MSIdentityTools

2.0.47

MSIdentityTools.psm1

#Requires -Version 5.1
#Requires -PSEdition Core,Desktop
#Requires -Module @{'ModuleVersion'='1.9.2';'GUID'='883916f2-9184-46ee-b1f8-b6a2fb784cee';'ModuleName'='Microsoft.Graph.Authentication'}

<#
.SYNOPSIS
    MSIdentityTools
.DESCRIPTION
    Tools for managing, troubleshooting, and reporting on various aspects of Microsoft Identity products and services, primarily Azure AD.
.NOTES
    ModuleVersion: 2.0.47
    GUID: 69790621-e75d-4303-b06e-02704b7ca42f
    Author: Microsoft Identity
    CompanyName: Microsoft Corporation
    Copyright: (c) 2023 Microsoft Corporation. All rights reserved.
.FUNCTIONALITY
    Add-MsIdServicePrincipal, Confirm-MsIdJwtTokenSignature, ConvertFrom-MsIdAadcAadConnectorSpaceDn, ConvertFrom-MsIdAadcSourceAnchor, ConvertFrom-MsIdUniqueTokenIdentifier, ConvertFrom-MsIdJwtToken, ConvertFrom-MsIdSamlMessage, Expand-MsIdJwtTokenPayload, Find-MsIdUnprotectedUsersWithAdminRoles, Get-MsIdProvisioningLogStatistics, Get-MsIdAdfsSamlToken, Get-MsIdAdfsWsFedToken, Get-MsIdAdfsWsTrustToken, Get-MsIdApplicationIdByAppId, Get-MsIdAuthorityUri, Get-MsIdAzureIpRange, Get-MsIdCrossTenantAccessActivity, Get-MsIdGroupWithExpiration, Get-MsIdMsftIdentityAssociation, Get-MsIdO365Endpoints, Get-MsIdOpenIdProviderConfiguration, Get-MsIdSamlFederationMetadata, Get-MsIdServicePrincipalIdByAppId, Get-MsIdUnmanagedExternalUser, Invoke-MsIdAzureAdSamlRequest, New-MsIdWsTrustRequest, New-MsIdClientSecret, New-MsIdSamlRequest, New-MsIdTemporaryUserPassword, Reset-MsIdExternalUser, Resolve-MsIdTenant, Revoke-MsIdServicePrincipalConsent, Set-MsIdWindowsTlsSettings, Resolve-MsIdAzureIpAddress, Show-MsIdJwtToken, Show-MsIdSamlToken, Test-MsIdAzureAdDeviceRegConnectivity, Test-MsIdCBATrustStoreConfiguration, Get-MsIdSigningKeyThumbprint, Update-MsIdApplicationSigningKeyThumbprint, Get-MsIdIsViralUser, Get-MsIdHasMicrosoftAccount, Get-MsIdGroupWritebackConfiguration, Update-MsIdGroupWritebackConfiguration, Get-MsIdUnredeemedInvitedUser, Get-MsIdAdfsSampleApp, Import-MsIdAdfsSampleApp, Import-MsIdAdfsSamplePolicy, Get-MsIdInactiveSignInUser, Set-MsIdServicePrincipalVisibleInMyApps, Split-MsIdEntitlementManagementConnectedOrganization
.LINK
    https://github.com/AzureAD/MSIdentityTools
#>

#region NestedModules Script(s)

#region Compress-Data.ps1

<#
.SYNOPSIS
    Compress data using DEFLATE (RFC 1951) and optionally GZIP file format (RFC 1952).
.DESCRIPTION

.EXAMPLE
    PS C:\>Compress-Data 'A string for compression'
    Compress string using Deflate.
.INPUTS
    System.String
.LINK
    https://github.com/jasoth/Utility.PS
#>
function Compress-Data {
    [CmdletBinding()]
    [Alias('Deflate-Data')]
    [OutputType([byte[]])]
    param (
        # Value to convert
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [object] $InputObjects,
        # Output gzip format
        [Parameter(Mandatory = $false)]
        [switch] $GZip,
        # Level of compression
        [Parameter(Mandatory = $false)]
        [System.IO.Compression.CompressionLevel] $CompressionLevel = ([System.IO.Compression.CompressionLevel]::Optimal),
        # Input encoding to use for text strings
        [Parameter (Mandatory = $false)]
        [ValidateSet('Ascii', 'UTF32', 'UTF7', 'UTF8', 'BigEndianUnicode', 'Unicode')]
        [string] $Encoding = 'Default',
        # Set gzip OS header byte to unknown
        [Parameter(Mandatory = $false)]
        [switch] $GZipUnknownOS
    )

    begin {
        function Compress ([byte[]]$InputBytes, [bool]$GZip) {
            try {
                $streamInput = New-Object System.IO.MemoryStream -ArgumentList @($InputBytes, $false)
                try {
                    $streamOutput = New-Object System.IO.MemoryStream
                    try {
                        if ($GZip) {
                            $streamCompression = New-Object System.IO.Compression.GZipStream -ArgumentList $streamOutput, $CompressionLevel, $true
                        }
                        else {
                            $streamCompression = New-Object System.IO.Compression.DeflateStream -ArgumentList $streamOutput, $CompressionLevel, $true
                        }
                        $streamInput.CopyTo($streamCompression)
                    }
                    finally { $streamCompression.Dispose() }
                    if ($GZip) {
                        [void] $streamOutput.Seek(8, [System.IO.SeekOrigin]::Begin)
                        switch ($CompressionLevel) {
                            'Optimal' { $streamOutput.WriteByte(2) }
                            'Fastest' { $streamOutput.WriteByte(4) }
                            Default { $streamOutput.WriteByte(0) }
                        }
                        if ($GZipUnknownOS) { $streamOutput.WriteByte(255) }
                        elseif ($PSVersionTable.PSEdition -eq 'Desktop' -or $IsWindows) { $streamOutput.WriteByte(11) }
                        elseif ($IsLinux) { $streamOutput.WriteByte(3) }
                        elseif ($IsMacOS) { $streamOutput.WriteByte(7) }
                        else { $streamOutput.WriteByte(255) }
                    }
                    [byte[]] $OutputBytes = $streamOutput.ToArray()
                }
                finally { $streamOutput.Dispose() }
            }
            finally { $streamInput.Dispose() }

            Write-Output $OutputBytes -NoEnumerate
        }

        ## Create list to capture byte stream from piped input.
        [System.Collections.Generic.List[byte]] $listBytes = New-Object System.Collections.Generic.List[byte]
    }

    process {
        if ($InputObjects -is [byte[]]) {
            Write-Output (Compress $InputObjects -GZip:$GZip) -NoEnumerate
        }
        else {
            foreach ($InputObject in $InputObjects) {
                [byte[]] $InputBytes = $null
                if ($InputObject -is [byte]) {
                    ## Populate list with byte stream from piped input.
                    if ($listBytes.Count -eq 0) {
                        Write-Verbose 'Creating byte array from byte stream.'
                        Write-Warning ('For better performance when piping a single byte array, use "Write-Output $byteArray -NoEnumerate | {0}".' -f $MyInvocation.MyCommand)
                    }
                    $listBytes.Add($InputObject)
                }
                elseif ($InputObject -is [byte[]]) {
                    $InputBytes = $InputObject
                }
                elseif ($InputObject -is [string]) {
                    $InputBytes = [Text.Encoding]::$Encoding.GetBytes($InputObject)
                }
                elseif ($InputObject -is [bool] -or $InputObject -is [char] -or $InputObject -is [single] -or $InputObject -is [double] -or $InputObject -is [int16] -or $InputObject -is [int32] -or $InputObject -is [int64] -or $InputObject -is [uint16] -or $InputObject -is [uint32] -or $InputObject -is [uint64]) {
                    $InputBytes = [System.BitConverter]::GetBytes($InputObject)
                }
                elseif ($InputObject -is [guid]) {
                    $InputBytes = $InputObject.ToByteArray()
                }
                elseif ($InputObject -is [System.IO.FileSystemInfo]) {
                    if ($PSVersionTable.PSVersion -ge [version]'6.0') {
                        $InputBytes = Get-Content $InputObject.FullName -Raw -AsByteStream
                    }
                    else {
                        $InputBytes = Get-Content $InputObject.FullName -Raw -Encoding Byte
                    }
                }
                else {
                    ## Non-Terminating Error
                    $Exception = New-Object ArgumentException -ArgumentList ('Cannot compress input of type {0}.' -f $InputObject.GetType())
                    Write-Error -Exception $Exception -Category ([System.Management.Automation.ErrorCategory]::ParserError) -CategoryActivity $MyInvocation.MyCommand -ErrorId 'CompressDataFailureTypeNotSupported' -TargetObject $InputObject
                }

                if ($null -ne $InputBytes -and $InputBytes.Count -gt 0) {
                    Write-Output (Compress $InputBytes -GZip:$GZip) -NoEnumerate
                }
            }
        }
    }

    end {
        ## Output captured byte stream from piped input.
        if ($listBytes.Count -gt 0) {
            Write-Output (Compress $listBytes.ToArray() -GZip:$GZip) -NoEnumerate
        }
    }
}

#endregion

#region Confirm-JsonWebSignature.ps1

<#
.SYNOPSIS
    Validate the digital signature for JSON Web Signature.
.EXAMPLE
    PS C:\>Confirm-JsonWebSignature $Base64JwsString -SigningCertificate $SigningCertificate
    Validate the JWS string was signed by provided certificate.
.INPUTS
    System.String
#>
function Confirm-JsonWebSignature {
    [CmdletBinding()]
    [Alias('Confirm-Jws')]
    [OutputType([bool])]
    param (
        # JSON Web Signature (JWS)
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [string[]] $InputObjects,
        # Certificate used to sign the data
        [Parameter(Mandatory = $true)]
        [System.Security.Cryptography.X509Certificates.X509Certificate2] $SigningCertificate
    )

    process {
        foreach ($InputObject in $InputObjects) {
            $Jws = ConvertFrom-JsonWebSignature $InputObject
            $JwsData = $InputObject.Substring(0, $InputObject.LastIndexOf('.'))
            [Security.Cryptography.HashAlgorithmName] $HashAlgorithm = [Security.Cryptography.HashAlgorithmName]::"SHA$($Jws.Header.alg.Substring(2,3))"
            switch ($Jws.Header.alg.Substring(0, 2)) {
                'RS' {
                    $RSAKey = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPublicKey($SigningCertificate)
                    [bool] $Result = $RSAKey.VerifyData([System.Text.Encoding]::UTF8.GetBytes($JwsData), $Jws.Signature, $HashAlgorithm, [Security.Cryptography.RSASignaturePadding]::Pkcs1)
                }
                'PS' {
                    $RSAKey = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPublicKey($SigningCertificate)
                    [bool] $Result = $RSAKey.VerifyData([System.Text.Encoding]::UTF8.GetBytes($JwsData), $Jws.Signature, $HashAlgorithm, [Security.Cryptography.RSASignaturePadding]::Pss)
                }
                'ES' {
                    $ECDsaKey = [System.Security.Cryptography.X509Certificates.ECDsaCertificateExtensions]::GetECDsaPublicKey($SigningCertificate)
                    [bool] $Result = $ECDsaKey.VerifyData([System.Text.Encoding]::UTF8.GetBytes($JwsData), $Jws.Signature, $HashAlgorithm)
                }
            }
            Write-Output $Result
        }
    }
}

#endregion

#region ConvertFrom-Base64String.ps1

<#
.SYNOPSIS
    Convert Base64 String to Byte Array or Plain Text String.
.DESCRIPTION

.EXAMPLE
    PS C:\>ConvertFrom-Base64String "QSBzdHJpbmcgd2l0aCBiYXNlNjQgZW5jb2Rpbmc="
    Convert Base64 String to String with Default Encoding.
.EXAMPLE
    PS C:\>"QVNDSUkgc3RyaW5nIHdpdGggYmFzZTY0dXJsIGVuY29kaW5n" | ConvertFrom-Base64String -Base64Url -Encoding Ascii
    Convert Base64Url String to String with Ascii Encoding.
.EXAMPLE
    PS C:\>[guid](ConvertFrom-Base64String "5oIhNbCaFUGAe8NsiAKfpA==" -RawBytes)
    Convert Base64 String to GUID.
.INPUTS
    System.String
.LINK
    https://github.com/jasoth/Utility.PS
#>
function ConvertFrom-Base64String {
    [CmdletBinding()]
    [OutputType([byte[]], [string])]
    param (
        # Value to convert
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [string[]] $InputObjects,
        # Use base64url variant
        [Parameter (Mandatory = $false)]
        [switch] $Base64Url,
        # Output raw byte array
        [Parameter (Mandatory = $false)]
        [switch] $RawBytes,
        # Encoding to use for text strings
        [Parameter (Mandatory = $false)]
        [ValidateSet('Ascii', 'UTF32', 'UTF7', 'UTF8', 'BigEndianUnicode', 'Unicode')]
        [string] $Encoding = 'Default'
    )

    process {
        foreach ($InputObject in $InputObjects) {
            [string] $strBase64 = $InputObject
            if (!$PSBoundParameters.ContainsValue('Base64Url') -and ($strBase64.Contains('-') -or $strBase64.Contains('_'))) { $Base64Url = $true }
            if ($Base64Url) { $strBase64 = $strBase64.Replace('-', '+').Replace('_', '/').PadRight($strBase64.Length + (4 - $strBase64.Length % 4) % 4, '=') }
            [byte[]] $outBytes = [System.Convert]::FromBase64String($strBase64)
            if ($RawBytes) {
                Write-Output $outBytes -NoEnumerate
            }
            else {
                [string] $outString = ([Text.Encoding]::$Encoding.GetString($outBytes))
                Write-Output $outString
            }
        }
    }
}

#endregion

#region ConvertFrom-HexString.ps1

<#
.SYNOPSIS
   Convert from Hex String
.DESCRIPTION

.EXAMPLE
    PS C:\>ConvertFrom-HexString "57 68 61 74 20 69 73 20 61 20 68 65 78 20 73 74 72 69 6E 67 3F"
    Convert hex byte string seperated by spaces to string.
.EXAMPLE
    PS C:\>"415343494920737472696E6720746F2068657820737472696E67" | ConvertFrom-HexString -Delimiter "" -Encoding Ascii
    Convert hex byte string with no seperation to ASCII string.
.INPUTS
    System.String
.LINK
    https://github.com/jasoth/Utility.PS
#>
function ConvertFrom-HexString {
    [CmdletBinding()]
    param (
        # Value to convert
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [string[]] $InputObject,
        # Delimiter between Hex pairs
        [Parameter (Mandatory = $false)]
        [string] $Delimiter = ' ',
        # Output raw byte array
        [Parameter (Mandatory = $false)]
        [switch] $RawBytes,
        # Encoding to use for text strings
        [Parameter (Mandatory = $false)]
        [ValidateSet('Ascii', 'UTF32', 'UTF7', 'UTF8', 'BigEndianUnicode', 'Unicode')]
        [string] $Encoding = 'Default'
    )

    process {
        $listBytes = New-Object object[] $InputObject.Count
        for ($iString = 0; $iString -lt $InputObject.Count; $iString++) {
            [string] $strHex = $InputObject[$iString]
            if ($strHex.Substring(2, 1) -eq $Delimiter) {
                [string[]] $listHex = $strHex -split $Delimiter
            }
            else {
                [string[]] $listHex = New-Object string[] ($strHex.Length / 2)
                for ($iByte = 0; $iByte -lt $strHex.Length; $iByte += 2) {
                    $listHex[[System.Math]::Truncate($iByte / 2)] = $strHex.Substring($iByte, 2)
                }
            }

