forked from richard-hart/cyber-security
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathHTMLReport.ps1
1509 lines (1319 loc) · 51.5 KB
/
HTMLReport.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<#
.NOTES
===========================================================================
Version: 1.0.5
Updated on: 8/14/2018
Created by: /u/TheLazyAdministrator
Contributors: /u/ascIVV, /u/jmn_lab, /u/nothingpersonalbro
===========================================================================
AzureAD Module is required
Install-Module -Name AzureAD
https://www.powershellgallery.com/packages/azuread/
ReportHTML Moduile is required
Install-Module -Name ReportHTML
https://www.powershellgallery.com/packages/ReportHTML/
UPDATES
1.0.5
/u/ascIVV: Added the following:
- Admin Tab
- Privileged Role Administrators
- Exchange Administrators
- User Account Administrators
- Tech Account Restricted Exchange Admin Role
- SharePoint Administrators
- Skype Administrators
- CRM Service Administrators
- Power BI Administrators
- Service Support Administrators
- Billing Administrators
/u/TheLazyAdministrator
- Cleaned up formatting
- Error Handling for $Null obj
- Console status
- Windows Defender ATP SKU
.DESCRIPTION
Generate an interactive HTML report on your Office 365 tenant. Report on Users, Tenant information, Groups, Policies, Contacts, Mail Users, Licenses and more!
.Link
Original: http://thelazyadministrator.com/2018/06/22/create-an-interactive-html-report-for-office-365-with-powershell/
#>
#########################################
# #
# VARIABLES #
# #
#########################################
#Company logo that will be displayed on the left, can be URL or UNC
#$CompanyLogo = "http://thelazyadministrator.com/wp-content/uploads/2018/06/logo-2-e1529684959389.png"
#Logo that will be on the right side, UNC or URL
#$RightLogo = "http://thelazyadministrator.com/wp-content/uploads/2018/06/amd.png"
#Location the report will be saved to
$ReportSavePath = "C:\Temp\"
#Variable to filter licenses out, in current state will only get licenses with a count less than 9,000 this will help filter free/trial licenses
$LicenseFilter = "90000"
#Set to $True if your global admin requires 2FA
$2FA = $True
########################################
If ($2FA -eq $False)
{
$credential = Get-Credential -Message "Please enter your Office 365 credentials"
Import-Module AzureAD
Connect-AzureAD -Credential $credential
$exchangeSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://outlook.office365.com/powershell-liveid/" -Authentication "Basic" -AllowRedirection -Credential $credential
Import-PSSession $exchangeSession -AllowClobber
}
Else
{
$Modules = dir $Env:LOCALAPPDATA\Apps\2.0\*\CreateExoPSSession.ps1 -Recurse | Select-Object -ExpandProperty Target -First 1
foreach ($Module in $Modules)
{
Import-Module "$Module"
}
Write-Host "Credential prompt to connect to Azure Graph" -ForegroundColor Yellow
#Connect to Azure Graph w/2FA
Connect-AzureAD
Write-Host "Credential prompt to connect to Azure" -ForegroundColor Yellow
#Connect to Azure w/ 2FA
Connect-MSOLService
Write-Host "Credential prompt to connect to Exchange Online" -ForegroundColor Yellow
#Connect to Exchange Online w/ 2FA
Connect-EXOPSSession
}
$Table = New-Object 'System.Collections.Generic.List[System.Object]'
$LicenseTable = New-Object 'System.Collections.Generic.List[System.Object]'
$UserTable = New-Object 'System.Collections.Generic.List[System.Object]'
$SharedMailboxTable = New-Object 'System.Collections.Generic.List[System.Object]'
$GroupTypetable = New-Object 'System.Collections.Generic.List[System.Object]'
$IsLicensedUsersTable = New-Object 'System.Collections.Generic.List[System.Object]'
$ContactTable = New-Object 'System.Collections.Generic.List[System.Object]'
$MailUser = New-Object 'System.Collections.Generic.List[System.Object]'
