Setup/PermissionDefinitions.ps1

# Permission definitions for Grant-M365AssessConsent
# These data tables define the exact permissions required by Invoke-M365Assessment.

# ==============================================================================
# GRAPH API PERMISSIONS
# Source: $sectionScopeMap from all sections, deduplicated
# ==============================================================================

$script:RequiredGraphPermissions = @(
    # -- Tenant ----------------------------------------------------------------
    @{ Name = 'Organization.Read.All';                   Sections = 'Tenant, Licensing, Hybrid'              ; Reason = 'Tenant org details, verified domains, hybrid config' }
    @{ Name = 'Domain.Read.All';                         Sections = 'Tenant, Identity, Hybrid'               ; Reason = 'All domains registered in the tenant' }
    @{ Name = 'Group.Read.All';                          Sections = 'Tenant, Inventory'                      ; Reason = 'All groups including Microsoft 365 and security groups' }
    # -- Identity --------------------------------------------------------------
    @{ Name = 'User.Read.All';                           Sections = 'Tenant, Identity, Licensing, Inventory' ; Reason = 'User profiles, sign-in activity, license assignments' }
    @{ Name = 'AuditLog.Read.All';                       Sections = 'Identity'                               ; Reason = 'Sign-in logs and directory audit events' }
    @{ Name = 'UserAuthenticationMethod.Read.All';       Sections = 'Identity'                               ; Reason = 'MFA and passwordless authentication methods per user' }
    @{ Name = 'RoleManagement.Read.Directory';           Sections = 'Identity'                               ; Reason = 'Entra directory role assignments and PIM eligibility' }
    @{ Name = 'Policy.Read.All';                         Sections = 'Tenant, Identity'                       ; Reason = 'Conditional Access, auth methods, token lifetime, password policies' }
    @{ Name = 'Application.Read.All';                    Sections = 'Identity'                               ; Reason = 'App registrations, service principals, OAuth permission grants' }
    @{ Name = 'Directory.Read.All';                      Sections = 'Identity'                               ; Reason = 'Devices, admin units, role templates' }
    # -- Intune ----------------------------------------------------------------
    @{ Name = 'DeviceManagementManagedDevices.Read.All'; Sections = 'Intune'                                 ; Reason = 'Managed device inventory and compliance state' }
    @{ Name = 'DeviceManagementConfiguration.Read.All';  Sections = 'Intune, Security'                       ; Reason = 'Configuration profiles, compliance policies, Multi-Admin Approval policies' }
    @{ Name = 'DeviceManagementRBAC.Read.All';           Sections = 'Security'                               ; Reason = 'Intune RBAC role definitions and assignments (scope tag audit)' }
    @{ Name = 'DeviceManagementApps.Read.All';           Sections = 'Security'                               ; Reason = 'Intune audit events including device wipe/retire/delete actions' }
    # -- Security --------------------------------------------------------------
    @{ Name = 'SecurityEvents.Read.All';                 Sections = 'Security'                               ; Reason = 'Secure Score, improvement actions, security alerts' }
    # -- Collaboration ---------------------------------------------------------
    @{ Name = 'SharePointTenantSettings.Read.All';       Sections = 'Collaboration'                          ; Reason = 'SharePoint and OneDrive tenant-level settings' }
    @{ Name = 'TeamSettings.Read.All';                   Sections = 'Collaboration'                          ; Reason = 'Teams tenant-level settings and policies' }
    @{ Name = 'TeamworkAppSettings.Read.All';            Sections = 'Collaboration'                          ; Reason = 'Teams app permission and setup policies' }
    @{ Name = 'OrgSettings-Forms.Read.All';             Sections = 'Collaboration'                          ; Reason = 'Microsoft Forms tenant-level settings' }
    # -- Inventory -------------------------------------------------------------
    @{ Name = 'Team.ReadBasic.All';                      Sections = 'Inventory'                              ; Reason = 'Enumerate all Teams' }
    @{ Name = 'TeamMember.Read.All';                     Sections = 'Inventory'                              ; Reason = 'Teams membership details' }
    @{ Name = 'Channel.ReadBasic.All';                   Sections = 'Inventory'                              ; Reason = 'Teams channels' }
    @{ Name = 'Reports.Read.All';                        Sections = 'Inventory'                              ; Reason = 'Microsoft 365 usage reports' }
    @{ Name = 'Sites.Read.All';                          Sections = 'Inventory'                              ; Reason = 'SharePoint site enumeration and metadata' }
)

# ==============================================================================
# EXCHANGE ONLINE ROLE GROUPS
#
# Cloud-only EXO tenants do NOT have "View-Only Recipients" or
# "View-Only Configuration" -- those only exist in on-premises / hybrid Exchange.
# In Exchange Online, "View-Only Organization Management" covers the equivalent
# read-only access for mailboxes, recipients, transport rules, and connectors.
#
# "Security Reader" is intentionally excluded here -- it is ambiguous (exists in
# both EXO and Entra ID) and causes a "matches multiple entries" error. The
# Entra ID "Security Reader" directory role is assigned in the Compliance step
# below, which is the correct surface for Defender/security policy reads.
# ==============================================================================

$script:RequiredExoRoleGroups = @(
    @{
        RoleGroup = 'View-Only Organization Management'
        Sections  = 'Email, Security, Inventory'
        Reason    = 'Read-only access to mailboxes, recipients, transport rules, connectors, and EOP/Defender policies. Replaces the on-prem-only "View-Only Recipients" and "View-Only Configuration" groups in cloud EXO.'
    }
    @{
        RoleGroup = 'Compliance Management'
        Sections  = 'Security'
        Reason    = 'Read access to compliance-related EXO configuration (journal rules, message tracking, transport compliance rules).'
    }
)

# ==============================================================================
# PURVIEW / COMPLIANCE ENTRA DIRECTORY ROLES
#
# These are Entra ID built-in directory roles, NOT Security & Compliance
# PowerShell role groups. They must be assigned via Graph
# (New-MgDirectoryRoleMemberByRef), not Connect-IPPSSession.
#
# Role template GUIDs are stable across all tenants (built-in roles).
# ==============================================================================

$script:RequiredComplianceRoles = @(
    @{
        DisplayName  = 'Compliance Administrator'
        TemplateId   = '17315797-102d-40b4-93e0-432062caca18'
        Sections     = 'Security'
        Reason       = 'Read access to Purview compliance configuration -- DLP policies, audit, retention, sensitivity labels.'
    }
    @{
        DisplayName  = 'Security Reader'
        TemplateId   = '5d6b6bb7-de71-4623-b4af-96380a352509'
        Sections     = 'Security'
        Reason       = 'Read access to Microsoft Defender and security-related settings, alerts, and policies.'
    }
    @{
        DisplayName  = 'Global Reader'
        TemplateId   = 'f2ef992c-3afb-46b9-b7cf-a126ee74c451'
        Sections     = 'Security, Compliance'
        Reason       = 'Broad read-only access across Microsoft 365 services including Purview, covering gaps not addressed by the above roles.'
    }
)