            [byte[]] $outBytes = New-Object byte[] $listHex.Count
            for ($iByte = 0; $iByte -lt $listHex.Count; $iByte++) {
                $outBytes[$iByte] = [byte]::Parse($listHex[$iByte], [System.Globalization.NumberStyles]::HexNumber)
            }

            if ($RawBytes) { $listBytes[$iString] = $outBytes }
            else {
                $outString = ([Text.Encoding]::$Encoding.GetString($outBytes))
                Write-Output $outString
            }
        }
        if ($RawBytes) {
            return $listBytes
        }
    }
}

#endregion

#region ConvertFrom-JsonWebSignature.ps1

<#
.SYNOPSIS
   Convert Json Web Signature (JWS) structure to PowerShell object.
.EXAMPLE
    PS C:\>$MsalToken.IdToken | ConvertFrom-JsonWebSignature
    Convert OAuth IdToken JWS to PowerShell object.
.INPUTS
    System.String
#>
function ConvertFrom-JsonWebSignature {
    [CmdletBinding()]
    [Alias('ConvertFrom-Jws')]
    [Alias('ConvertFrom-JsonWebToken')]
    [Alias('ConvertFrom-Jwt')]
    [OutputType([PSCustomObject])]
    param (
        # JSON Web Signature (JWS)
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [string[]] $InputObjects,
        # Content Type of the Payload
        [Parameter(Mandatory = $false)]
        [ValidateSet('text/plain', 'application/json', 'application/octet-stream')]
        [string] $ContentType = 'application/json'
    )

    process {
        foreach ($InputObject in $InputObjects) {
            [string[]] $JwsComponents = $InputObject.Split('.')
            switch ($ContentType) {
                'application/octet-stream' { [byte[]] $JwsPayload = $JwsComponents[1] | ConvertFrom-Base64String -Base64Url -RawBytes }
                'text/plain' { [string] $JwsPayload = $JwsComponents[1] | ConvertFrom-Base64String -Base64Url }
                'application/json' { [PSCustomObject] $JwsPayload = $JwsComponents[1] | ConvertFrom-Base64String -Base64Url | ConvertFrom-Json }
                Default { [string] $JwsPayload = $JwsComponents[1] | ConvertFrom-Base64String -Base64Url }
            }
            [PSCustomObject] $JwsDecoded = New-Object PSCustomObject -Property @{
                Header    = $JwsComponents[0] | ConvertFrom-Base64String -Base64Url | ConvertFrom-Json
                Payload   = $JwsPayload
                Signature = $JwsComponents[2] | ConvertFrom-Base64String -Base64Url -RawBytes
            }
            Write-Output ($JwsDecoded | Select-Object -Property Header, Payload, Signature)
        }
    }
}

#endregion

#region ConvertFrom-QueryString.ps1

<#
.SYNOPSIS
    Convert Query String to object.
.DESCRIPTION

.EXAMPLE
    PS C:\>ConvertFrom-QueryString '?name=path/file.json&index=10'
    Convert query string to object.
.EXAMPLE
    PS C:\>'name=path/file.json&index=10' | ConvertFrom-QueryString -AsHashtable
    Convert query string to hashtable.
.INPUTS
    System.String
.LINK
    https://github.com/jasoth/Utility.PS
#>
function ConvertFrom-QueryString {
    [CmdletBinding()]
    [OutputType([psobject])]
    [OutputType([hashtable])]
    param (
        # Value to convert
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [AllowEmptyString()]
        [string[]] $InputStrings,
        # URL decode parameter names
        [Parameter(Mandatory = $false)]
        [switch] $DecodeParameterNames,
        # Converts to hash table object
        [Parameter(Mandatory = $false)]
        [switch] $AsHashtable
    )

    process {
        foreach ($InputString in $InputStrings) {
            if ($AsHashtable) { [hashtable] $OutputObject = @{ } }
            else { [psobject] $OutputObject = New-Object psobject }

            if ($InputString) {
                if ($InputString[0] -eq '?') { $InputString = $InputString.Substring(1) }
                [string[]] $QueryParameters = $InputString.Split('&')
                foreach ($QueryParameter in $QueryParameters) {
                    [string[]] $QueryParameterPair = $QueryParameter.Split('=')
                    if ($DecodeParameterNames) { $QueryParameterPair[0] = [System.Net.WebUtility]::UrlDecode($QueryParameterPair[0]) }
                    if ($OutputObject -is [hashtable]) {
                        $OutputObject.Add($QueryParameterPair[0], [System.Net.WebUtility]::UrlDecode($QueryParameterPair[1]))
                    }
                    else {
                        $OutputObject | Add-Member $QueryParameterPair[0] -MemberType NoteProperty -Value ([System.Net.WebUtility]::UrlDecode($QueryParameterPair[1]))
                    }
                }
            }
            Write-Output $OutputObject
        }
    }

}

#endregion

#region ConvertFrom-SamlMessage.ps1

<#
.SYNOPSIS
   Convert Saml Message to XML object.
.EXAMPLE
    PS C:\>ConvertFrom-SamlMessage 'Base64String'
    Convert Saml Message to XML object.
.INPUTS
    System.String
.OUTPUTS
    SamlMessage : System.Xml.XmlDocument
#>
function ConvertFrom-SamlMessage {
    [CmdletBinding()]
    [Alias('ConvertFrom-SamlRequest')]
    [Alias('ConvertFrom-SamlResponse')]
    #[OutputType([xml])]
    param (
        # SAML Message
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [string[]] $InputObject
    )

    process {
        foreach ($_InputObject in $InputObject) {
            [byte[]] $bytesInput = $null
            $xmlOutput = New-Object SamlMessage
            try {
                $xmlOutput.LoadXml($_InputObject)
            }
            catch {
                try {
                    $bytesInput = [System.Convert]::FromBase64String($_InputObject)
                }
                catch {
                    $bytesInput = [System.Convert]::FromBase64String([System.Net.WebUtility]::UrlDecode($_InputObject))
                }
            }
            if ($bytesInput) {
                try {
                    $streamInput = New-Object System.IO.MemoryStream -ArgumentList @($bytesInput, $false)
                    try {
                        $xmlOutput.Load($streamInput)
                    }
                    catch {
                        $streamInput = New-Object System.IO.MemoryStream -ArgumentList @($bytesInput, $false)
                        try {
                            $streamOutput = New-Object System.IO.MemoryStream
                            try {
                                [System.IO.Compression.DeflateStream] $streamCompression = New-Object System.IO.Compression.DeflateStream -ArgumentList $streamInput, ([System.IO.Compression.CompressionMode]::Decompress), $true
                                $streamCompression.CopyTo($streamOutput)
                            }
                            finally { $streamCompression.Dispose() }
                            $streamOutput.Position = 0
                            $xmlOutput.Load($streamOutput)
                            #[string] $strOutput = ([Text.Encoding]::$Encoding.GetString($streamOutput.ToArray()))
                            #$xmlOutput.LoadXml($strOutput)
                        }
                        finally { $streamOutput.Dispose() }
                    }
                }
                finally { $streamInput.Dispose() }
            }

            Write-Output $xmlOutput
        }
    }
}

#endregion

#region ConvertFrom-SecureStringAsPlainText.ps1

<#
.SYNOPSIS
    Convert/Decrypt SecureString to Plain Text String.
.DESCRIPTION

.EXAMPLE
    PS C:\>ConvertFrom-SecureStringAsPlainText (ConvertTo-SecureString 'SuperSecretString' -AsPlainText -Force) -Force
    Convert plain text to SecureString and then convert it back.
.INPUTS
    System.Security.SecureString
.LINK
    https://github.com/jasoth/Utility.PS
#>
function ConvertFrom-SecureStringAsPlainText {
    [CmdletBinding()]
    [OutputType([string])]
    param (
        # Secure String Value
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [securestring] $SecureString,
        # Confirms that you understand the implications of using the AsPlainText parameter and still want to use it.
        [Parameter(Mandatory = $false)]
        [switch] $Force
    )

    begin {
        if ($PSVersionTable.PSVersion -ge [version]'7.0') {
            Write-Warning 'PowerShell 7 introduced an AsPlainText parameter to the ConvertFrom-SecureString cmdlet.'
        }
        if (!${Force}) {
            ## Terminating Error
            $Exception = New-Object ArgumentException -ArgumentList 'The system cannot protect plain text output. To suppress this warning and convert a SecureString to plain text, reissue the command specifying the Force parameter.'
            Write-Error -Exception $Exception -Category ([System.Management.Automation.ErrorCategory]::InvalidArgument) -CategoryActivity $MyInvocation.MyCommand -ErrorId 'ConvertSecureStringFailureForceRequired' -TargetObject ${SecureString} -ErrorAction Stop
        }
    }

    process {
        try {
            [IntPtr] $BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecureString)
            Write-Output ([System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($BSTR))
        }
        finally {
            [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($BSTR)
        }
    }
}

#endregion

#region ConvertTo-Base64String.ps1

<#
.SYNOPSIS
    Convert Byte Array or Plain Text String to Base64 String.
.DESCRIPTION

.EXAMPLE
    PS C:\>ConvertTo-Base64String "A string with base64 encoding"
    Convert String with Default Encoding to Base64 String.
.EXAMPLE
    PS C:\>"ASCII string with base64url encoding" | ConvertTo-Base64String -Base64Url -Encoding Ascii
    Convert String with Ascii Encoding to Base64Url String.
.EXAMPLE
    PS C:\>ConvertTo-Base64String ([guid]::NewGuid())
    Convert GUID to Base64 String.
.INPUTS
    System.Object
.LINK
    https://github.com/jasoth/Utility.PS
#>
function ConvertTo-Base64String {
    [CmdletBinding()]
    [OutputType([string])]
    param (
        # Value to convert
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [object] $InputObjects,
        # Use base64url variant
        [Parameter (Mandatory = $false)]
        [switch] $Base64Url,
        # Output encoding to use for text strings
        [Parameter (Mandatory = $false)]
        [ValidateSet('Ascii', 'UTF32', 'UTF7', 'UTF8', 'BigEndianUnicode', 'Unicode')]
        [string] $Encoding = 'Default'
    )

    begin {
        function Transform ([byte[]]$InputBytes) {
            [string] $outBase64String = [System.Convert]::ToBase64String($InputBytes)
            if ($Base64Url) { $outBase64String = $outBase64String.Replace('+', '-').Replace('/', '_').Replace('=', '') }
            return $outBase64String
        }

        ## Create list to capture byte stream from piped input.
        [System.Collections.Generic.List[byte]] $listBytes = New-Object System.Collections.Generic.List[byte]
    }

    process {
        if ($InputObjects -is [byte[]]) {
            Write-Output (Transform $InputObjects)
        }
        else {
            foreach ($InputObject in $InputObjects) {
                [byte[]] $InputBytes = $null
                if ($InputObject -is [byte]) {
                    ## Populate list with byte stream from piped input.
                    if ($listBytes.Count -eq 0) {
                        Write-Verbose 'Creating byte array from byte stream.'
                        Write-Warning ('For better performance when piping a single byte array, use "Write-Output $byteArray -NoEnumerate | {0}".' -f $MyInvocation.MyCommand)
                    }
                    $listBytes.Add($InputObject)
                }
                elseif ($InputObject -is [byte[]]) {
                    $InputBytes = $InputObject
                }
                elseif ($InputObject -is [string]) {
                    $InputBytes = [Text.Encoding]::$Encoding.GetBytes($InputObject)
                }
                elseif ($InputObject -is [bool] -or $InputObject -is [char] -or $InputObject -is [single] -or $InputObject -is [double] -or $InputObject -is [int16] -or $InputObject -is [int32] -or $InputObject -is [int64] -or $InputObject -is [uint16] -or $InputObject -is [uint32] -or $InputObject -is [uint64]) {
                    $InputBytes = [System.BitConverter]::GetBytes($InputObject)
                }
                elseif ($InputObject -is [guid]) {
                    $InputBytes = $InputObject.ToByteArray()
                }
                elseif ($InputObject -is [System.IO.FileSystemInfo]) {
                    if ($PSVersionTable.PSVersion -ge [version]'6.0') {
                        $InputBytes = Get-Content $InputObject.FullName -Raw -AsByteStream
                    }
                    else {
                        $InputBytes = Get-Content $InputObject.FullName -Raw -Encoding Byte
                    }
                }
                else {
                    ## Non-Terminating Error
                    $Exception = New-Object ArgumentException -ArgumentList ('Cannot convert input of type {0} to Base64 string.' -f $InputObject.GetType())
                    Write-Error -Exception $Exception -Category ([System.Management.Automation.ErrorCategory]::ParserError) -CategoryActivity $MyInvocation.MyCommand -ErrorId 'ConvertBase64StringFailureTypeNotSupported' -TargetObject $InputObject
                }

                if ($null -ne $InputBytes -and $InputBytes.Count -gt 0) {
                    Write-Output (Transform $InputBytes)
                }
            }
        }
    }

    end {
        ## Output captured byte stream from piped input.
        if ($listBytes.Count -gt 0) {
            Write-Output (Transform $listBytes.ToArray())
        }
    }
}

#endregion

#region ConvertTo-HexString.ps1

<#
.SYNOPSIS
   Convert to Hex String
.DESCRIPTION

.EXAMPLE
    PS C:\>ConvertTo-HexString "What is a hex string?"
    Convert string to hex byte string seperated by spaces.
.EXAMPLE
    PS C:\>"ASCII string to hex string" | ConvertTo-HexString -Delimiter "" -Encoding Ascii
    Convert ASCII string to hex byte string with no seperation.
.INPUTS
    System.Object
.LINK
    https://github.com/jasoth/Utility.PS
#>
function ConvertTo-HexString {
    [CmdletBinding()]
    param (
        # Value to convert
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [object] $InputObjects,
        # Delimiter between Hex pairs
        [Parameter (Mandatory = $false)]
        [string] $Delimiter = ' ',
        # Encoding to use for text strings
        [Parameter (Mandatory = $false)]
        [ValidateSet('Ascii', 'UTF32', 'UTF7', 'UTF8', 'BigEndianUnicode', 'Unicode')]
        [string] $Encoding = 'Default'
    )

    begin {
        function Transform ([byte[]]$InputBytes) {
            [string[]] $outHexString = New-Object string[] $InputBytes.Count
            for ($iByte = 0; $iByte -lt $InputBytes.Count; $iByte++) {
                $outHexString[$iByte] = $InputBytes[$iByte].ToString('X2')
            }
            return $outHexString -join $Delimiter
        }