$ContactMailUserTable = New-Object 'System.Collections.Generic.List[System.Object]'
$RoomTable = New-Object 'System.Collections.Generic.List[System.Object]'
$EquipTable = New-Object 'System.Collections.Generic.List[System.Object]'
$GlobalAdminTable = New-Object 'System.Collections.Generic.List[System.Object]'
$ExchangeAdminTable = New-Object 'System.Collections.Generic.List[System.Object]'
$PrivAdminTable = New-Object 'System.Collections.Generic.List[System.Object]'
$UserAdminTable = New-Object 'System.Collections.Generic.List[System.Object]'
$TechExchAdminTable = New-Object 'System.Collections.Generic.List[System.Object]'
$SharePointAdminTable = New-Object 'System.Collections.Generic.List[System.Object]'
$SkypeAdminTable = New-Object 'System.Collections.Generic.List[System.Object]'
$CRMAdminTable = New-Object 'System.Collections.Generic.List[System.Object]'
$PowerBIAdminTable = New-Object 'System.Collections.Generic.List[System.Object]'
$ServiceAdminTable = New-Object 'System.Collections.Generic.List[System.Object]'
$BillingAdminTable = New-Object 'System.Collections.Generic.List[System.Object]'
$StrongPasswordTable = New-Object 'System.Collections.Generic.List[System.Object]'
$CompanyInfoTable = New-Object 'System.Collections.Generic.List[System.Object]'
$DomainTable = New-Object 'System.Collections.Generic.List[System.Object]'
$Sku = @{
"O365_BUSINESS_ESSENTIALS" = "Office 365 Business Essentials"
"O365_BUSINESS_PREMIUM" = "Office 365 Business Premium"
"DESKLESSPACK" = "Office 365 (Plan K1)"
"DESKLESSWOFFPACK" = "Office 365 (Plan K2)"
"LITEPACK" = "Office 365 (Plan P1)"
"EXCHANGESTANDARD" = "Office 365 Exchange Online Only"
"STANDARDPACK" = "Enterprise Plan E1"
"STANDARDWOFFPACK" = "Office 365 (Plan E2)"
"ENTERPRISEPACK" = "Enterprise Plan E3"
"ENTERPRISEPACKLRG" = "Enterprise Plan E3"
"ENTERPRISEWITHSCAL" = "Enterprise Plan E4"
"STANDARDPACK_STUDENT" = "Office 365 (Plan A1) for Students"
"STANDARDWOFFPACKPACK_STUDENT" = "Office 365 (Plan A2) for Students"
"ENTERPRISEPACK_STUDENT" = "Office 365 (Plan A3) for Students"
"ENTERPRISEWITHSCAL_STUDENT" = "Office 365 (Plan A4) for Students"
"STANDARDPACK_FACULTY" = "Office 365 (Plan A1) for Faculty"
"STANDARDWOFFPACKPACK_FACULTY" = "Office 365 (Plan A2) for Faculty"
"ENTERPRISEPACK_FACULTY" = "Office 365 (Plan A3) for Faculty"
"ENTERPRISEWITHSCAL_FACULTY" = "Office 365 (Plan A4) for Faculty"
"ENTERPRISEPACK_B_PILOT" = "Office 365 (Enterprise Preview)"
"STANDARD_B_PILOT" = "Office 365 (Small Business Preview)"
"VISIOCLIENT" = "Visio Pro Online"
"POWER_BI_ADDON" = "Office 365 Power BI Addon"
"POWER_BI_INDIVIDUAL_USE" = "Power BI Individual User"
"POWER_BI_STANDALONE" = "Power BI Stand Alone"
"POWER_BI_STANDARD" = "Power-BI Standard"
"PROJECTESSENTIALS" = "Project Lite"
"PROJECTCLIENT" = "Project Professional"
"PROJECTONLINE_PLAN_1" = "Project Online"
"PROJECTONLINE_PLAN_2" = "Project Online and PRO"
"ProjectPremium" = "Project Online Premium"
"ECAL_SERVICES" = "ECAL"
"EMS" = "Enterprise Mobility Suite"
"RIGHTSMANAGEMENT_ADHOC" = "Windows Azure Rights Management"
"MCOMEETADV" = "PSTN conferencing"
"SHAREPOINTSTORAGE" = "SharePoint storage"
"PLANNERSTANDALONE" = "Planner Standalone"
"CRMIUR" = "CMRIUR"
"BI_AZURE_P1" = "Power BI Reporting and Analytics"
"INTUNE_A" = "Windows Intune Plan A"
"PROJECTWORKMANAGEMENT" = "Office 365 Planner Preview"
"ATP_ENTERPRISE" = "Exchange Online Advanced Threat Protection"
"EQUIVIO_ANALYTICS" = "Office 365 Advanced eDiscovery"
"AAD_BASIC" = "Azure Active Directory Basic"
"RMS_S_ENTERPRISE" = "Azure Active Directory Rights Management"
"AAD_PREMIUM" = "Azure Active Directory Premium"
"MFA_PREMIUM" = "Azure Multi-Factor Authentication"
"STANDARDPACK_GOV" = "Microsoft Office 365 (Plan G1) for Government"
"STANDARDWOFFPACK_GOV" = "Microsoft Office 365 (Plan G2) for Government"
