# BreakGlassApp.ps1
#
# Script to add a User to the Entra global Admin Role using Microsoft Graph SDK.
# Prerequisites:
# - Microsoft.Graph PowerShell Module installed 
# - App Registration with the following App-Permissions:
#   - RoleManagement.ReadWrite.Directory (Application) with AdminConsent

# Aufruf
# .\BreakGlass.ps1 -TenantId "tenantA" -ClientId "xxx" -ClientSecret "yyy" -UserPrincipalName "admin@domain.de"
# .\BreakGlass.ps1 -TenantId "tenantB" -ClientId "aaa" -CertificateThumbprint "bbbbb" -UserPrincipalName "admin@domain.de"



param(
    [Parameter(Mandatory)]
    [string]$TenantId,

    [Parameter(Mandatory)]
    [string]$AppId,

    [Parameter(Mandatory)]
    [string]$UserPrincipalName,

    [Parameter()]
    [string]$ClientSecret,

    [Parameter()]
    [string]$CertificateThumbprint
)

# --- Konfiguration ---
$GlobalAdminRoleId = "62e90394-69f5-4237-9190-012177145e10"   # Global Administrator

Write-Host "== BreakGlassApp startet ==" -ForegroundColor Cyan

Write-Host "== Authentifizierung vorbereiten =="
if ($ClientSecret -and $CertificateThumbprint) {
    throw "Bitte entweder ClientSecret ODER CertificateThumbprint angeben, nicht beides."
}

if (-not $ClientSecret -and -not $CertificateThumbprint) {
    throw "Es muss entweder ClientSecret oder CertificateThumbprint angegeben werden."
}

Write-Host "== Microsoft Graph SDK laden =="
Import-Module Microsoft.Graph -ErrorAction Stop

Write-Host "== Login =="  -NoNewline

if ($ClientSecret) {
    Write-Host "Authentifiziere mit Client Secret..."
    $SecuredPasswordPassword = ConvertTo-SecureString `
                                -String $ClientSecret  `
                                -AsPlainText  `
                                -Force
    $ClientSecretCredential = New-Object `
                                -TypeName System.Management.Automation.PSCredential  `
                                -ArgumentList $AppId, $SecuredPasswordPassword
    Connect-MgGraph  `
        -TenantId $tenantID `
        -ClientSecretCredential $ClientSecretCredential `
        -NoWelcome
}
else {
    Write-Host "Authentifiziere mit Zertifikat..."
    $cert = Get-Item "Cert:\CurrentUser\My\$CertificateThumbprint"
    Connect-MgGraph `
        -TenantId $TenantId `
        -AppId $ClientId `
        -Certificate $cert `
        -NoWelcome
}


$tokenInfo = Get-MgContext
if (-not ($tokenInfo.Scopes -contains "RoleManagement.ReadWrite.Directory")) {
    Write-Warning "Die App hat NICHT die nötigen App-Permissions! (RoleManagement.ReadWrite.Directory)"
}

Write-Host "Suche Benutzer $UserPrincipalName ..."
$user = Get-MgUser -Filter "userPrincipalName eq '$UserPrincipalName'"
if (-not $user) {
    throw "Benutzer wurde nicht gefunden."
}
Write-Host "Benutzer gefunden: $($user.Id)"

$existing = Get-MgRoleManagementDirectoryRoleAssignment -Filter "principalId eq '$($user.Id)' and roleDefinitionId eq '$GlobalAdminRoleId'"
if ($existing) {
    Write-Host "Benutzer ist bereits Global Administrator." -ForegroundColor Yellow
    return
}

# --- Role Assignment erstellen ---
Write-Host "Füge Benutzer zur Rolle 'Global Administrator' hinzu..." -ForegroundColor Green
$body = @{
    principalId      = $user.Id
    roleDefinitionId = $GlobalAdminRoleId
    directoryScopeId = "/"
}

try {
    New-MgRoleManagementDirectoryRoleAssignment -BodyParameter $body | out-null
    Write-Host "✔ Benutzer wurde erfolgreich zum Global Administrator gemacht!" -ForegroundColor Green
}
catch {
    Write-Host "❌ Fehler beim Erstellen des Role Assignments:" -ForegroundColor Red
    Write-Host $_.Exception.Message
    throw
}