        ## Create list to capture byte stream from piped input.
        [System.Collections.Generic.List[byte]] $listBytes = New-Object System.Collections.Generic.List[byte]
    }

    process {
        if ($InputObjects -is [byte[]]) {
            Write-Output (Transform $InputObjects)
        }
        else {
            foreach ($InputObject in $InputObjects) {
                [byte[]] $InputBytes = $null
                if ($InputObject -is [byte]) {
                    ## Populate list with byte stream from piped input.
                    if ($listBytes.Count -eq 0) {
                        Write-Verbose 'Creating byte array from byte stream.'
                        Write-Warning ('For better performance when piping a single byte array, use "Write-Output $byteArray -NoEnumerate | {0}".' -f $MyInvocation.MyCommand)
                    }
                    $listBytes.Add($InputObject)
                }
                elseif ($InputObject -is [byte[]]) {
                    $InputBytes = $InputObject
                }
                elseif ($InputObject -is [string]) {
                    $InputBytes = [Text.Encoding]::$Encoding.GetBytes($InputObject)
                }
                elseif ($InputObject -is [bool] -or $InputObject -is [char] -or $InputObject -is [single] -or $InputObject -is [double] -or $InputObject -is [int16] -or $InputObject -is [int32] -or $InputObject -is [int64] -or $InputObject -is [uint16] -or $InputObject -is [uint32] -or $InputObject -is [uint64]) {
                    $InputBytes = [System.BitConverter]::GetBytes($InputObject)
                }
                elseif ($InputObject -is [guid]) {
                    $InputBytes = $InputObject.ToByteArray()
                }
                elseif ($InputObject -is [System.IO.FileSystemInfo]) {
                    if ($PSVersionTable.PSVersion -ge [version]'6.0') {
                        $InputBytes = Get-Content $InputObject.FullName -Raw -AsByteStream
                    }
                    else {
                        $InputBytes = Get-Content $InputObject.FullName -Raw -Encoding Byte
                    }
                }
                else {
                    ## Non-Terminating Error
                    $Exception = New-Object ArgumentException -ArgumentList ('Cannot convert input of type {0} to Hex string.' -f $InputObject.GetType())
                    Write-Error -Exception $Exception -Category ([System.Management.Automation.ErrorCategory]::ParserError) -CategoryActivity $MyInvocation.MyCommand -ErrorId 'ConvertHexFailureTypeNotSupported' -TargetObject $InputObject
                }

                if ($null -ne $InputBytes -and $InputBytes.Count -gt 0) {
                    Write-Output (Transform $InputBytes)
                }
            }
        }
    }

    end {
        ## Output captured byte stream from piped input.
        if ($listBytes.Count -gt 0) {
            Write-Output (Transform $listBytes.ToArray())
        }
    }
}

#endregion

#region ConvertTo-PsParameterString.ps1

<#
.SYNOPSIS
    Convert splatable PowerShell paramters to PowerShell parameter string syntax.
.EXAMPLE
    PS C:\>ConvertTo-PsParameterString @{ key1='value1'; key2='value2' }
    Convert hashtable to PowerShell parameters string.
.INPUTS
    System.String
.LINK
    https://github.com/jasoth/Utility.PS
#>
function ConvertTo-PsParameterString {
    [CmdletBinding()]
    [OutputType([string])]
    param (
        #
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 0)]
        [AllowNull()]
        [object] $InputObjects,
        #
        [Parameter(Mandatory = $false)]
        [switch] $Compact,
        #
        [Parameter(Mandatory = $false, Position = 1)]
        [type[]] $RemoveTypes = ([string], [bool], [int], [long]),
        #
        [Parameter(Mandatory = $false)]
        [switch] $NoEnumerate
    )

    begin {
        function GetPsParameterString ($InputObject) {
            $OutputString = New-Object System.Text.StringBuilder

            ## Add Value
            switch ($InputObject.GetType()) {
                { $_.Equals([Hashtable]) -or $_.Equals([System.Collections.Specialized.OrderedDictionary]) -or $_.FullName.StartsWith('System.Collections.Generic.Dictionary') -or ($_.BaseType -and $_.BaseType.FullName.StartsWith('System.Collections.Generic.Dictionary')) } {
                    foreach ($Parameter in $InputObject.GetEnumerator()) {
                        [string] $ParameterValue = (ConvertTo-PsString $Parameter.Value -Compact:$Compact -NoEnumerate)
                        if ($ParameterValue.StartsWith('[')) { $ParameterValue = '({0})' -f $ParameterValue }
                        [void]$OutputString.AppendFormat(' -{0} {1}', $Parameter.Key, $ParameterValue)
                    }
                    break
                }
                { $_.BaseType.Equals([Array]) -or $_.Equals([System.Collections.ArrayList]) -or $_.FullName.StartsWith('System.Collections.Generic.List') } {
                    foreach ($Parameter in $InputObject) {
                        [string] $ParameterValue = (ConvertTo-PsString $Parameter -Compact:$Compact -NoEnumerate)
                        if ($ParameterValue.StartsWith('[')) { $ParameterValue = '({0})' -f $ParameterValue }
                        [void]$OutputString.AppendFormat(' {0}', $ParameterValue)
                    }
                    break
                }
                Default {
                    $Exception = New-Object ArgumentException -ArgumentList ('Cannot convert input of type {0} to PowerShell parameter string. Use -NoEnumerate if providing a single splatable array.' -f $InputObject.GetType())
                    Write-Error -Exception $Exception -Category ([System.Management.Automation.ErrorCategory]::ParserError) -CategoryActivity $MyInvocation.MyCommand -ErrorId 'ConvertPowerShellParameterStringFailureTypeNotSupported' -TargetObject $InputObject -ErrorAction Stop
                }
            }

            if ($NoEnumerate) {
                $listOutputString.Add($OutputString.ToString())
            }
            else {
                Write-Output $OutputString.ToString()
            }
        }

        if ($NoEnumerate) {
            $listOutputString = New-Object System.Collections.Generic.List[string]
        }
    }

    process {
        if ($PSCmdlet.MyInvocation.ExpectingInput -or $NoEnumerate) {
            GetPsParameterString $InputObjects
        }
        else {
            foreach ($InputObject in $InputObjects) {
                GetPsParameterString $InputObject
            }
        }
    }

    end {
        if ($NoEnumerate) {
            $OutputArray = New-Object System.Text.StringBuilder
            if ($PSVersionTable.PSVersion -ge [version]'6.0') {
                [void]$OutputArray.AppendJoin('', $listOutputString)
            }
            else {
                [void]$OutputArray.Append(($listOutputString -join ''))
            }
            Write-Output $OutputArray.ToString()
        }
    }
}

#endregion

#region ConvertTo-PsString.ps1

<#
.SYNOPSIS
    Convert PowerShell data types to PowerShell string syntax.
.DESCRIPTION

.EXAMPLE
    PS C:\>ConvertTo-PsString @{ key1='value1'; key2='value2' }
    Convert hashtable to PowerShell string.
.INPUTS
    System.String
.LINK
    https://github.com/jasoth/Utility.PS
#>
function ConvertTo-PsString {
    [CmdletBinding()]
    [OutputType([string])]
    param (
        #
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 0)]
        [AllowNull()]
        [object] $InputObjects,
        #
        [Parameter(Mandatory = $false)]
        [switch] $Compact,
        #
        [Parameter(Mandatory = $false, Position = 1)]
        [type[]] $RemoveTypes = ([string], [bool], [int], [long]),
        #
        [Parameter(Mandatory = $false)]
        [switch] $NoEnumerate
    )

    begin {
        if ($Compact) {
            [System.Collections.Generic.Dictionary[string, type]] $TypeAccelerators = [psobject].Assembly.GetType('System.Management.Automation.TypeAccelerators')::get
            [System.Collections.Generic.Dictionary[type, string]] $TypeAcceleratorsLookup = New-Object 'System.Collections.Generic.Dictionary[type,string]'
            foreach ($TypeAcceleratorKey in $TypeAccelerators.Keys) {
                if (!$TypeAcceleratorsLookup.ContainsKey($TypeAccelerators[$TypeAcceleratorKey])) {
                    $TypeAcceleratorsLookup.Add($TypeAccelerators[$TypeAcceleratorKey], $TypeAcceleratorKey)
                }
            }
        }

        function Resolve-Type {
            param (
                #
                [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 0)]
                [type] $ObjectType,
                #
                [Parameter(Mandatory = $false, Position = 1)]
                [switch] $Compact,
                #
                [Parameter(Mandatory = $false, Position = 1)]
                [type[]] $RemoveTypes
            )

            [string] $OutputString = ''
            if ($ObjectType.IsGenericType -or ($ObjectType.BaseType -and $ObjectType.BaseType.IsGenericType)) {
                if (!$ObjectType.IsGenericType) { $ObjectType = $ObjectType.BaseType }
                if ($ObjectType.FullName.StartsWith('System.Collections.Generic.Dictionary')) {
                    #$OutputString += '[hashtable]'
                    if ($Compact) {
                        $OutputString += '(Invoke-Command { $D = New-Object ''Collections.Generic.Dictionary['
                    }
                    else {
                        $OutputString += '(Invoke-Command { $D = New-Object ''System.Collections.Generic.Dictionary['
                    }
                    $iInput = 0
                    foreach ($GenericTypeArgument in $ObjectType.GenericTypeArguments) {
                        if ($iInput -gt 0) { $OutputString += ',' }
                        $OutputString += Resolve-Type $GenericTypeArgument -Compact:$Compact -RemoveTypes @()
                        $iInput++
                    }
                    $OutputString += ']'''
                }
                elseif ($InputObject.GetType().FullName -match '^(System.(Collections.Generic.[a-zA-Z]+))`[0-9]\[(?:\[(.+?), .+?, Version=.+?, Culture=.+?, PublicKeyToken=.+?\],?)+?\]$') {
                    if ($Compact) {
                        $OutputString += '[{0}[' -f $Matches[2]
                    }
                    else {
                        $OutputString += '[{0}[' -f $Matches[1]
                    }
                    $iInput = 0
                    foreach ($GenericTypeArgument in $ObjectType.GenericTypeArguments) {
                        if ($iInput -gt 0) { $OutputString += ',' }
                        $OutputString += Resolve-Type $GenericTypeArgument -Compact:$Compact -RemoveTypes @()
                        $iInput++
                    }
                    $OutputString += ']]'
                }
            }
            elseif ($ObjectType -eq [System.Collections.Specialized.OrderedDictionary]) {
                $OutputString += '[ordered]'  # Explicit cast does not work with full name. Only [ordered] works.
            }
            elseif ($Compact) {
                if ($ObjectType -notin $RemoveTypes) {
                    if ($TypeAcceleratorsLookup.ContainsKey($ObjectType)) {
                        $OutputString += '[{0}]' -f $TypeAcceleratorsLookup[$ObjectType]
                    }
                    elseif ($ObjectType.FullName.StartsWith('System.')) {
                        $OutputString += '[{0}]' -f $ObjectType.FullName.Substring(7)
                    }
                    else {
                        $OutputString += '[{0}]' -f $ObjectType.FullName
                    }
                }
            }
            else {
                $OutputString += '[{0}]' -f $ObjectType.FullName
            }
            return $OutputString
        }

        function GetPSString ($InputObject) {
            $OutputString = New-Object System.Text.StringBuilder

            if ($null -eq $InputObject) { [void]$OutputString.Append('$null') }
            else {
                ## Add Casting
                [void]$OutputString.Append((Resolve-Type $InputObject.GetType() -Compact:$Compact -RemoveTypes $RemoveTypes))

                ## Add Value
                switch ($InputObject.GetType()) {
                    { $_.Equals([String]) } {
                        [void]$OutputString.AppendFormat("'{0}'", $InputObject.Replace("'", "''")) #.Replace('"','`"')
                        break
                    }
                    { $_.Equals([Char]) } {
                        [void]$OutputString.AppendFormat("'{0}'", ([string]$InputObject).Replace("'", "''"))
                        break
                    }
                    { $_.Equals([Boolean]) -or $_.Equals([switch]) } {
                        [void]$OutputString.AppendFormat('${0}', $InputObject)
                        break
                    }
                    { $_.Equals([DateTime]) } {
                        [void]$OutputString.AppendFormat("'{0}'", $InputObject.ToString('O'))
                        break
                    }
                    { $_.Equals([guid]) } {
                        [void]$OutputString.AppendFormat("'{0}'", $InputObject)
                        break
                    }
                    { $_.BaseType -and $_.BaseType.Equals([Enum]) } {
                        [void]$OutputString.AppendFormat('::{0}', $InputObject)
                        break
                    }
                    { $_.BaseType -and $_.BaseType.Equals([ValueType]) } {
                        [void]$OutputString.AppendFormat('{0}', $InputObject)
                        break
                    }
                    { $_.BaseType.Equals([System.IO.FileSystemInfo]) -or $_.Equals([System.Uri]) } {
                        [void]$OutputString.AppendFormat("'{0}'", $InputObject.ToString().Replace("'", "''")) #.Replace('"','`"')
                        break
                    }
                    { $_.Equals([System.Xml.XmlDocument]) } {
                        [void]$OutputString.AppendFormat("'{0}'", $InputObject.OuterXml.Replace("'", "''")) #.Replace('"','""')
                        break
                    }
                    { $_.Equals([Hashtable]) -or $_.Equals([System.Collections.Specialized.OrderedDictionary]) } {
                        [void]$OutputString.Append('@{')
                        $iInput = 0
                        foreach ($enumHashtable in $InputObject.GetEnumerator()) {
                            if ($iInput -gt 0) { [void]$OutputString.Append(';') }
                            [void]$OutputString.AppendFormat('{0}={1}', (ConvertTo-PsString $enumHashtable.Key -Compact:$Compact -NoEnumerate), (ConvertTo-PsString $enumHashtable.Value -Compact:$Compact -NoEnumerate))
                            $iInput++
                        }
                        [void]$OutputString.Append('}')
                        break
                    }
                    { $_.FullName.StartsWith('System.Collections.Generic.Dictionary') -or ($_.BaseType -and $_.BaseType.FullName.StartsWith('System.Collections.Generic.Dictionary')) } {
                        $iInput = 0
                        foreach ($enumHashtable in $InputObject.GetEnumerator()) {
                            [void]$OutputString.AppendFormat('; $D.Add({0},{1})', (ConvertTo-PsString $enumHashtable.Key -Compact:$Compact -NoEnumerate), (ConvertTo-PsString $enumHashtable.Value -Compact:$Compact -NoEnumerate))
                            $iInput++
                        }
                        [void]$OutputString.Append('; $D })')
                        break
                    }
                    { $_.BaseType -and $_.BaseType.Equals([Array]) } {
                        [void]$OutputString.Append('(Write-Output @(')
                        $iInput = 0
                        for ($iInput = 0; $iInput -lt $InputObject.Count; $iInput++) {
                            if ($iInput -gt 0) { [void]$OutputString.Append(',') }
                            [void]$OutputString.Append((ConvertTo-PsString $InputObject[$iInput] -Compact:$Compact -RemoveTypes $InputObject.GetType().DeclaredMembers.Where( { $_.Name -eq 'Set' })[0].GetParameters()[1].ParameterType -NoEnumerate))
                        }
                        [void]$OutputString.Append(') -NoEnumerate)')
                        break
                    }
                    { $_.Equals([System.Collections.ArrayList]) } {
                        [void]$OutputString.Append('@(')
                        $iInput = 0
                        for ($iInput = 0; $iInput -lt $InputObject.Count; $iInput++) {
                            if ($iInput -gt 0) { [void]$OutputString.Append(',') }
                            [void]$OutputString.Append((ConvertTo-PsString $InputObject[$iInput] -Compact:$Compact -NoEnumerate))
                        }
                        [void]$OutputString.Append(')')
                        break
                    }
                    { $_.FullName.StartsWith('System.Collections.Generic.List') } {
                        [void]$OutputString.Append('@(')
                        $iInput = 0
                        for ($iInput = 0; $iInput -lt $InputObject.Count; $iInput++) {
                            if ($iInput -gt 0) { [void]$OutputString.Append(',') }
                            [void]$OutputString.Append((ConvertTo-PsString $InputObject[$iInput] -Compact:$Compact -RemoveTypes $_.GenericTypeArguments -NoEnumerate))
                        }
                        [void]$OutputString.Append(')')
                        break
                    }
                    ## Convert objects with object initializers
                    { $_ -is [object] -and ($_.GetConstructors() | ForEach-Object { if ($_.IsPublic -and !$_.GetParameters()) { $true } }) } {
                        [void]$OutputString.Append('@{')
                        $iInput = 0
                        foreach ($Item in ($InputObject | Get-Member -MemberType Property, NoteProperty)) {
                            if ($iInput -gt 0) { [void]$OutputString.Append(';') }
                            $PropertyName = $Item.Name
                            [void]$OutputString.AppendFormat('{0}={1}', (ConvertTo-PsString $PropertyName -Compact:$Compact -NoEnumerate), (ConvertTo-PsString $InputObject.$PropertyName -Compact:$Compact -NoEnumerate))
                            $iInput++
                        }
                        [void]$OutputString.Append('}')
                        break
                    }
                    Default {
                        $Exception = New-Object ArgumentException -ArgumentList ('Cannot convert input of type {0} to PowerShell string.' -f $InputObject.GetType())
                        Write-Error -Exception $Exception -Category ([System.Management.Automation.ErrorCategory]::ParserError) -CategoryActivity $MyInvocation.MyCommand -ErrorId 'ConvertPowerShellStringFailureTypeNotSupported' -TargetObject $InputObject
                    }
                }
            }