"ENTERPRISEPACK_GOV" = "Microsoft Office 365 (Plan G3) for Government"
"ENTERPRISEWITHSCAL_GOV" = "Microsoft Office 365 (Plan G4) for Government"
"DESKLESSPACK_GOV" = "Microsoft Office 365 (Plan K1) for Government"
"ESKLESSWOFFPACK_GOV" = "Microsoft Office 365 (Plan K2) for Government"
"EXCHANGESTANDARD_GOV" = "Microsoft Office 365 Exchange Online (Plan 1) only for Government"
"EXCHANGEENTERPRISE_GOV" = "Microsoft Office 365 Exchange Online (Plan 2) only for Government"
"SHAREPOINTDESKLESS_GOV" = "SharePoint Online Kiosk"
"EXCHANGE_S_DESKLESS_GOV" = "Exchange Kiosk"
"RMS_S_ENTERPRISE_GOV" = "Windows Azure Active Directory Rights Management"
"OFFICESUBSCRIPTION_GOV" = "Office ProPlus"
"MCOSTANDARD_GOV" = "Lync Plan 2G"
"SHAREPOINTWAC_GOV" = "Office Online for Government"
"SHAREPOINTENTERPRISE_GOV" = "SharePoint Plan 2G"
"EXCHANGE_S_ENTERPRISE_GOV" = "Exchange Plan 2G"
"EXCHANGE_S_ARCHIVE_ADDON_GOV" = "Exchange Online Archiving"
"EXCHANGE_S_DESKLESS" = "Exchange Online Kiosk"
"SHAREPOINTDESKLESS" = "SharePoint Online Kiosk"
"SHAREPOINTWAC" = "Office Online"
"YAMMER_ENTERPRISE" = "Yammer for the Starship Enterprise"
"EXCHANGE_L_STANDARD" = "Exchange Online (Plan 1)"
"MCOLITE" = "Lync Online (Plan 1)"
"SHAREPOINTLITE" = "SharePoint Online (Plan 1)"
"OFFICE_PRO_PLUS_SUBSCRIPTION_SMBIZ" = "Office ProPlus"
"EXCHANGE_S_STANDARD_MIDMARKET" = "Exchange Online (Plan 1)"
"MCOSTANDARD_MIDMARKET" = "Lync Online (Plan 1)"
"SHAREPOINTENTERPRISE_MIDMARKET" = "SharePoint Online (Plan 1)"
"OFFICESUBSCRIPTION" = "Office ProPlus"
"YAMMER_MIDSIZE" = "Yammer"
"DYN365_ENTERPRISE_PLAN1" = "Dynamics 365 Customer Engagement Plan Enterprise Edition"
"ENTERPRISEPREMIUM_NOPSTNCONF" = "Enterprise E5 (without Audio Conferencing)"
"ENTERPRISEPREMIUM" = "Enterprise E5 (with Audio Conferencing)"
"MCOSTANDARD" = "Skype for Business Online Standalone Plan 2"
"PROJECT_MADEIRA_PREVIEW_IW_SKU" = "Dynamics 365 for Financials for IWs"
"STANDARDWOFFPACK_IW_STUDENT" = "Office 365 Education for Students"
"STANDARDWOFFPACK_IW_FACULTY" = "Office 365 Education for Faculty"
"EOP_ENTERPRISE_FACULTY" = "Exchange Online Protection for Faculty"
"EXCHANGESTANDARD_STUDENT" = "Exchange Online (Plan 1) for Students"
"OFFICESUBSCRIPTION_STUDENT" = "Office ProPlus Student Benefit"
"STANDARDWOFFPACK_FACULTY" = "Office 365 Education E1 for Faculty"
"STANDARDWOFFPACK_STUDENT" = "Microsoft Office 365 (Plan A2) for Students"
"DYN365_FINANCIALS_BUSINESS_SKU" = "Dynamics 365 for Financials Business Edition"
"DYN365_FINANCIALS_TEAM_MEMBERS_SKU" = "Dynamics 365 for Team Members Business Edition"
"FLOW_FREE" = "Microsoft Flow Free"
"POWER_BI_PRO" = "Power BI Pro"
"O365_BUSINESS" = "Office 365 Business"
"DYN365_ENTERPRISE_SALES" = "Dynamics Office 365 Enterprise Sales"
"RIGHTSMANAGEMENT" = "Rights Management"
"PROJECTPROFESSIONAL" = "Project Professional"
"VISIOONLINE_PLAN1" = "Visio Online Plan 1"
"EXCHANGEENTERPRISE" = "Exchange Online Plan 2"
"DYN365_ENTERPRISE_P1_IW" = "Dynamics 365 P1 Trial for Information Workers"
"DYN365_ENTERPRISE_TEAM_MEMBERS" = "Dynamics 365 For Team Members Enterprise Edition"
"CRMSTANDARD" = "Microsoft Dynamics CRM Online Professional"
"EXCHANGEARCHIVE_ADDON" = "Exchange Online Archiving For Exchange Online"
"EXCHANGEDESKLESS" = "Exchange Online Kiosk"
"SPZA_IW" = "App Connect"
"WINDOWS_STORE" = "Windows Store for Business"
"MCOEV" = "Microsoft Phone System"
"VIDEO_INTEROP" = "Polycom Skype Meeting Video Interop for Skype for Business"
"SPE_E5" = "Microsoft 365 E5"
"SPE_E3" = "Microsoft 365 E3"
"ATA" = "Advanced Threat Analytics"
"MCOPSTN2" = "Domestic and International Calling Plan"
"FLOW_P1" = "Microsoft Flow Plan 1"
"FLOW_P2" = "Microsoft Flow Plan 2"
"WIN_DEF_ATP" = "Windows Defender ATP"
}
# Get all users right away. Instead of doing several lookups, we will use this object to look up all the information needed.
