\$name -confirm:$false
Write-Host ("Done for $name")
}
}

Get-ManagementRoleEntry ($roleName + "\*")

# Assign Roles to Role Group and Add Service Principal
# Creates a new role group named "I2A", includes:
# * Standard built-in roles (like audit and read-only)
# * The custom role we created
# * Assigns everything to the Service Principal
New-RoleGroup -Name $roleGroupName -Roles "Audit Logs","View-Only Configuration","View-Only Recipients",$roleName -Members $SP.Identity

# Disconnect
# Ends the Exchange Online and Graph session properly.
Disconnect-ExchangeOnline
Disconnect-Graph