            if ($NoEnumerate) {
                $listOutputString.Add($OutputString.ToString())
            }
            else {
                Write-Output $OutputString.ToString()
            }
        }

        if ($NoEnumerate) {
            $listOutputString = New-Object System.Collections.Generic.List[string]
        }
    }

    process {
        if ($PSCmdlet.MyInvocation.ExpectingInput -or $NoEnumerate -or $null -eq $InputObjects) {
            GetPSString $InputObjects
        }
        else {
            foreach ($InputObject in $InputObjects) {
                GetPSString $InputObject
            }
        }
    }

    end {
        if ($NoEnumerate) {
            if (($null -eq $InputObjects -and $listOutputString.Count -eq 0) -or $listOutputString.Count -gt 1) {
                Write-Warning ('To avoid losing strong type on outermost enumerable type when piping, use "Write-Output $Array -NoEnumerate | {0}".' -f $MyInvocation.MyCommand)
                $OutputArray = New-Object System.Text.StringBuilder
                [void]$OutputArray.Append('(Write-Output @(')
                if ($PSVersionTable.PSVersion -ge [version]'6.0') {
                    [void]$OutputArray.AppendJoin(',', $listOutputString)
                }
                else {
                    [void]$OutputArray.Append(($listOutputString -join ','))
                }
                [void]$OutputArray.Append(') -NoEnumerate)')
                Write-Output $OutputArray.ToString()
            }
            else {
                Write-Output $listOutputString[0]
            }

        }
    }
}

#endregion

#region ConvertTo-QueryString.ps1

<#
.SYNOPSIS
    Convert Hashtable to Query String.
.DESCRIPTION

.EXAMPLE
    PS C:\>ConvertTo-QueryString @{ name = 'path/file.json'; index = 10 }
    Convert hashtable to query string.
.EXAMPLE
    PS C:\>[ordered]@{ title = 'convert&prosper'; id = [guid]'352182e6-9ab0-4115-807b-c36c88029fa4' } | ConvertTo-QueryString
    Convert ordered dictionary to query string.
.INPUTS
    System.Collections.Hashtable
.LINK
    https://github.com/jasoth/Utility.PS
#>
function ConvertTo-QueryString {
    [CmdletBinding()]
    [OutputType([string])]
    param (
        # Value to convert
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [object] $InputObjects,
        # URL encode parameter names
        [Parameter(Mandatory = $false)]
        [switch] $EncodeParameterNames
    )

    process {
        foreach ($InputObject in $InputObjects) {
            $QueryString = New-Object System.Text.StringBuilder
            if ($InputObject -is [hashtable] -or $InputObject -is [System.Collections.Specialized.OrderedDictionary] -or $InputObject.GetType().FullName.StartsWith('System.Collections.Generic.Dictionary')) {
                foreach ($Item in $InputObject.GetEnumerator()) {
                    if ($QueryString.Length -gt 0) { [void]$QueryString.Append('&') }
                    [string] $ParameterName = $Item.Key
                    if ($EncodeParameterNames) { $ParameterName = [System.Net.WebUtility]::UrlEncode($ParameterName) }
                    [void]$QueryString.AppendFormat('{0}={1}', $ParameterName, [System.Net.WebUtility]::UrlEncode($Item.Value))
                }
            }
            elseif ($InputObject -is [object] -and $InputObject -isnot [ValueType]) {
                foreach ($Item in ($InputObject | Get-Member -MemberType Property, NoteProperty)) {
                    if ($QueryString.Length -gt 0) { [void]$QueryString.Append('&') }
                    [string] $ParameterName = $Item.Name
                    if ($EncodeParameterNames) { $ParameterName = [System.Net.WebUtility]::UrlEncode($ParameterName) }
                    [void]$QueryString.AppendFormat('{0}={1}', $ParameterName, [System.Net.WebUtility]::UrlEncode($InputObject.($Item.Name)))
                }
            }
            else {
                ## Non-Terminating Error
                $Exception = New-Object ArgumentException -ArgumentList ('Cannot convert input of type {0} to query string.' -f $InputObject.GetType())
                Write-Error -Exception $Exception -Category ([System.Management.Automation.ErrorCategory]::ParserError) -CategoryActivity $MyInvocation.MyCommand -ErrorId 'ConvertQueryStringFailureTypeNotSupported' -TargetObject $InputObject
                continue
            }

            Write-Output $QueryString.ToString()
        }
    }
}

#endregion

#region Expand-Data.ps1

<#
.SYNOPSIS
    Decompress data using DEFLATE (RFC 1951) or GZIP file format (RFC 1952).
.DESCRIPTION

.EXAMPLE
    [byte[]] $byteArray = @(115,84,40,46,41,202,204,75,87,72,203,47,82,72,206,207,45,40,74,45,46,206,204,207,3,0)
    PS C:\>Expand-Data $byteArray
    Decompress string using Deflate.
.INPUTS
    System.String
.LINK
    https://github.com/jasoth/Utility.PS
#>
function Expand-Data {
    [CmdletBinding()]
    [Alias('Decompress-Data')]
    [Alias('Inflate-Data')]
    [OutputType([string], [byte[]])]
    param (
        # Value to convert
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [object] $InputObjects,
        # Input is gzip file format
        [Parameter(Mandatory = $false)]
        [switch] $GZip,
        # Output raw byte array
        [Parameter (Mandatory = $false)]
        [switch] $RawBytes,
        # Encoding to use for text strings
        [Parameter (Mandatory = $false)]
        [ValidateSet('Ascii', 'UTF32', 'UTF7', 'UTF8', 'BigEndianUnicode', 'Unicode')]
        [string] $Encoding = 'Default'
    )

    begin {
        function Expand ([byte[]]$InputBytes) {
            try {
                $streamOutput = New-Object System.IO.MemoryStream
                try {
                    $streamInput = New-Object System.IO.MemoryStream -ArgumentList @($InputBytes, $false)
                    try {
                        if ($GZip) {
                            $streamCompression = New-Object System.IO.Compression.GZipStream -ArgumentList $streamInput, ([System.IO.Compression.CompressionMode]::Decompress)
                        }
                        else {
                            $streamCompression = New-Object System.IO.Compression.DeflateStream -ArgumentList $streamInput, ([System.IO.Compression.CompressionMode]::Decompress)
                        }
                        $streamCompression.CopyTo($streamOutput)
                    }
                    catch {
                        Write-Error -Exception $_.Exception.InnerException -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -CategoryActivity $MyInvocation.MyCommand -ErrorId 'ExpandDataFailureInvalidData' -TargetObject $InputBytes -ErrorAction Stop
                    }
                    finally { $streamCompression.Dispose() }
                    [byte[]] $OutputBytes = $streamOutput.ToArray()
                }
                finally { $streamInput.Dispose() }
            }
            finally { $streamOutput.Dispose() }

            Write-Output $OutputBytes
        }

        ## Create list to capture byte stream from piped input.
        [System.Collections.Generic.List[byte]] $listBytes = New-Object System.Collections.Generic.List[byte]
    }

    process {
        if ($InputObjects -is [byte[]]) {
            [byte[]] $outBytes = Expand $InputObjects
            if ($RawBytes) {
                Write-Output $outBytes -NoEnumerate
            }
            else {
                [string] $outString = ([Text.Encoding]::$Encoding.GetString($outBytes))
                Write-Output $outString
            }
        }
        else {
            foreach ($InputObject in $InputObjects) {
                [byte[]] $InputBytes = $null
                if ($InputObject -is [byte]) {
                    ## Populate list with byte stream from piped input.
                    if ($listBytes.Count -eq 0) {
                        Write-Verbose 'Creating byte array from byte stream.'
                        Write-Warning ('For better performance when piping a single byte array, use "Write-Output $byteArray -NoEnumerate | {0}".' -f $MyInvocation.MyCommand)
                    }
                    $listBytes.Add($InputObject)
                }
                elseif ($InputObject -is [byte[]]) {
                    $InputBytes = $InputObject
                }
                elseif ($InputObject -is [bool] -or $InputObject -is [char] -or $InputObject -is [single] -or $InputObject -is [double] -or $InputObject -is [int16] -or $InputObject -is [int32] -or $InputObject -is [int64] -or $InputObject -is [uint16] -or $InputObject -is [uint32] -or $InputObject -is [uint64]) {
                    $InputBytes = [System.BitConverter]::GetBytes($InputObject)
                }
                elseif ($InputObject -is [System.IO.FileSystemInfo]) {
                    if ($PSVersionTable.PSVersion -ge [version]'6.0') {
                        $InputBytes = Get-Content $InputObject.FullName -Raw -AsByteStream
                    }
                    else {
                        $InputBytes = Get-Content $InputObject.FullName -Raw -Encoding Byte
                    }
                }
                else {
                    ## Non-Terminating Error
                    $Exception = New-Object ArgumentException -ArgumentList ('Cannot compress input of type {0}.' -f $InputObject.GetType())
                    Write-Error -Exception $Exception -Category ([System.Management.Automation.ErrorCategory]::ParserError) -CategoryActivity $MyInvocation.MyCommand -ErrorId 'CompressDataFailureTypeNotSupported' -TargetObject $InputObject
                }

                if ($null -ne $InputBytes -and $InputBytes.Count -gt 0) {
                    [byte[]] $outBytes = Expand $InputBytes
                    if ($RawBytes) {
                        Write-Output $outBytes -NoEnumerate
                    }
                    else {
                        [string] $outString = ([Text.Encoding]::$Encoding.GetString($outBytes))
                        Write-Output $outString
                    }
                }
            }
        }
    }

    end {
        ## Output captured byte stream from piped input.
        if ($listBytes.Count -gt 0) {
            [byte[]] $outBytes = Expand $listBytes.ToArray()
            if ($RawBytes) {
                Write-Output $outBytes -NoEnumerate
            }
            else {
                [string] $outString = ([Text.Encoding]::$Encoding.GetString($outBytes))
                Write-Output $outString
            }
        }
    }
}

#endregion

#region Get-MsftUserRealm.ps1

<#
.SYNOPSIS
   Get User Realm Information for a Microsoft user account.
.EXAMPLE
   Get-MsftUserRealm user@domain.com
.EXAMPLE
   'user1@domainA.com','user2@domainA.com','user@domainB.com' | Get-MsftUserRealm
#>
function Get-MsftUserRealm {
    [CmdletBinding()]
    [OutputType([PsCustomObject[]])]
    param (
        # User Principal Name
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 1)]
        [string[]] $User,
        # Check For Microsoft Account
        [Parameter(Mandatory = $false)]
        [switch] $CheckForMicrosoftAccount,
        # API Version
        [Parameter(Mandatory = $false)]
        [string] $ApiVersion = '2.1'
    )

    process {
        foreach ($_User in $User) {
            $uriUserRealm = New-Object System.UriBuilder 'https://login.microsoftonline.com/common/userrealm'
            $uriUserRealm.Query = ConvertTo-QueryString @{
                'api-version' = $ApiVersion
                'checkForMicrosoftAccount' = $CheckForMicrosoftAccount
                'user'        = $_User
            }

            $Result = Invoke-RestMethod -UseBasicParsing -Method Get -Uri $uriUserRealm.Uri.AbsoluteUri
            Write-Output $Result
        }
    }
}

#endregion

#region Get-ObjectPropertyValue.ps1

<#
.SYNOPSIS
    Get object property value.
.EXAMPLE
    PS C:\>$object = New-Object psobject -Property @{ title = 'title value' }
    PS C:\>$object | Get-ObjectPropertyValue -Property 'title'
    Get value of object property named title.
.EXAMPLE
    PS C:\>$object = New-Object psobject -Property @{ lvl1 = (New-Object psobject -Property @{ nextLevel = 'lvl2 data' }) }
    PS C:\>Get-ObjectPropertyValue $object -Property 'lvl1', 'nextLevel'
    Get value of nested object property named nextLevel.
.INPUTS
    System.Collections.Hashtable
    System.Management.Automation.PSObject
#>
function Get-ObjectPropertyValue {
    [CmdletBinding()]
    [OutputType([psobject])]
    param (
        # Object containing property values
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [AllowNull()]
        [psobject] $InputObjects,
        # Name of property. Specify an array of property names to tranverse nested objects.
        [Parameter(Mandatory = $true, ValueFromRemainingArguments = $true)]
        [string[]] $Property
    )

    process {
        foreach ($InputObject in $InputObjects) {
            for ($iProperty = 0; $iProperty -lt $Property.Count; $iProperty++) {
                ## Get property value
                if ($InputObject -is [hashtable]) {
                    if ($InputObject.ContainsKey($Property[$iProperty])) {
                        $PropertyValue = $InputObject[$Property[$iProperty]]
                    }
                    else { $PropertyValue = $null }
                }
                else {
                    $PropertyValue = Select-Object -InputObject $InputObject -ExpandProperty $Property[$iProperty] -ErrorAction Ignore
                    if ($null -eq $PropertyValue) { break }
                }
                ## Check for more nested properties
                if ($iProperty -lt $Property.Count - 1) {
                    $InputObject = $PropertyValue
                    if ($null -eq $InputObject) { break }
                }
                else {
                    Write-Output $PropertyValue
                }
            }
        }
    }
}