$AllUsers = get-azureaduser -All:$true -ErrorAction SilentlyContinue
Write-Host "Gathering Company Information..." -ForegroundColor Yellow
#Company Information
$CompanyInfo = Get-AzureADTenantDetail -ErrorAction SilentlyContinue
$CompanyName = $CompanyInfo.DisplayName
$TechEmail = $CompanyInfo.TechnicalNotificationMails | Out-String
$DirSync = $CompanyInfo.DirSyncEnabled
$LastDirSync = $CompanyInfo.CompanyLastDirSyncTime
If ($DirSync -eq $Null)
{
$LastDirSync = "Not Available"
$DirSync = "Disabled"
}
If ($PasswordSync -eq $Null)
{
$LastPasswordSync = "Not Available"
}
$obj = [PSCustomObject]@{
'Name' = $CompanyName
'Technical E-mail' = $TechEmail
'Directory Sync' = $DirSync
'Last Directory Sync' = $LastDirSync
}
$CompanyInfoTable.add($obj)
Write-Host "Gathering Admin Roles and Members..." -ForegroundColor Yellow
Write-Host "Getting Tenant Global Admins" -ForegroundColor white
#Get Tenant Global Admins
$role = Get-AzureADDirectoryRole | Where-Object { $_.DisplayName -match "Company Administrator" } -ErrorAction SilentlyContinue
If ($null -ne $role)
{
$Admins = Get-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -ne "CloudConsoleGrapApi" }
Foreach ($Admin in $Admins)
{
$MFAS = ((Get-MsolUser -objectid $Admin.ObjectID -ErrorAction SilentlyContinue).StrongAuthenticationRequirements).State
if ($Null -ne $MFAS)
{
$MFASTATUS = "Enabled"
}
else
{
$MFASTATUS = "Disabled"
}
$Name = $Admin.DisplayName
$EmailAddress = $Admin.Mail
if (($admin.assignedlicenses.SkuID) -ne $Null)
{
$Licensed = $True
}
else
{
$Licensed = $False
}
$obj = [PSCustomObject]@{
'Name' = $Name
'MFA Status' = $MFAStatus
'Is Licensed' = $Licensed
'E-Mail Address' = $EmailAddress
}
$GlobalAdminTable.add($obj)
}
}
Write-Host "Getting Tenant Exchange Admins" -ForegroundColor white
#Get Tenant Exchange Admins
$exchrole = Get-AzureADDirectoryRole | Where-Object { $_.DisplayName -match "Exchange Service Administrator" } -ErrorAction SilentlyContinue
If ($Null -ne $exchrole)
{
$ExchAdmins = Get-AzureADDirectoryRoleMember -ObjectId $exchrole.ObjectId -ErrorAction SilentlyContinue
Foreach ($ExchAdmin in $ExchAdmins)
{
$MFAS = ((Get-MsolUser -objectid $ExchAdmin.ObjectID -ErrorAction SilentlyContinue).StrongAuthenticationRequirements).State
if ($Null -ne $MFAS)
{
$MFASTATUS = "Enabled"
}
else
{
$MFASTATUS = "Disabled"
}
$Name = $ExchAdmin.DisplayName
$EmailAddress = $ExchAdmin.Mail
if (($Exchadmin.assignedlicenses.SkuID) -ne $Null)
{
$Licensed = $True
}
else
{
$Licensed = $False
}
$obj = [PSCustomObject]@{
'Name' = $Name
'MFA Status' = $MFAStatus
'Is Licensed' = $Licensed
'E-Mail Address' = $EmailAddress
}
$ExchangeAdminTable.add($obj)
}
}
If (($ExchangeAdminTable).count -eq 0)
{
$ExchangeAdminTable = [PSCustomObject]@{
'Information' = 'Information: No Users with the Exchange Administrator role were found, refer to the Global Administrators list.'
}
}
Write-Host "Getting Tenant Privileged Admins" -ForegroundColor white
#Get Tenant Privileged Admins
$privadminrole = Get-AzureADDirectoryRole | Where-Object { $_.DisplayName -match "Privileged Role Administrator" } -ErrorAction SilentlyContinue
If ($Null -ne $privadminrole)
{
$PrivAdmins = Get-AzureADDirectoryRoleMember -ObjectId $privadminrole.ObjectId -ErrorAction SilentlyContinue -ErrorVariable SilentlyContinue
Foreach ($PrivAdmin in $PrivAdmins)
{
$MFAS = ((Get-MsolUser -objectid $PrivAdmin.ObjectID -ErrorAction SilentlyContinue).StrongAuthenticationRequirements).State
if ($Null -ne $MFAS)
{
$MFASTATUS = "Enabled"
}
else
{
$MFASTATUS = "Disabled"
}
$Name = $PrivAdmin.DisplayName
$EmailAddress = $PrivAdmin.Mail
if (($admin.assignedlicenses.SkuID) -ne $Null)
{
$Licensed = $True
}
else
{
$Licensed = $False
}
$obj = [PSCustomObject]@{
'Name' = $Name
'MFA Status' = $MFAStatus
'Is Licensed' = $Licensed
'E-Mail Address' = $EmailAddress
}
$PrivAdminTable.add($obj)
}
}
If (($PrivAdminTable).count -eq 0)
{
$PrivAdminTable = [PSCustomObject]@{
'Information' = 'Information: No Users with the Privileged Administrator role were found, refer to the Global Administrators list.'
}
}
Write-Host "Getting Tenant User Account Admins" -ForegroundColor white
#Get Tenant User Account Admins
$userrole = Get-AzureADDirectoryRole | Where-Object { $_.DisplayName -match "User Account Administrator" } -ErrorAction SilentlyContinue
If ($Null -ne $userrole)
{
$userAdmins = Get-AzureADDirectoryRoleMember -ObjectId $userrole.ObjectId -ErrorAction SilentlyContinue
Foreach ($userAdmin in $userAdmins)
{
$MFAS = ((Get-MsolUser -objectid $userAdmin.ObjectID -ErrorAction SilentlyContinue).StrongAuthenticationRequirements).State
if ($Null -ne $MFAS)
{
$MFASTATUS = "Enabled"
}
else
{
$MFASTATUS = "Disabled"
}
$Name = $userAdmin.DisplayName
$EmailAddress = $userAdmin.Mail
if (($useradmin.assignedlicenses.SkuID) -ne $Null)
{
$Licensed = $True
}
else
{
$Licensed = $False
}
$obj = [PSCustomObject]@{
'Name' = $Name
'MFA Status' = $MFAStatus
'Is Licensed' = $Licensed
'E-Mail Address' = $EmailAddress
}
$UserAdminTable.add($obj)
}
}
If (($UserAdminTable).count -eq 0)
{
$UserAdminTable = [PSCustomObject]@{
'Information' = 'Information: No Users with the User Account Administrator role were found, refer to the Global Administrators list.'
}
}
Write-Host "Getting Helpdesk Admins" -ForegroundColor white
#Get Tenant Tech Account Exchange Admins
$TechExchAdmins = Get-RoleGroupMember -Identity "Helpdesk Administrator" -ErrorAction SilentlyContinue
Foreach ($TechExchAdmin in $TechExchAdmins)
{
$AccountInfo = Get-MsolUser -searchstring $TechExchAdmin.Name -ErrorAction SilentlyContinue
$Name = $AccountInfo.DisplayName
$MFAS = ((Get-MsolUser -objectid $AccountInfo.ObjectID -ErrorAction SilentlyContinue).StrongAuthenticationRequirements).State
if ($Null -ne $MFAS)
{
$MFASTATUS = "Enabled"
}
else
{
$MFASTATUS = "Disabled"
}
$EmailAddress = $AccountInfo.UserPrincipalName
if (($AccountInfo.assignedlicenses.SkuID) -ne $Null)
{
$Licensed = $True
}
else
{
$Licensed = $False
}
$obj = [PSCustomObject]@{
'Name' = $Name
'MFA Status' = $MFAStatus
'Is Licensed' = $Licensed
'E-Mail Address' = $EmailAddress
}
$TechExchAdminTable.add($obj)
}
If (($TechExchAdminTable).count -eq 0)
{
$TechExchAdminTable = [PSCustomObject]@{
'Information' = 'Information: No Users with the Helpdesk Administrator role were found, refer to the Global Administrators list.'
}
}
Write-Host "Getting Tenant SharePoint Admins" -ForegroundColor white
#Get Tenant SharePoint Admins
$sprole = Get-AzureADDirectoryRole | Where-Object { $_.DisplayName -match "SharePoint Service Administrator" } -ErrorAction SilentlyContinue
If ($Null -ne $sprole)
{
$SPAdmins = Get-AzureADDirectoryRoleMember -ObjectId $sprole.ObjectId -ErrorAction SilentlyContinue
Foreach ($SPAdmin in $SPAdmins)
{
$MFAS = ((Get-MsolUser -objectid $SPAdmin.ObjectID -ErrorAction SilentlyContinue).StrongAuthenticationRequirements).State
if ($Null -ne $MFAS)
{
$MFASTATUS = "Enabled"
}
else
{
$MFASTATUS = "Disabled"
}
$Name = $SPAdmin.DisplayName
$EmailAddress = $SPAdmin.Mail
if (($SPadmin.assignedlicenses.SkuID) -ne $Null)
{
$Licensed = $True
}
else
{
$Licensed = $False
}
$obj = [PSCustomObject]@{
'Name' = $Name
'MFA Status' = $MFAStatus
'Is Licensed' = $Licensed
'E-Mail Address' = $EmailAddress
}
$SharePointAdminTable.add($obj)
}
}
If (($SharePointAdminTable).count -eq 0)
{
$SharePointAdminTable = [PSCustomObject]@{
'Information' = 'Information: No Users with the SharePoint Service Administrator role were found, refer to the Global Administrators list.'