#endregion

#region Get-OpenIdProviderConfiguration.ps1

<#
.SYNOPSIS
    Parse OpenId Provider Configuration and Keys
.EXAMPLE
    PS C:\>Get-MsIdAuthorityUri -TenantId tenant.onmicrosoft.com | Get-OpenIdProviderConfiguration
    Get OpenId Provider Configuration for a specific Microsoft organizational tenant (Azure AD).
.EXAMPLE
    PS C:\>Get-MsIdAuthorityUri -TenantId tenant.onmicrosoft.com | Get-OpenIdProviderConfiguration -Keys
    Get public keys for OpenId Provider for a specific Microsoft organizational tenant (Azure AD).
.EXAMPLE
    PS C:\>Get-MsIdAuthorityUri -Msa | Get-OpenIdProviderConfiguration
    Get OpenId Provider Configuration for Microsoft consumer accounts (MSA).
.EXAMPLE
    PS C:\>Get-OpenIdProviderConfiguration 'https://accounts.google.com/'
    Get OpenId Provider Configuration for Google Accounts.
.INPUTS
    System.Uri
#>
function Get-OpenIdProviderConfiguration {
    [CmdletBinding()]
    [OutputType([PsCustomObject[]])]
    param (
        # Identity Provider Authority URI
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 1)]
        [uri] $Issuer,
        # Return configuration keys
        [Parameter(Mandatory = $false)]
        [switch] $Keys
    )
    ## Build common OpenId provider configuration URI
    $uriOpenIdProviderConfiguration = New-Object System.UriBuilder $Issuer.AbsoluteUri
    if (!$uriOpenIdProviderConfiguration.Path.EndsWith('/.well-known/openid-configuration')) { $uriOpenIdProviderConfiguration.Path += '/.well-known/openid-configuration' }

    ## Download and parse configuration
    $OpenIdProviderConfiguration = Invoke-RestMethod -UseBasicParsing -Uri $uriOpenIdProviderConfiguration.Uri.AbsoluteUri  # Should return ContentType 'application/json'
    if ($Keys) {
        $OpenIdProviderConfigurationJwks = Invoke-RestMethod -UseBasicParsing -Uri $OpenIdProviderConfiguration.jwks_uri  # Should return ContentType 'application/json'
        return $OpenIdProviderConfigurationJwks.keys
    }
    else {
        return $OpenIdProviderConfiguration
    }
}

#endregion

#region Get-ParsedTokenFromResponse.ps1

<#
.SYNOPSIS
    Parses token from response as plain text string.
.EXAMPLE
    PS C:\>Get-ParsedTokenFromResponse $response
    Parses token from $response as plain text string.
#>
function Get-ParsedTokenFromResponse {
    [CmdletBinding()]
    [OutputType([string])]
    param (
        # HTTP response
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [string] $HttpResponse,
        [Parameter(Mandatory=$true, Position = 1)]
        # Protocol SAML or WsFed
        [ValidateSet("SAML", "WsFed")]
        [string]$Protocol
  
    )

    $token = ""

    if ($Protocol -eq "SAML") {
        # <input type="hidden" name="SAMLResponse" value=" ... " />
        if($HttpResponse -match '<input type=\"hidden\" name=\"SAMLResponse\" value=\"(.+)\" \/><noscript>') {
            # $token = $Matches[1] | ConvertFrom-Base64String
            $token = $Matches[1] | ConvertFrom-SamlMessage
        }
    }
    else {
        # <input type="hidden" name="wresult" value=" ... " />
        if($HttpResponse -match '<input type=\"hidden\" name=\"wresult\" value=\"(.+)\" \/><noscript>') {
            $token = [System.Net.WebUtility]::HtmlDecode($Matches[1]) | ConvertFrom-SamlMessage
        }
    }


    return $token
}
#endregion

#region Get-SamlFederationMetadata.ps1

<#
.SYNOPSIS
    Parse Federation Metadata
.EXAMPLE
    PS C:\>Get-MsIdAuthorityUri -TenantId tenant.onmicrosoft.com -AppType 'Saml' | Get-SamlFederationMetadata
    Get SAML or WS-Fed Federation Metadata for a specific Microsoft tenant.
.EXAMPLE
    PS C:\>Get-MsIdAuthorityUri -TenantId tenant.onmicrosoft.com -AppType 'Saml' | Get-SamlFederationMetadata -AppId 00000000-0000-0000-0000-000000000000
    Get SAML or WS-Fed Federation Metadata for a specific application within a specific Microsoft tenant.
.EXAMPLE
    PS C:\>Get-SamlFederationMetadata 'https://adfs.contoso.com'
    Get SAML or WS-Fed Federation Metadata for an ADFS farm.
.INPUTS
    System.Uri
#>
function Get-SamlFederationMetadata {
    [CmdletBinding()]
    [Alias('Get-WsFedFederationMetadata')]
    [OutputType([xml], [System.Xml.XmlElement[]])]
    param (
        # Identity Provider Authority URI
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 1)]
        [uri] $Issuer,
        # Azure AD Application Id
        [Parameter(Mandatory = $false, Position = 2)]
        [guid] $AppId
    )

    ## Remove Microsoft v2.0 endpoint because it is only for OAuth2
    if ($Issuer.Authority -eq 'login.microsoftonline.com') { $Issuer = $Issuer.AbsoluteUri -replace '[/\\]v2.0[/\\]?$', '' }

    ## Build common federation metadata URI
    $uriFederationMetadata = New-Object System.UriBuilder $Issuer.AbsoluteUri
    if (!$uriFederationMetadata.Path.EndsWith('/FederationMetadata/2007-06/FederationMetadata.xml', $true, $null)) { $uriFederationMetadata.Path += '/FederationMetadata/2007-06/FederationMetadata.xml' }
    if ($AppId) {
        $uriFederationMetadata.Query = ConvertTo-QueryString @{
            AppId = $AppId
        }
    }

    ## Download and parse federation metadata
    $FederationMetadata = Invoke-RestMethod -UseBasicParsing -Uri $uriFederationMetadata.Uri.AbsoluteUri -ErrorAction Stop  # Should return ContentType 'application/samlmetadata+xml'
    if ($FederationMetadata -is [string]) {
        try {
            [xml] $xmlFederationMetadata = $FederationMetadata -replace '^[^<]*', ''
        }
        catch { throw }
    }
    else {
        [xml] $xmlFederationMetadata = $FederationMetadata
    }

    return $xmlFederationMetadata.GetElementsByTagName('EntityDescriptor')
}

#endregion

#region Get-X509Certificate.ps1

<#
.SYNOPSIS
    Get certificate object for X509 certificate.
.DESCRIPTION
    Get certificate object for X509 certificate.
.EXAMPLE
    PS C:\>[byte[]] $DERCert = @(48,130,4,18,48,130,2,250,160,3,2,1,2,2,15,0,193,0,139,60,60,136,17,209,62,246,99,236,223,64,48,13,6,9,42,134,72,134,247,13,1,1,4,5,0,48,112,49,43,48,41,6,3,85,4,11,19,34,67,111,112,121,114,105,103,104,116,32,40,99,41,32,49,57,57,55,32,77,105,99,114,111,115,111,102,116,32,67,111,114,112,46,49,30,48,28,6,3,85,4,11,19,21,77,105,99,114,111,115,111,102,116,32,67,111,114,112,111,114,97,116,105,111,110,49,33,48,31,6,3,85,4,3,19,24,77,105,99,114,111,115,111,102,116,32,82,111,111,116,32,65,117,116,104,111,114,105,116,121,48,30,23,13,57,55,48,49,49,48,48,55,48,48,48,48,90,23,13,50,48,49,50,51,49,48,55,48,48,48,48,90,48,112,49,43,48,41,6,3,85,4,11,19,34,67,111,112,121,114,105,103,104,116,32,40,99,41,32,49,57,57,55,32,77,105,99,114,111,115,111,102,116,32,67,111,114,112,46,49,30,48,28,6,3,85,4,11,19,21,77,105,99,114,111,115,111,102,116,32,67,111,114,112,111,114,97,116,105,111,110,49,33,48,31,6,3,85,4,3,19,24,77,105,99,114,111,115,111,102,116,32,82,111,111,116,32,65,117,116,104,111,114,105,116,121,48,130,1,34,48,13,6,9,42,134,72,134,247,13,1,1,1,5,0,3,130,1,15,0,48,130,1,10,2,130,1,1,0,169,2,189,193,112,230,59,242,78,27,40,159,151,120,94,48,234,162,169,141,37,95,248,254,149,76,163,183,254,157,162,32,62,124,81,162,155,162,143,96,50,107,209,66,100,121,238,172,118,201,84,218,242,235,156,134,28,143,159,132,102,179,197,107,122,98,35,214,29,60,222,15,1,146,232,150,196,191,45,102,154,154,104,38,153,208,58,44,191,12,181,88,38,193,70,231,10,62,56,150,44,169,40,57,168,236,73,131,66,227,132,15,187,154,108,85,97,172,130,124,161,96,45,119,76,233,153,180,100,59,154,80,28,49,8,36,20,159,169,231,145,43,24,230,61,152,99,20,96,88,5,101,159,29,55,82,135,247,167,239,148,2,198,27,211,191,85,69,179,137,128,191,58,236,84,148,78,174,253,167,122,109,116,78,175,24,204,150,9,40,33,0,87,144,96,105,55,187,75,18,7,60,86,255,91,251,164,102,10,8,166,210,129,86,87,239,182,59,94,22,129,119,4,218,246,190,174,128,149,254,176,205,127,214,167,26,114,92,60,202,188,240,8,163,34,48,179,6,133,201,179,32,119,19,133,223,2,3,1,0,1,163,129,168,48,129,165,48,129,162,6,3,85,29,1,4,129,154,48,129,151,128,16,91,208,112,239,105,114,158,35,81,126,20,178,77,142,255,203,161,114,48,112,49,43,48,41,6,3,85,4,11,19,34,67,111,112,121,114,105,103,104,116,32,40,99,41,32,49,57,57,55,32,77,105,99,114,111,115,111,102,116,32,67,111,114,112,46,49,30,48,28,6,3,85,4,11,19,21,77,105,99,114,111,115,111,102,116,32,67,111,114,112,111,114,97,116,105,111,110,49,33,48,31,6,3,85,4,3,19,24,77,105,99,114,111,115,111,102,116,32,82,111,111,116,32,65,117,116,104,111,114,105,116,121,130,15,0,193,0,139,60,60,136,17,209,62,246,99,236,223,64,48,13,6,9,42,134,72,134,247,13,1,1,4,5,0,3,130,1,1,0,149,232,11,192,141,243,151,24,53,237,184,1,36,216,119,17,243,92,96,50,159,158,11,203,62,5,145,136,143,201,58,230,33,242,240,87,147,44,181,160,71,200,98,239,252,215,204,59,59,90,169,54,84,105,254,36,109,63,201,204,170,222,5,124,221,49,141,61,159,16,112,106,187,254,18,79,24,105,192,252,208,67,227,17,90,32,79,234,98,123,175,170,25,200,43,55,37,45,190,101,161,18,138,37,15,99,163,247,84,28,249,33,201,214,21,243,82,172,110,67,50,7,253,130,23,248,229,103,108,13,81,246,189,241,82,199,189,231,196,48,252,32,49,9,136,29,149,41,26,77,213,29,2,165,241,128,224,3,180,91,244,177,221,200,87,238,101,73,199,82,84,182,180,3,40,18,255,144,214,240,8,143,126,184,151,197,171,55,44,228,122,228,168,119,227,118,160,0,208,106,63,193,210,54,138,224,65,18,168,53,106,27,106,219,53,225,212,28,4,228,168,69,4,200,90,51,56,110,77,28,13,98,183,10,162,140,211,213,84,63,70,205,28,85,166,112,219,18,58,135,147,117,159,167,210,160)
    PS C:\>Get-X509Certificate $DERCert -Verbose
    Get certificate details from binary (DER) encoded X509 certificate.
.EXAMPLE
    PS C:\>[string] $Base64Cert = 'MIIEEjCCAvqgAwIBAgIPAMEAizw8iBHRPvZj7N9AMA0GCSqGSIb3DQEBBAUAMHAxKzApBgNVBAsTIkNvcHlyaWdodCAoYykgMTk5NyBNaWNyb3NvZnQgQ29ycC4xHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEhMB8GA1UEAxMYTWljcm9zb2Z0IFJvb3QgQXV0aG9yaXR5MB4XDTk3MDExMDA3MDAwMFoXDTIwMTIzMTA3MDAwMFowcDErMCkGA1UECxMiQ29weXJpZ2h0IChjKSAxOTk3IE1pY3Jvc29mdCBDb3JwLjEeMBwGA1UECxMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSEwHwYDVQQDExhNaWNyb3NvZnQgUm9vdCBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCpAr3BcOY78k4bKJ+XeF4w6qKpjSVf+P6VTKO3/p2iID58UaKboo9gMmvRQmR57qx2yVTa8uuchhyPn4Rms8VremIj1h083g8BkuiWxL8tZpqaaCaZ0Dosvwy1WCbBRucKPjiWLKkoOajsSYNC44QPu5psVWGsgnyhYC13TOmZtGQ7mlAcMQgkFJ+p55ErGOY9mGMUYFgFZZ8dN1KH96fvlALGG9O/VUWziYC/OuxUlE6u/ad6bXROrxjMlgkoIQBXkGBpN7tLEgc8Vv9b+6RmCgim0oFWV++2O14WgXcE2va+roCV/rDNf9anGnJcPMq88AijIjCzBoXJsyB3E4XfAgMBAAGjgagwgaUwgaIGA1UdAQSBmjCBl4AQW9Bw72lyniNRfhSyTY7/y6FyMHAxKzApBgNVBAsTIkNvcHlyaWdodCAoYykgMTk5NyBNaWNyb3NvZnQgQ29ycC4xHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEhMB8GA1UEAxMYTWljcm9zb2Z0IFJvb3QgQXV0aG9yaXR5gg8AwQCLPDyIEdE+9mPs30AwDQYJKoZIhvcNAQEEBQADggEBAJXoC8CN85cYNe24ASTYdxHzXGAyn54Lyz4FkYiPyTrmIfLwV5MstaBHyGLv/NfMOztaqTZUaf4kbT/JzKreBXzdMY09nxBwarv+Ek8YacD80EPjEVogT+pie6+qGcgrNyUtvmWhEoolD2Oj91Qc+SHJ1hXzUqxuQzIH/YIX+OVnbA1R9r3xUse958Qw/CAxCYgdlSkaTdUdAqXxgOADtFv0sd3IV+5lScdSVLa0AygS/5DW8AiPfriXxas3LOR65Kh343agANBqP8HSNorgQRKoNWobats14dQcBOSoRQTIWjM4bk0cDWK3CqKM09VUP0bNHFWmcNsSOoeTdZ+n0qA='
    PS C:\>$Base64Cert | Get-X509Certificate -Verbose
    Get certificate details from Base64 encoded X509 certificate.
.EXAMPLE
    PS C:\>Get-Item "certificateFile.cer" | Get-X509Certificate
    Get certificate details from .cer file.
.INPUTS
    System.Object
.LINK
    https://github.com/jasoth/Utility.PS
#>
function Get-X509Certificate {
    [CmdletBinding()]
    [OutputType([System.Security.Cryptography.X509Certificates.X509Certificate2], [System.Security.Cryptography.X509Certificates.X509Certificate2Collection])]
    param (
        # X.509 certificate that is binary (DER) encoded or Base64-encoded
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 0)]
        [object] $InputObjects,
        # Only return the end-entity certificate
        [Parameter(Mandatory = $false)]
        [switch] $EndEntityCertificateOnly
    )

    begin {
        ## Create list to capture byte stream from piped input.
        [System.Collections.Generic.List[byte]] $listBytes = New-Object System.Collections.Generic.List[byte]

        function Transform ([byte[]]$InputBytes) {
            $X509CertificateCollection = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection
            $X509CertificateCollection.Import($InputBytes, $null, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::EphemeralKeySet)
            Write-Output $X509CertificateCollection -NoEnumerate
        }
    }

    process {
        if ($InputObjects -is [byte[]]) {
            $X509CertificateCollection = Transform $InputObjects
            if ($EndEntityCertificateOnly) { Write-Output $X509CertificateCollection[-1] }
            else { Write-Output $X509CertificateCollection }
        }
        else {
            foreach ($InputObject in $InputObjects) {
                [byte[]] $inputBytes = $null
                if ($InputObject -is [byte]) {
                    ## Populate list with byte stream from piped input.
                    if ($listBytes.Count -eq 0) {
                        Write-Verbose 'Creating byte array from byte stream.'
                        Write-Warning ('For better performance when piping a single byte array, use "Write-Output $byteArray -NoEnumerate | {0}".' -f $MyInvocation.MyCommand)
                    }
                    $listBytes.Add($InputObject)
                }
                elseif ($InputObject -is [byte[]]) {
                    $inputBytes = $InputObject
                }
                elseif ($InputObject -is [SecureString]) {
                    Write-Verbose 'Decrypting SecureString and decoding Base64 string to byte array.'
                    if ($PSVersionTable.PSVersion -ge [version]'7.0') {
                        $inputBytes = [System.Convert]::FromBase64String((ConvertFrom-SecureString $InputObject -AsPlainText))
                    }
                    else {
                        $inputBytes = [System.Convert]::FromBase64String((ConvertFrom-SecureStringAsPlainText $InputObject -Force))
                    }
                }
                elseif ($InputObject -is [string]) {
                    Write-Verbose 'Decoding Base64 string to byte array.'
                    $inputBytes = [System.Convert]::FromBase64String($InputObject)
                }
                elseif ($InputObject -is [System.IO.FileSystemInfo]) {
                    Write-Verbose 'Decoding file content to byte array.'
                    if ($PSVersionTable.PSVersion -ge [version]'6.0') {
                        $inputBytes = Get-Content $InputObject.FullName -Raw -AsByteStream
                    }
                    else {
                        $inputBytes = Get-Content $InputObject.FullName -Raw -Encoding Byte
                    }
                }
                else {
                    # Otherwise, write a terminating error message indicating that input object type is not supported.
                    $errorMessage = 'Cannot convert input of type {0} to X.509 certificate.' -f $InputObject.GetType()
                    Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::ParserError) -ErrorId 'GetX509CertificateFailureTypeNotSupported' -ErrorAction Stop
                }