}
}
Write-Host "Getting Tenant Skype Admins" -ForegroundColor white
#Get Tenant Skype Admins
$skyperole = Get-AzureADDirectoryRole | Where-Object { $_.DisplayName -match "Lync Service Administrator" } -ErrorAction SilentlyContinue
If ($Null -ne $skyperole)
{
$skypeAdmins = Get-AzureADDirectoryRoleMember -ObjectId $skyperole.ObjectId -ErrorAction SilentlyContinue
Foreach ($skypeAdmin in $skypeAdmins)
{
$MFAS = ((Get-MsolUser -objectid $skypeAdmin.ObjectID -ErrorAction SilentlyContinue).StrongAuthenticationRequirements).State
if ($Null -ne $MFAS)
{
$MFASTATUS = "Enabled"
}
else
{
$MFASTATUS = "Disabled"
}
$Name = $skypeAdmin.DisplayName
$EmailAddress = $skypeAdmin.Mail
if (($skypeadmin.assignedlicenses.SkuID) -ne $Null)
{
$Licensed = $True
}
else
{
$Licensed = $False
}
$obj = [PSCustomObject]@{
'Name' = $Name
'MFA Status' = $MFAStatus
'Is Licensed' = $Licensed
'E-Mail Address' = $EmailAddress
}
$SkypeAdminTable.add($obj)
}
}
If (($skypeAdminTable).count -eq 0)
{
$skypeAdminTable = [PSCustomObject]@{
'Information' = 'Information: No Users with the Lync Service Administrator role were found, refer to the Global Administrators list.'
}
}
Write-Host "Getting Tenant CRM Admins" -ForegroundColor white
#Get Tenant CRM Admins
$crmrole = Get-AzureADDirectoryRole | Where-Object { $_.DisplayName -match "CRM Service Administrator" } -ErrorAction SilentlyContinue
If ($Null -ne $crmrole)
{
$crmAdmins = Get-AzureADDirectoryRoleMember -ObjectId $crmrole.ObjectId -ErrorAction SilentlyContinue
Foreach ($crmAdmin in $crmAdmins)
{
$MFAS = ((Get-MsolUser -objectid $crmAdmin.ObjectID -ErrorAction SilentlyContinue).StrongAuthenticationRequirements).State
if ($Null -ne $MFAS)
{
$MFASTATUS = "Enabled"
}
else
{
$MFASTATUS = "Disabled"
}
$Name = $crmAdmin.DisplayName
$EmailAddress = $crmAdmin.Mail
if (($crmadmin.assignedlicenses.SkuID) -ne $Null)
{
$Licensed = $True
}
else
{
$Licensed = $False
}
$obj = [PSCustomObject]@{
'Name' = $Name
'MFA Status' = $MFAStatus
'Is Licensed' = $Licensed
'E-Mail Address' = $EmailAddress
}
$CRMAdminTable.add($obj)
}
}
If (($CRMAdminTable).count -eq 0)
{
$CRMAdminTable = [PSCustomObject]@{
'Information' = 'Information: No Users with the CRM Service Administrator role were found, refer to the Global Administrators list.'
}
}
Write-Host "Getting Tenant Power BI Admins" -ForegroundColor white
#Get Tenant Power BI Admins
$birole = Get-AzureADDirectoryRole | Where-Object { $_.DisplayName -match "Power BI Service Administrator" } -ErrorAction SilentlyContinue
If ($null -ne $birole)
{
$biAdmins = Get-AzureADDirectoryRoleMember -ObjectId $birole.ObjectId -ErrorAction SilentlyContinue
Foreach ($biAdmin in $biAdmins)
{
$MFAS = ((Get-MsolUser -objectid $biAdmin.ObjectID -ErrorAction SilentlyContinue).StrongAuthenticationRequirements).State
if ($Null -ne $MFAS)
{
$MFASTATUS = "Enabled"
}
else
{
$MFASTATUS = "Disabled"
}
$Name = $biAdmin.DisplayName
$EmailAddress = $biAdmin.Mail
if (($biadmin.assignedlicenses.SkuID) -ne $Null)
{
$Licensed = $True
}
else
{
$Licensed = $False
}
$obj = [PSCustomObject]@{
'Name' = $Name
'MFA Status' = $MFAStatus
'Is Licensed' = $Licensed
'E-Mail Address' = $EmailAddress
}
$PowerBIAdminTable.add($obj)
}
}
If (($PowerBIAdminTable).count -eq 0)
{
$PowerBIAdminTable = [PSCustomObject]@{
'Information' = 'Information: No Users with the Power BI Administrator role were found, refer to the Global Administrators list.'