                ## Only write output if the input is not a byte stream.
                if ($listBytes.Count -eq 0) {
                    $X509CertificateCollection = Transform $inputBytes
                    if ($EndEntityCertificateOnly) { Write-Output $X509CertificateCollection[-1] }
                    else { Write-Output $X509CertificateCollection }
                }
            }
        }
    }

    end {
        ## Output captured byte stream from piped input.
        if ($listBytes.Count -gt 0) {
            $X509CertificateCollection = Transform $listBytes
            if ($EndEntityCertificateOnly) { Write-Output $X509CertificateCollection[-1] }
            else { Write-Output $X509CertificateCollection }
        }
    }
}

#endregion

#region Import-AdfsModule.ps1

<#
.SYNOPSIS
    Imports the AD FS PowerShell module.
.DESCRIPTION
    Imports the AD FS PowerShell module if not imported and returns $true. Returns $false in case it is not installed.
.EXAMPLE
    PS > if (Import-AdfsModule) { Write-Host 'AD FS PowerShell module is present' }

    Displays a string if the AD FS module was sucessfully imported.
#>
function Import-AdfsModule {
    $module = 'ADFS'
    
    if(-not(Get-Module -Name $module)) {
        if(Get-Module -ListAvailable | Where-Object { $_.name -eq $module }) {
            Import-Module -Name $module
            $true
        }
        else { $false }
    }
    else { $true } #module already loaded
}

#endregion

#region Invoke-CommandAsSystem.ps1

<#
.SYNOPSIS
    Run PowerShell commands under system context.
.EXAMPLE
    PS C:\>Invoke-CommandAsSystem { [System.Security.Principal.WindowsIdentity]::GetCurrent().Name }
    Run the ScriptBlock under the system context.
.INPUTS
    System.Management.Automation.ScriptBlock
.LINK
    https://github.com/jasoth/Utility.PS
#>
function Invoke-CommandAsSystem {
    [CmdletBinding()]
    param (
        #
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 1)]
        [ScriptBlock] $ScriptBlock,
        #
        [Parameter(Mandatory = $false, Position = 2)]
        [string[]] $ArgumentList
    )

    begin {
        ## Initialize Critical Dependencies
        $CriticalError = $null
        try {
            Import-Module PSScheduledJob, ScheduledTasks -ErrorAction Stop
        }
        catch { Write-Error -ErrorRecord $_ -ErrorVariable CriticalError; return }
    }

    process {
        ## Return Immediately On Critical Error
        if ($CriticalError) { return }

        ## Process
        [guid] $GUID = New-Guid

        try {
            ## Register ScheduleJob
            if ($ArgumentList) {
                $ScheduledJob = Register-ScheduledJob -Name $GUID -ScheduledJobOption (New-ScheduledJobOption -RunElevated) -ScriptBlock $ScriptBlock -ArgumentList $ArgumentList -ErrorAction Stop
            }
            else {
                $ScheduledJob = Register-ScheduledJob -Name $GUID -ScheduledJobOption (New-ScheduledJobOption -RunElevated) -ScriptBlock $ScriptBlock -ErrorAction Stop
            }
            try {
                ## Register ScheduledTask for ScheduledJob
                $ScheduledTask = Register-ScheduledTask -TaskName $GUID -Action (New-ScheduledTaskAction -Execute $ScheduledJob.PSExecutionPath -Argument $ScheduledJob.PSExecutionArgs) -Principal (New-ScheduledTaskPrincipal -UserId 'NT AUTHORITY\SYSTEM' -LogonType ServiceAccount -RunLevel Highest) -ErrorAction Stop

                try {
                    ## Execute ScheduledTask Job to Run ScheduledJob Job
                    $ScheduledTask | Start-ScheduledTask -AsJob -ErrorAction Stop | Wait-Job | Remove-Job -Force -Confirm:$False

                    ## Wait for ScheduledTask to finish
                    While (($ScheduledTask | Get-ScheduledTaskInfo).LastTaskResult -eq 267009) { Start-Sleep -Milliseconds 150 }

                    ## Find ScheduledJob and get the result
                    $Job = Get-Job -Name $GUID -ErrorAction SilentlyContinue | Wait-Job
                    $Result = $Job | Receive-Job -Wait -AutoRemoveJob
                }
                finally {
                    ## Unregister ScheduledTask for ScheduledJob
                    $ScheduledTask | Unregister-ScheduledTask -Confirm:$false
                }
            }
            finally {
                ## Unregister ScheduleJob
                $ScheduledJob | Unregister-ScheduledJob -Force -Confirm:$False
            }
        }
        catch { Write-Error -ErrorRecord $_; return }

        return $Result
    }
}

#endregion

#region New-AdfsLoginFormFields.ps1

<#
.SYNOPSIS
    Gets the form fields to login to AD FS server for the login URL and credentials.
.DESCRIPTION
.EXAMPLE
    PS C:\>New-AdfsLoginFormFields -Url $url -Credential $credential
    Gets the form fields for the variables.
#>
function New-AdfsLoginFormFields {
    [CmdletBinding()]
    [OutputType([System.Collections.Generic.Dictionary[string, string]])]
    param (
        # User credential
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [pscredential] $Credential
    )

    $user = $Credential.UserName
    $password = ConvertFrom-SecureStringAsPlainText $Credential.Password -Force

    $fields = New-Object -TypeName "System.Collections.Generic.Dictionary[string,string]"
    $fields.Add("UserName",$user)
    $fields.Add("Password",$password)
    $fields.Add("AuthMethod","FormsAuthentication")

    return $fields
}
#endregion

#region Resolve-XmlAttribute.ps1

function Resolve-XmlAttribute {
    [CmdletBinding(DefaultParameterSetName = "QualifiedName")]
    [OutputType([System.Xml.XmlAttribute])]
    param
    (
        #
        [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ValueFromPipeline = $true, Position = 1)]
        [System.Xml.XmlElement] $ParentNode,
        #
        [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = "QualifiedName")]
        [string] $QualifiedName,
        #
        [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = "Prefix")]
        [string] $Prefix,
        [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = "Prefix")]
        [string] $LocalName,
        #
        [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true, ParameterSetName = "QualifiedName")]
        [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true, ParameterSetName = "Prefix")]
        [string] $NamespaceURI,
        #
        [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)]
        [Alias("Create")]
        [switch] $CreateMissing
    )

    process {
        [System.Xml.XmlAttribute] $xmlAttribute = $null
        switch ($PSCmdlet.ParameterSetName) {
            'QualifiedName' {
                $resultSelectXml = Select-Xml -Xml $ParentNode -XPath ('@{0}' -f $QualifiedName)
                if ($resultSelectXml) { $xmlAttribute = $resultSelectXml.Node }
                elseif ($CreateMissing) {
                    if ($NamespaceURI) { $xmlAttribute = $ParentNode.SetAttributeNode($ParentNode.OwnerDocument.CreateAttribute($QualifiedName, $NamespaceURI)) }
                    else { $xmlAttribute = $ParentNode.SetAttributeNode(($ParentNode.OwnerDocument.CreateAttribute($QualifiedName))) }
                }
                break 
            }
            'Prefix' {
                if ($Prefix -eq "xmlns") { $resultSelectXml = Select-Xml -Xml $ParentNode -XPath ('namespace::{0}' -f $LocalName) }
                else { $resultSelectXml = Select-Xml -Xml $ParentNode -XPath ('@{0}:{1}' -f $Prefix, $LocalName) -Namespace @{ $Prefix = $ParentNode.GetNamespaceOfPrefix($Prefix) } }
                if ($resultSelectXml) { $xmlAttribute = $resultSelectXml.Node }
                elseif ($CreateMissing) { $xmlAttribute = $ParentNode.SetAttributeNode($ParentNode.OwnerDocument.CreateAttribute($Prefix, $LocalName, $ParentNode.GetNamespaceOfPrefix($Prefix))) }
                break 
            }
        }
        return $xmlAttribute
    }
}

#endregion

#region Resolve-XmlElement.ps1

function Resolve-XmlElement {
    [CmdletBinding(DefaultParameterSetName = "QualifiedName")]
    [OutputType([System.Xml.XmlElement[]])]
    param
    (
        #
        [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ValueFromPipeline = $true, Position = 1)]
        [System.Xml.XmlElement] $ParentNode,
        #
        [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = "QualifiedName")]
        [string] $QualifiedName,
        #
        [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = "Prefix")]
        [string] $Prefix,
        #
        [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = "Prefix")]
        [string] $LocalName,
        #
        [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true,  ParameterSetName = "QualifiedName")]
        [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = "Prefix")]
        [string] $NamespaceURI,
        #
        [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)]
        [Alias("Clear")]
        [switch] $ClearExisting = $false,
        #
        [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)]
        [Alias("Create")]
        [switch] $CreateMissing
    )
        
    process {
        [System.Xml.XmlElement[]] $xmlElement = @()
                
        switch ($PSCmdlet.ParameterSetName) {
            'QualifiedName' {
                [Microsoft.PowerShell.Commands.SelectXmlInfo[]] $resultSelectXml = Select-Xml -Xml $ParentNode -XPath ('./p:{0}' -f $QualifiedName) -Namespace @{ 'p' = $ParentNode.NamespaceURI }
                if ($ClearExisting) {
                    foreach ($result in $resultSelectXml) { $ParentNode.RemoveChild($result.Node) | Out-Null }
                    $resultSelectXml = @()
                }
                if ($resultSelectXml) { $xmlElement = $resultSelectXml.Node }
                elseif ($CreateMissing) { $xmlElement = $ParentNode.AppendChild($ParentNode.OwnerDocument.CreateElement($QualifiedName, $ParentNode.NamespaceURI)) }
                break 
            }
            'Prefix' {
                [Microsoft.PowerShell.Commands.SelectXmlInfo[]] $resultSelectXml = Select-Xml -Xml $ParentNode -XPath ('./{0}:{1}' -f $Prefix, $LocalName) -Namespace @{ $Prefix = $ParentNode.GetNamespaceOfPrefix($Prefix) }
                if ($ClearExisting) {
                    foreach ($result in $resultSelectXml) { $ParentNode.RemoveChild($result.Node) | Out-Null }
                    $resultSelectXml = @()
                }
                if ($resultSelectXml) { $xmlElement = $resultSelectXml.Node }
                elseif ($CreateMissing) { $xmlElement = $ParentNode.AppendChild($ParentNode.OwnerDocument.CreateElement($Prefix, $LocalName, $ParentNode.GetNamespaceOfPrefix($Prefix))) }
                break 
            }
        }
        return $xmlElement
    }
}
#endregion

#region Test-IpAddressInSubnet.ps1

<#
.SYNOPSIS
    Determine if an IP address exists in the specified subnet.
.EXAMPLE
    PS C:\>Test-IpAddressInSubnet 192.168.1.10 -Subnet '192.168.1.1/32','192.168.1.0/24'
    Determine if the IPv4 address exists in the specified subnet.
.EXAMPLE
    PS C:\>Test-IpAddressInSubnet 2001:db8:1234::1 -Subnet '2001:db8:a::123/64','2001:db8:1234::/48'
    Determine if the IPv6 address exists in the specified subnet.
.INPUTS
    System.Net.IPAddress
.LINK
    https://github.com/jasoth/Utility.PS
#>
function Test-IpAddressInSubnet {
    [CmdletBinding()]
    [OutputType([bool], [string[]])]
    param (
        # IP Address to test against provided subnets.
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 1)]
        [ipaddress[]] $IpAddresses,
        # List of subnets in CIDR notation. For example, "192.168.1.0/24" or "2001:db8:1234::/48".
        [Parameter(Mandatory = $true)]
        [string[]] $Subnets,
        # Return list of matching subnets rather than a boolean result.
        [Parameter(Mandatory = $false)]
        [switch] $ReturnMatchingSubnets
    )

    begin {
        function ConvertBitArrayToByteArray([System.Collections.BitArray] $BitArray) {
            [byte[]] $ByteArray = New-Object byte[] ([System.Math]::Ceiling($BitArray.Length / 8))
            $BitArray.CopyTo($ByteArray, 0)
            return $ByteArray
        }

        function ConvertBitArrayToBigInt([System.Collections.BitArray] $BitArray) {
            return [bigint][byte[]](ConvertBitArrayToByteArray $BitArray)
        }
    }

    process {
        foreach ($IpAddress in $IpAddresses) {
            if ($IpAddress.AddressFamily -eq [System.Net.Sockets.AddressFamily]::InterNetwork) {
                [int32] $bitIpAddress = [BitConverter]::ToInt32($IpAddress.GetAddressBytes(), 0)
            }
            else {
                [System.Collections.BitArray] $bitIpAddress = $IpAddress.GetAddressBytes()
            }