}
}
Write-Host "Getting Tenant Service Support Admins" -ForegroundColor white
#Get Tenant Service Support Admins
$servicerole = Get-AzureADDirectoryRole | Where-Object { $_.DisplayName -match "Service Support Administrator" } -ErrorAction SilentlyContinue
If ($Null -ne $servicerole)
{
$serviceAdmins = Get-AzureADDirectoryRoleMember -ObjectId $servicerole.ObjectId -ErrorAction SilentlyContinue
Foreach ($serviceAdmin in $serviceAdmins)
{
$MFAS = ((Get-MsolUser -objectid $serviceAdmin.ObjectID -ErrorAction SilentlyContinue).StrongAuthenticationRequirements).State
if ($Null -ne $MFAS)
{
$MFASTATUS = "Enabled"
}
else
{
$MFASTATUS = "Disabled"
}
$Name = $serviceAdmin.DisplayName
$EmailAddress = $serviceAdmin.Mail
if (($serviceadmin.assignedlicenses.SkuID) -ne $Null)
{
$Licensed = $True
}
else
{
$Licensed = $False
}
$obj = [PSCustomObject]@{
'Name' = $Name
'MFA Status' = $MFAStatus
'Is Licensed' = $Licensed
'E-Mail Address' = $EmailAddress
}
$ServiceAdminTable.add($obj)
}
}
If (($serviceAdminTable).count -eq 0)
{
$serviceAdminTable = [PSCustomObject]@{
'Information' = 'Information: No Users with the Service Support Administrator role were found, refer to the Global Administrators list.'
}
}
Write-Host "Getting Tenant Billing Admins" -ForegroundColor white
#Get Tenant Billing Admins
$billingrole = Get-AzureADDirectoryRole | Where-Object { $_.DisplayName -match "Billing Administrator" } -ErrorAction SilentlyContinue
If ($Null -ne $billingrole)
{
$billingAdmins = Get-AzureADDirectoryRoleMember -ObjectId $billingrole.ObjectId -ErrorAction SilentlyContinue
Foreach ($billingAdmin in $billingAdmins)
{
$MFAS = ((Get-MsolUser -objectid $billingAdmin.ObjectID -ErrorAction SilentlyContinue).StrongAuthenticationRequirements).State
if ($Null -ne $MFAS)
{
$MFASTATUS = "Enabled"
}
else
{
$MFASTATUS = "Disabled"
}
$Name = $billingAdmin.DisplayName
$EmailAddress = $billingAdmin.Mail
if (($billingadmin.assignedlicenses.SkuID) -ne $Null)
{
$Licensed = $True
}
else
{
$Licensed = $False
}
$obj = [PSCustomObject]@{
'Name' = $Name
'MFA Status' = $MFAStatus
'Is Licensed' = $Licensed
'E-Mail Address' = $EmailAddress
}
$BillingAdminTable.add($obj)
}
}
If (($billingAdminTable).count -eq 0)
{
$billingAdminTable = [PSCustomObject]@{
'Information' = 'Information: No Users with the Billing Administrator role were found, refer to the Global Administrators list.'
}
}
Write-Host "Getting Users with Strong Password Disabled..." -ForegroundColor Yellow
#Users with Strong Password Disabled
$LooseUsers = $AllUsers | Where-Object { $_.PasswordPolicies -eq "DisableStrongPassword" }
Foreach ($LooseUser in $LooseUsers)
{
$NameLoose = $LooseUser.DisplayName
$UPNLoose = $LooseUser.UserPrincipalName
$StrongPasswordLoose = "False"
if (($LooseUser.assignedlicenses.SkuID) -ne $Null)
{
$LicensedLoose = $true
}
else
{
$LicensedLoose = $false
}
$obj = [PSCustomObject]@{
'Name' = $NameLoose
'UserPrincipalName' = $UPNLoose
'Is Licensed' = $LicensedLoose
'Strong Password Required' = $StrongPasswordLoose
}
$StrongPasswordTable.add($obj)
}
If (($StrongPasswordTable).count -eq 0)
{
$StrongPasswordTable = [PSCustomObject]@{
'Information' = 'Information: No Users were found with Strong Password Enforcement disabled'
}
}
Write-Host "Getting Tenant Domains..." -ForegroundColor Yellow
#Tenant Domain
$Domains = Get-AzureAdDomain
foreach ($Domain in $Domains)
{
$DomainName = $Domain.Name
$Verified = $Domain.IsVerified
$DefaultStatus = $Domain.IsDefault
$obj = [PSCustomObject]@{
'Domain Name' = $DomainName
'Verification Status' = $Verified
'Default' = $DefaultStatus
}
$DomainTable.add($obj)
}
Write-Host "Getting Groups..." -ForegroundColor Yellow
#Get groups and sort in alphabetical order
$Groups = Get-AzureAdGroup -All $True | Sort-Object DisplayName
$365GroupCount = ($Groups | Where-Object { $_.MailEnabled -eq $true -and $_.DirSyncEnabled -eq $null -and $_.SecurityEnabled -eq $false }).Count
$obj1 = [PSCustomObject]@{
'Name' = 'Office 365 Group'
'Count' = $365GroupCount
}
$GroupTypetable.add($obj1)