            [System.Collections.Generic.List[string]] $listSubnets = New-Object System.Collections.Generic.List[string]
            [bool] $Result = $false
            foreach ($Subnet in $Subnets) {
                [string[]] $SubnetComponents = $Subnet.Split('/')
                [ipaddress] $SubnetAddress = $SubnetComponents[0]
                [int] $SubnetMaskLength = $SubnetComponents[1]

                if ($IpAddress.AddressFamily -eq $SubnetAddress.AddressFamily) {
                    if ($IpAddress.AddressFamily -eq [System.Net.Sockets.AddressFamily]::InterNetwork) {
                        ## Supports IPv4 (32 bit) only but more performant than BitArray?
                        #[int32] $bitIpAddress = [BitConverter]::ToInt32($IpAddress.GetAddressBytes(), 0)
                        [int32] $bitSubnetAddress = [BitConverter]::ToInt32($SubnetAddress.GetAddressBytes(), 0)
                        [int32] $bitSubnetMaskHostOrder = 0
                        if ($SubnetMaskLength -gt 0) {
                            $bitSubnetMaskHostOrder = -1 -shl (32 - $SubnetMaskLength)
                        }
                        [int32] $bitSubnetMask = [ipaddress]::HostToNetworkOrder($bitSubnetMaskHostOrder)

                        ## Check IP
                        if (($bitIpAddress -band $bitSubnetMask) -eq ($bitSubnetAddress -band $bitSubnetMask)) {
                            if ($ReturnMatchingSubnets) {
                                $listSubnets.Add($Subnet)
                            }
                            else {
                                $Result = $true
                                continue
                            }
                        }
                    }
                    else {
                        ## BitArray supports IPv4 (32 bits) and IPv6 (128 bits). Would Int128 type in .NET 7 improve performance?
                        #[System.Collections.BitArray] $bitIpAddress = $IpAddress.GetAddressBytes()
                        [System.Collections.BitArray] $bitSubnetAddress = $SubnetAddress.GetAddressBytes()
                        [System.Collections.BitArray] $bitSubnetMask = New-Object System.Collections.BitArray -ArgumentList ($bitSubnetAddress.Length - $SubnetMaskLength), $true
                        $bitSubnetMask.Length = $bitSubnetAddress.Length
                        [void]$bitSubnetMask.Not()
                        [byte[]] $ByteArray = ConvertBitArrayToByteArray $bitSubnetMask
                        [array]::Reverse($ByteArray)  # Convert to Network byte order
                        [System.Collections.BitArray] $bitSubnetMask = $ByteArray
                
                        ## Check IP
                        if ((ConvertBitArrayToBigInt $bitIpAddress.And($bitSubnetMask)) -eq (ConvertBitArrayToBigInt $bitSubnetAddress.And($bitSubnetMask))) {
                            if ($ReturnMatchingSubnets) {
                                $listSubnets.Add($Subnet)
                            }
                            else {
                                $Result = $true
                                continue
                            }
                        }
                    }
                }
            }

            ## Return list of matches or boolean result
            if ($ReturnMatchingSubnets) {
                if ($listSubnets.Count -gt 1) { Write-Output $listSubnets.ToArray() -NoEnumerate }
                elseif ($listSubnets.Count -eq 1) { Write-Output $listSubnets.ToArray() }
                else {
                    $Exception = New-Object ArgumentException -ArgumentList ('The IP address {0} does not belong to any of the provided subnets.' -f $IpAddress)
                    Write-Error -Exception $Exception -Category ([System.Management.Automation.ErrorCategory]::ObjectNotFound) -CategoryActivity $MyInvocation.MyCommand -ErrorId 'TestIpAddressInSubnetNoMatch' -TargetObject $IpAddress
                }
            }
            else {
                Write-Output $Result
            }
        }
    }
}

#endregion

#region Test-MgCommandPrerequisites.ps1

<#
.SYNOPSIS
    Test Mg Graph Command Prerequisites
.EXAMPLE
    PS > Test-MgCommandPrerequisites 'Get-MgUser'
.INPUTS
    System.String
#>
function Test-MgCommandPrerequisites {
    [CmdletBinding()]
    [OutputType([bool])]
    param (
        # The name of a command.
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, Position = 1)]
        [Alias('Command')]
        [string[]] $Name,
        # The service API version.
        [Parameter(Mandatory = $false, Position = 2)]
        [ValidateSet('v1.0', 'beta')]
        [string] $ApiVersion = 'beta',
        # Specifies a minimum version.
        [Parameter(Mandatory = $false)]
        [version] $MinimumVersion,
        # Require "list" permissions rather than "get" permissions when Get-Mg* commands are specified.
        [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)]
        [switch] $RequireListPermissions
    )

    begin {
        [version] $MgAuthenticationModuleVersion = $null
        $Assembly = [System.AppDomain]::CurrentDomain.GetAssemblies() | Where-Object FullName -Like "Microsoft.Graph.Authentication,*"
        if ($Assembly.FullName -match "Version=(([0-9]+.[0-9]+.[0-9]+).[0-9]+),") {
            $MgAuthenticationModuleVersion = $Matches[2]
        }
        else {
            $MgAuthenticationModuleVersion = Get-Command 'Connect-MgGraph' -Module 'Microsoft.Graph.Authentication' | Select-Object -ExpandProperty Version
        }
        Write-Debug "Microsoft.Graph.Authentication module version loaded: $MgAuthenticationModuleVersion"
    }

    process {
        ## Initialize
        $result = $true

        ## Get Graph Command Details
        [hashtable] $MgCommandLookup = @{}
        foreach ($CommandName in $Name) {
            [array] $MgCommands = Find-MgGraphCommand -Command $CommandName -ApiVersion $ApiVersion

            $MgCommand = $MgCommands[0]
            if ($MgCommands.Count -gt 1) {
                ## Resolve from multiple results
                [array] $MgCommandsWithPermissions = $MgCommands | Where-Object Permissions -NE $null
                [array] $MgCommandsWithListPermissions = $MgCommandsWithPermissions | Where-Object URI -NotLike "*}"
                [array] $MgCommandsWithGetPermissions = $MgCommandsWithPermissions | Where-Object URI -Like "*}"
                if ($MgCommandsWithListPermissions -and $RequireListPermissions) {
                    $MgCommand = $MgCommandsWithListPermissions[0]
                }
                elseif ($MgCommandsWithGetPermissions) {
                    $MgCommand = $MgCommandsWithGetPermissions[0]
                }
                else {
                    $MgCommand = $MgCommands[0]
                }
            }

            $MgCommandLookup[$MgCommand.Command] = $MgCommand
        }

        ## Import Required Modules
        [string[]] $MgModules = @()
        foreach ($MgCommand in $MgCommandLookup.Values) {
            if (!$MgModules.Contains($MgCommand.Module)) {
                $MgModules += $MgCommand.Module
                [string] $ModuleName = "Microsoft.Graph.$($MgCommand.Module)"
                try {
                    if ($MgAuthenticationModuleVersion -lt $MinimumVersion) {
                        ## Check for newer module but load will likely fail due to old Microsoft.Graph.Authentication module
                        try {
                            Import-Module $ModuleName -MinimumVersion $MinimumVersion -Scope Global -ErrorAction Stop -Verbose:$false
                        }
                        catch [System.IO.FileLoadException] {
                            $result = $false
                            Write-Error -Exception $_.Exception -Category ResourceUnavailable -ErrorId 'MgModuleOutOfDate' -Message ("The module '{0}' with minimum version '{1}' was found but currently loaded 'Microsoft.Graph.Authentication' module is version '{2}'. To resolve, try opening a new PowerShell session and running the command again." -f $ModuleName, $MinimumVersion, $MgAuthenticationModuleVersion) -TargetObject $ModuleName -RecommendedAction ("Import-Module {0} -MinimumVersion '{1}'" -f $ModuleName, $MinimumVersion)
                        }
                        catch [System.IO.FileNotFoundException] {
                            $result = $false
                            Write-Error -Exception $_.Exception -Category ResourceUnavailable -ErrorId 'MgModuleWithVersionNotFound' -Message ("The module '{0}' with minimum version '{1}' not found. To resolve, try installing module '{0}' with the latest version. For example: Install-Module {0} -MinimumVersion '{1}'" -f $ModuleName, $MinimumVersion) -TargetObject $ModuleName -RecommendedAction ("Install-Module {0} -MinimumVersion '{1}'" -f $ModuleName, $MinimumVersion)
                        }
                    }
                    else {
                        ## Load module to match currently loaded Microsoft.Graph.Authentication module
                        try {
                            Import-Module $ModuleName -RequiredVersion $MgAuthenticationModuleVersion -Scope Global -ErrorAction Stop -Verbose:$false
                        }
                        catch [System.IO.FileLoadException] {
                            $result = $false
                            Write-Error -Exception $_.Exception -Category ResourceUnavailable -ErrorId 'MgModuleOutOfDate' -Message ("The module '{0}' was found but is not a compatible version. To resolve, try updating module '{0}' to version '{1}' to match currently loaded modules. For example: Update-Module {0} -RequiredVersion '{1}'" -f $ModuleName, $MgAuthenticationModuleVersion) -TargetObject $ModuleName -RecommendedAction ("Update-Module {0} -RequiredVersion '{1}'" -f $ModuleName, $MgAuthenticationModuleVersion)
                        }
                        catch [System.IO.FileNotFoundException] {
                            $result = $false
                            Write-Error -Exception $_.Exception -Category ResourceUnavailable -ErrorId 'MgModuleWithVersionNotFound' -Message ("The module '{0}' with version '{1}' not found. To resolve, try installing module '{0}' with version '{1}' to match currently loaded modules. For example: Install-Module {0} -RequiredVersion '{1}'" -f $ModuleName, $MgAuthenticationModuleVersion) -TargetObject $ModuleName -RecommendedAction ("Install-Module {0} -RequiredVersion '{1}'" -f $ModuleName, $MgAuthenticationModuleVersion)
                        }
                    }
                }
                catch {
                    $result = $false
                    Write-Error -ErrorRecord $_
                }
            }
        }
        Write-Verbose ('Required Microsoft Graph Modules: {0}' -f (($MgModules | ForEach-Object { "Microsoft.Graph.$_" }) -join ', '))

        ## Check MgModule Connection
        $MgContext = Get-MgContext
        if ($MgContext) {
            if ($MgContext.AuthType -eq 'Delegated') {
                ## Check MgModule Consented Scopes
                foreach ($MgCommand in $MgCommandLookup.Values) {
                    if ($MgCommand.Permissions -and (!$MgContext.Scopes -or !(Compare-Object $MgCommand.Permissions.Name -DifferenceObject $MgContext.Scopes -ExcludeDifferent -IncludeEqual))) {
                        $Exception = New-Object System.Security.SecurityException -ArgumentList "Additional scope required for command '$($MgCommand.Command)', call Connect-MgGraph with one of the following scopes: $($MgCommand.Permissions.Name -join ', ')"
                        Write-Error -Exception $Exception -Category ([System.Management.Automation.ErrorCategory]::PermissionDenied) -ErrorId 'MgScopePermissionRequired'
                        $result = $false
                    }
                }
            }
            else {
                ## Check MgModule Consented Scopes
                foreach ($MgCommand in $MgCommandLookup.Values) {
                    if ($MgCommand.Permissions -and (!$MgContext.Scopes -or !(Compare-Object $MgCommand.Permissions.Name -DifferenceObject $MgContext.Scopes -ExcludeDifferent -IncludeEqual))) {
                        Write-Warning "Additional scope may be required for command '$($MgCommand.Command), add and consent ClientId '$($MgContext.ClientId)' to one of the following app scopes: $($MgCommand.Permissions.Name -join ', ')"
                    }
                }
            }
        }
        else {
            $Exception = New-Object System.Security.Authentication.AuthenticationException -ArgumentList "Authentication needed, call Connect-MgGraph."
            Write-Error -Exception $Exception -Category ([System.Management.Automation.ErrorCategory]::AuthenticationError) -CategoryReason 'AuthenticationException' -ErrorId 'MgAuthenticationRequired'
            $result = $false
        }

        return $result
    }
}

#endregion

#region Test-MgModulePrerequisites.ps1

<#
.SYNOPSIS
    Test Mg Graph Module Prerequisites
.EXAMPLE
    PS > Test-MgModulePrerequisites 'CrossTenantInformation.ReadBasic.All'
.INPUTS
    System.String
#>
function Test-MgModulePrerequisites {
    [CmdletBinding()]
    [OutputType([bool])]
    param (
        # The name of scope
        [Parameter(Mandatory = $false, ValueFromPipeline = $true)]
        [Alias('Permission')]
        [string[]] $Scope
    )

    process {
        ## Initialize
        $result = $true
        
        ## Check MgModule Connection
        $MgContext = Get-MgContext
        if ($MgContext) {
            if ($Scope) {
                ## Check MgModule Consented Scopes
                [string[]] $ScopesMissing = Compare-Object $Scope -DifferenceObject $MgContext.Scopes | Where-Object SideIndicator -EQ '<=' | Select-Object -ExpandProperty InputObject
                if ($ScopesMissing) {
                    $Exception = New-Object System.Security.SecurityException -ArgumentList "Additional scope(s) needed, call Connect-MgGraph with all of the following scopes: $($ScopesMissing -join ', ')"
                    Write-Error -Exception $Exception -Category ([System.Management.Automation.ErrorCategory]::PermissionDenied) -ErrorId 'MgScopePermissionRequired' -RecommendedAction ("Connect-MgGraph -Scopes $($ScopesMissing -join ',')")
                    $result = $false
                }
            }
        }
        else {
            $Exception = New-Object System.Security.Authentication.AuthenticationException -ArgumentList "Authentication needed, call Connect-MgGraph."
            Write-Error -Exception $Exception -Category ([System.Management.Automation.ErrorCategory]::AuthenticationError) -CategoryReason 'AuthenticationException' -ErrorId 'MgAuthenticationRequired'
            $result = $false
        }

        return $result
    }
}

#endregion

#region Test-PsElevation.ps1

<#
.SYNOPSIS
    Test if current PowerShell process is elevated to local administrator privileges.
.DESCRIPTION
    Test if current PowerShell process is elevated to local administrator privileges.
.EXAMPLE
    PS C:\>Test-PsElevation
    Test is current PowerShell process is elevated.
.LINK
    https://github.com/jasoth/Utility.PS
#>
function Test-PsElevation {
    [CmdletBinding()]
    [OutputType([bool])]
    param()

    try {
        $WindowsIdentity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
        $WindowsPrincipal = New-Object 'System.Security.Principal.WindowsPrincipal' $WindowsIdentity
        $LocalAdministrator = [System.Security.Principal.WindowsBuiltInRole]::Administrator
        return $WindowsPrincipal.IsInRole($LocalAdministrator)
    }
    catch { 
        if ($_.Exception.InnerException) {
            Write-Error -Exception $_.Exception.InnerException -Category $_.CategoryInfo.Category -CategoryActivity $_.CategoryInfo.Activity -ErrorId $_.FullyQualifiedErrorId -TargetObject $_.TargetObject
        }
        else { Write-Error -ErrorRecord $_ }
    }
}