Write-Host "Getting Distribution Groups..." -ForegroundColor White
$DistroCount = ($Groups | Where-Object { $_.MailEnabled -eq $true -and $_.SecurityEnabled -eq $false }).Count
$obj1 = [PSCustomObject]@{
'Name' = 'Distribution List'
'Count' = $DistroCount
}
$GroupTypetable.add($obj1)
Write-Host "Getting Security Groups..." -ForegroundColor White
$SecurityCount = ($Groups | Where-Object { $_.MailEnabled -eq $false -and $_.SecurityEnabled -eq $true }).Count
$obj1 = [PSCustomObject]@{
'Name' = 'Security Group'
'Count' = $SecurityCount
}
$GroupTypetable.add($obj1)
Write-Host "Getting Mail-Enabled Security Groups..." -ForegroundColor White
$SecurityMailEnabledCount = ($Groups | Where-Object { $_.MailEnabled -eq $true -and $_.SecurityEnabled -eq $true }).Count
$obj1 = [PSCustomObject]@{
'Name' = 'Mail Enabled Security Group'
'Count' = $SecurityMailEnabledCount
}
$GroupTypetable.add($obj1)
Foreach ($Group in $Groups)
{
$Type = New-Object 'System.Collections.Generic.List[System.Object]'
if ($group.MailEnabled -eq $True -and $group.DirSyncEnabled -eq $null -and $group.SecurityEnabled -eq $False)
{
$Type = "Office 365 Group"
}
if ($group.MailEnabled -eq $True -and $group.SecurityEnabled -eq $False)
{
$Type = "Distribution List"
}
if ($group.MailEnabled -eq $False -and $group.SecurityEnabled -eq $True)
{
$Type = "Security Group"
}
if ($group.MailEnabled -eq $True -and $group.SecurityEnabled -eq $True)
{
$Type = "Mail Enabled Security Group"
}
$Users = (Get-AzureADGroupMember -ObjectId $Group.ObjectID | Sort-Object DisplayName | Select-Object -ExpandProperty DisplayName) -join ", "
$GName = $Group.DisplayName
$hash = New-Object PSObject -property @{ Name = "$GName"; Type = "$Type"; Members = "$Users" }
$GEmail = $Group.Mail
$obj = [PSCustomObject]@{
'Name' = $GName
'Type' = $Type
'Members' = $users
'E-mail Address' = $GEmail
}
$table.add($obj)
}
If (($table).count -eq 0)
{
$table = [PSCustomObject]@{
'Information' = 'Information: No Groups were found in the tenant'
}
}
Write-Host "Getting Licenses..." -ForegroundColor Yellow
#Get all licenses
$Licenses = Get-AzureADSubscribedSku
#Split licenses at colon
Foreach ($License in $Licenses)
{
$TextLic = $null
$ASku = ($License).SkuPartNumber
$TextLic = $Sku.Item("$ASku")
If (!($TextLic))
{
$OLicense = $License.SkuPartNumber
}
Else
{
$OLicense = $TextLic
}
$TotalAmount = $License.PrepaidUnits.enabled
$Assigned = $License.ConsumedUnits
$Unassigned = ($TotalAmount - $Assigned)
If ($TotalAmount -lt $LicenseFilter)
{
$obj = [PSCustomObject]@{
'Name' = $Olicense
'Total Amount' = $TotalAmount
'Assigned Licenses' = $Assigned
'Unassigned Licenses' = $Unassigned
}
$licensetable.add($obj)
}
}
If (($licensetable).count -eq 0)
{
$licensetable = [PSCustomObject]@{
'Information' = 'Information: No Licenses were found in the tenant'
}
}
$IsLicensed = ($AllUsers | Where-Object { $_.assignedlicenses.count -gt 0 }).Count
$objULic = [PSCustomObject]@{
'Name' = 'Users Licensed'
'Count' = $IsLicensed
}
$IsLicensedUsersTable.add($objULic)
$ISNotLicensed = ($AllUsers | Where-Object { $_.assignedlicenses.count -eq 0 }).Count
$objULic = [PSCustomObject]@{
'Name' = 'Users Not Licensed'
'Count' = $IsNotLicensed
}
$IsLicensedUsersTable.add($objULic)
If (($IsLicensedUsersTable).count -eq 0)
{
$IsLicensedUsersTable = [PSCustomObject]@{
'Information' = 'Information: No Licenses were found in the tenant'
}
}
Write-Host "Getting Users..." -ForegroundColor Yellow
Foreach ($User in $AllUsers)
{
$ProxyA = New-Object 'System.Collections.Generic.List[System.Object]'
$NewObject02 = New-Object 'System.Collections.Generic.List[System.Object]'
$NewObject01 = New-Object 'System.Collections.Generic.List[System.Object]'
$UserLicenses = ($user | Select -ExpandProperty AssignedLicenses).SkuID
If (($UserLicenses).count -gt 1)
{
$LastLogon = Get-MailboxStatistics $User.DisplayName | Select-Object -ExpandProperty LastLogonTime
Foreach ($UserLicense in $UserLicenses)
{
$UserLicense = ($licenses | Where-Object { $_.skuid -match $UserLicense }).SkuPartNumber
$TextLic = $Sku.Item("$UserLicense")