#endregion

#region Write-HostPrompt.ps1

<#
.SYNOPSIS
    Displays a PowerShell prompt for multiple fields or multiple choices.
.DESCRIPTION
    Displays a PowerShell prompt for multiple fields or multiple choices.
.EXAMPLE
    PS C:\>Write-HostPrompt "Prompt Caption" -Fields "Field 1", "Field 2"
    Display simple prompt for 2 fields.
.EXAMPLE
    PS C:\>$IntegerField = New-Object System.Management.Automation.Host.FieldDescription -ArgumentList "Integer Field" -Property @{ HelpMessage = "Help Message for Integer Field" }
    PS C:\>$IntegerField.SetParameterType([int[]])
    PS C:\>$DateTimeField = New-Object System.Management.Automation.Host.FieldDescription -ArgumentList "DateTime Field" -Property @{ HelpMessage = "Help Message for DateTime Field" }
    PS C:\>$DateTimeField.SetParameterType([datetime])
    PS C:\>Write-HostPrompt "Prompt Caption" "Prompt Message" -Fields $IntegerField, $DateTimeField
    Display prompt for 2 type-specific fields, with int field being an array.
.EXAMPLE
    PS C:\>Write-HostPrompt "Prompt Caption" -Choices "Choice &1", "Choice &2"
    Display simple prompt with 2 choices.
.EXAMPLE
    PS C:\>Write-HostPrompt "Prompt Caption" "Prompt Message" -DefaultChoice 2 -Choices @(
        New-Object System.Management.Automation.Host.ChoiceDescription -ArgumentList "&1`bChoice one" -Property @{ HelpMessage = "Help Message for Choice 1" }
        New-Object System.Management.Automation.Host.ChoiceDescription -ArgumentList "&2`bChoice two" -Property @{ HelpMessage = "Help Message for Choice 2" }
    )
    Display prompt with 2 choices and help messages that defaults to the second choice.
.EXAMPLE
    PS C:\>Write-HostPrompt "Prompt Caption" "Choose a number" -Choices "Menu Item A", "Menu Item B", "Menu Item C" -HelpMessages "Menu Item A Needs Help", "Menu Item B Needs More Help",, "Menu Item C Needs Crazy Help" -NumberedHotKeys
    Display prompt with 3 choices and help message that are automatically numbered.
.INPUTS
    System.Management.Automation.Host.FieldDescription
    System.Management.Automation.Host.ChoiceDescription
.OUTPUTS
    System.Collections.Generic.Dictionary[System.String,System.Management.Automation.PSObject]
    System.Int32
.LINK
    https://github.com/jasoth/Utility.PS
#>
function Write-HostPrompt {
    [CmdletBinding()]
    param
    (
        # Caption to preceed or title the prompt.
        [Parameter(Mandatory = $true, Position = 1)]
        [string] $Caption,
        # A message that describes the prompt.
        [Parameter(Mandatory = $false, Position = 2)]
        [string] $Message,
        # The fields in the prompt.
        [Parameter(Mandatory = $true, ParameterSetName = 'Fields', Position = 3, ValueFromPipeline = $true)]
        [System.Management.Automation.Host.FieldDescription[]] $Fields,
        # The choices the shown in the prompt.
        [Parameter(Mandatory = $true, ParameterSetName = 'Choices', Position = 3, ValueFromPipeline = $true)]
        [System.Management.Automation.Host.ChoiceDescription[]] $Choices,
        # Specifies a help message for each field or choice.
        [Parameter(Mandatory = $false, Position = 4)]
        [string[]] $HelpMessages = @(),
        # The index of the label in the choices to make default.
        [Parameter(Mandatory = $false, ParameterSetName = 'Choices', Position = 5)]
        [int] $DefaultChoice,
        # Use numbered hot keys (aka "keyboard accelerator") for each choice.
        [Parameter(Mandatory = $false, ParameterSetName = 'Choices', Position = 6)]
        [switch] $NumberedHotKeys
    )

    begin {
        ## Create list to capture multiple fields or multiple choices.
        [System.Collections.Generic.List[System.Management.Automation.Host.FieldDescription]] $listFields = New-Object System.Collections.Generic.List[System.Management.Automation.Host.FieldDescription]
        [System.Collections.Generic.List[System.Management.Automation.Host.ChoiceDescription]] $listChoices = New-Object System.Collections.Generic.List[System.Management.Automation.Host.ChoiceDescription]
    }

    process {
        switch ($PSCmdlet.ParameterSetName) {
            'Fields' {
                for ($iField = 0; $iField -lt $Fields.Count; $iField++) {
                    if ($iField -lt $HelpMessages.Count -and $HelpMessages[$iField]) { $Fields[$iField].HelpMessage = $HelpMessages[$iField] }
                    $listFields.Add($Fields[$iField])
                }
            }
            'Choices' {
                for ($iChoice = 0; $iChoice -lt $Choices.Count; $iChoice++) {
                    if ($NumberedHotKeys) { $Choices[$iChoice] = New-Object System.Management.Automation.Host.ChoiceDescription -ArgumentList "&$($iChoice+1)`b$($Choices[$iChoice].Label)" -Property @{ HelpMessage = $Choices[$iChoice].HelpMessage } }
                    #elseif (!$Choices[$iChoice].Label.Contains('&')) { $Choices[$iChoice] = New-Object System.Management.Automation.Host.ChoiceDescription -ArgumentList "&$($Choices[$iChoice].Label)" -Property @{ HelpMessage = $Choices[$iChoice].HelpMessage } }
                    if ($iChoice -lt $HelpMessages.Count -and $HelpMessages[$iChoice]) { $Choices[$iChoice].HelpMessage = $HelpMessages[$iChoice] }
                    $listChoices.Add($Choices[$iChoice])
                }
            }
        }
    }

    end {
        try {
            switch ($PSCmdlet.ParameterSetName) {
                'Fields' { return $Host.UI.Prompt($Caption, $Message, $listFields.ToArray()) }
                'Choices' { return $Host.UI.PromptForChoice($Caption, $Message, $listChoices.ToArray(), $DefaultChoice - 1) + 1 }
            }
        }
        catch [System.Management.Automation.PSInvalidOperationException] {
            ## Write Non-Terminating Error When In Non-Interactive Mode.
            Write-Error -ErrorRecord $_ -CategoryActivity $MyInvocation.MyCommand
        }
    }
}

#endregion

#region Add-MsIdServicePrincipal.ps1

<#
.SYNOPSIS
    Create service principal for existing application registration

.EXAMPLE
    PS > Add-MsIdServicePrincipal 10000000-0000-0000-0000-000000000001

    Create service principal for existing appId, 10000000-0000-0000-0000-000000000001.

.INPUTS
    System.String

#>
function Add-MsIdServicePrincipal {
    [CmdletBinding()]
    [OutputType([object])]
    param (
        # AppID of Application
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 1)]
        [string[]] $AppId
    )

    begin {
        ## Initialize Critical Dependencies
        $CriticalError = $null
        if (!(Test-MgCommandPrerequisites 'New-MgServicePrincipal' -MinimumVersion 2.8.0 -ErrorVariable CriticalError)) { return }
    }

    process {
        if ($CriticalError) { return }

        foreach ($_AppId in $AppId) {
            ## Create Service Principal from Application Registration
            New-MgServicePrincipal -AppId $_AppId
        }
    }
}

#endregion

#region Confirm-MsIdJwtTokenSignature.ps1

<#
.SYNOPSIS
    Validate the digital signature for JSON Web Token.

.EXAMPLE
    PS > Confirm-MsIdJwtTokenSignature $OpenIdConnectToken

    Validate the OpenId token was signed by token issuer based on the OIDC Provider Configuration for token issuer.

.EXAMPLE
    PS > Confirm-MsIdJwtTokenSignature $AccessToken

    Validate the access token was signed by token issuer based on the OIDC Provider Configuration for token issuer.

.INPUTS
    System.String
    
#>
function Confirm-MsIdJwtTokenSignature {
    [CmdletBinding()]
    [Alias('Confirm-JwtSignature')]
    [OutputType([bool])]
    param (
        # JSON Web Token (JWT)
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [string[]] $Tokens
    )

    process {
        foreach ($Token in $Tokens) {
            $Jws = ConvertFrom-JsonWebSignature $Token
            $SigningKeys = $Jws.Payload.iss | Get-OpenIdProviderConfiguration -Keys | Where-Object use -EQ 'sig'
            $SigningKey = $SigningKeys | Where-Object kid -EQ $Jws.Header.kid
            $SigningCertificate = Get-X509Certificate $SigningKey.x5c

            Confirm-JsonWebSignature $Token -SigningCertificate $SigningCertificate
        }
    }
}

#endregion

#region ConvertFrom-MsIdAadcAadConnectorSpaceDn.ps1

<#
.SYNOPSIS
    Convert Azure AD connector space object Distinguished Name (DN) in AAD Connect

.EXAMPLE
    PS > ConvertFrom-MsIdAadcAadConnectorSpaceDn 'CN={414141414141414141414141414141414141414141413D3D}'

    Convert Azure AD connector space object DN in AAD Connect to sourceAnchor and sourceGuid.

.EXAMPLE
    PS > 'CN={4F626A656374547970655F30303030303030302D303030302D303030302D303030302D303030303030303030303030}' | ConvertFrom-MsIdAadcAadConnectorSpaceDn
    
    Convert Azure AD connector space object DN in AAD Connect to cloudAnchor and cloudGuid.

.INPUTS
    System.String
    
#>
function ConvertFrom-MsIdAadcAadConnectorSpaceDn {
    [CmdletBinding()]
    [OutputType([PSCustomObject])]
    param (
        # Azure AD Connector Space DN from AAD Connect
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 0)]
        [string] $InputObject
    )

    process {
        ## Extract Hex String
        if ($InputObject -imatch '(?:CN=)?\{?([0-9a-f]+)\}?') {
            [string] $HexString = $Matches[1]
        }
        else {
            [string] $HexString = $InputObject
        }

        ## Decode Hex String
        [string] $DecodedString = ConvertFrom-HexString $HexString
        if ($DecodedString -imatch '([a-z]+)_([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})') {
            [guid] $CloudGuid = $Matches[2]
            $Result = [PSCustomObject]@{
                cloudAnchor = $DecodedString
                cloudGuid   = $CloudGuid
            }
        }
        else {
            [guid] $SourceGuid = ConvertFrom-Base64String $DecodedString -RawBytes
            $Result = [PSCustomObject]@{
                sourceAnchor = $DecodedString
                sourceGuid   = $SourceGuid
            }
        }

        Write-Output $Result
    }
}

#endregion

#region ConvertFrom-MsIdAadcSourceAnchor.ps1

<#
.SYNOPSIS
    Convert Azure AD Connect metaverse object sourceAnchor or Azure AD ImmutableId to sourceGuid.
    
.EXAMPLE
    PS > ConvertFrom-MsIdAadcSourceAnchor 'AAAAAAAAAAAAAAAAAAAAAA=='

    Convert Azure AD Connect metaverse object sourceAnchor base64 format to sourceGuid.

.EXAMPLE
    PS > ConvertFrom-MsIdAadcSourceAnchor '00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'

    Convert Azure AD Connect metaverse object sourceAnchor hex format to sourceGuid.

.INPUTS
    System.String

#>
function ConvertFrom-MsIdAadcSourceAnchor {
    [CmdletBinding()]
    [Alias('ConvertFrom-MsIdAzureAdImmutableId')]
    [OutputType([guid], [string])]
    param (
        # Azure AD Connect metaverse object sourceAnchor.
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 0)]
        [string] $InputObject
    )

    process {
        if ($InputObject -imatch '(?:^|,)((?:[0-9a-f]{2} ?)+)(?:$|,)') {
            [guid] $SourceGuid = ConvertFrom-HexString $Matches[1].Trim() -RawBytes
        }
        elseif ($InputObject -imatch '(?:^|,)([0-9a-z+/=]+=+)(?:$|,)') {
            [guid] $SourceGuid = ConvertFrom-Base64String $Matches[1] -RawBytes
        }
        else {
            [guid] $SourceGuid = ConvertFrom-Base64String $InputObject -RawBytes
        }

        Write-Output $SourceGuid
    }
}

#endregion

#region ConvertFrom-MsIdUniqueTokenIdentifier.ps1

<#
.SYNOPSIS
    Convert Azure AD Unique Token Identifier to Request Id.
    
.EXAMPLE
    PS > ConvertFrom-MsIdUniqueTokenIdentifier 'AAAAAAAAAAAAAAAAAAAAAA'

    Convert Azure AD Unique Token Identifier to Request Id.

.EXAMPLE
    PS > Get-MgBetaAuditLogSignIn -Top 1 | ConvertFrom-MsIdUniqueTokenIdentifier

    Get a Sign-in Log Entry and Convert Azure AD Unique Token Identifier to Request Id.

.INPUTS
    System.String

#>
function ConvertFrom-MsIdUniqueTokenIdentifier {
    [CmdletBinding()]
    [OutputType([guid])]
    param (
        # Azure AD Unique Token Identifier
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
        [ValidateLength(22,22)]
        [Alias("UniqueTokenIdentifier")]
        [string] $InputObject
    )

    process {
        [guid] $SourceGuid = ConvertFrom-Base64String $InputObject -Base64Url -RawBytes
        return $SourceGuid
    }
}

#endregion

#region ConvertFrom-MsIdJwtToken.ps1

<#
.SYNOPSIS
    Convert Msft Identity token structure to PowerShell object.

.EXAMPLE
    PS > ConvertFrom-MsIdJwtToken $OpenIdConnectToken

    Convert OAuth Id Token JWS to PowerShell object.

.EXAMPLE
    PS > ConvertFrom-MsIdJwtToken $AccessToken

    Convert OAuth Access Token JWS to PowerShell object.

.INPUTS
    System.String
    
#>
function ConvertFrom-MsIdJwtToken {
    [CmdletBinding()]
    [OutputType([PSCustomObject])]
    param (
        # JSON Web Token (JWT)
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [string[]] $Tokens
    )

    process {
        foreach ($Token in $Tokens) {
            ConvertFrom-JsonWebSignature $Token
        }
    }
}

#endregion

#region ConvertFrom-MsIdSamlMessage.ps1

<#
.SYNOPSIS
    Convert SAML Message structure to PowerShell object.

.EXAMPLE
    PS > ConvertFrom-MsIdSamlMessage 'Base64String'

    Convert Saml Message to XML object.

.INPUTS
    System.String

.OUTPUTS
    SamlMessage : System.Xml.XmlDocument
    
#>
function ConvertFrom-MsIdSamlMessage {
    [CmdletBinding()]
    [Alias('ConvertFrom-MsIdSamlRequest')]
    [Alias('ConvertFrom-MsIdSamlResponse')]
    #[OutputType([xml])]
    param (
        # SAML Message
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [string[]] $InputObject
    )

    process {
        foreach ($_InputObject in $InputObject) {
            ConvertFrom-SamlMessage $_InputObject
        }
    }
}

#endregion

#region Expand-MsIdJwtTokenPayload.ps1

<#
.SYNOPSIS
    Extract Json Web Token (JWT) payload from JWS structure to PowerShell object.

.EXAMPLE
    PS > $MsalToken.IdToken | Expand-MsIdJwtTokenPayload

    Extract Json Web Token (JWT) payload from JWS structure to PowerShell object.

.INPUTS
    System.String
    
#>
function Expand-MsIdJwtTokenPayload {
    [CmdletBinding()]
    [OutputType([PSCustomObject])]
    param (
        # JSON Web Token (JWT)
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [string[]] $Tokens
    )

    process {
        foreach ($Token in $Tokens) {
            $Jwt = ConvertFrom-JsonWebSignature $Token
            Write-Output $Jwt.Payload
        }
    }
}

#endregion

#region Find-MsIdUnprotectedUsersWithAdminRoles.ps1

<#
.SYNOPSIS
    Find Users with Admin Roles that are not registered for MFA
.DESCRIPTION
    Find Users with Admin Roles that are not registered for MFA by evaluating their authentication methods registered for MFA and their sign-in activity.
.EXAMPLE
    PS > Find-MsIdUnprotectedUsersWithAdminRoles

    Enumerate users with role assignments
.EXAMPLE
    PS > Find-MsIdUnprotectedUsersWithAdminRoles -includeSignIns:$false

    Enumerate users with role assignments including their sign in activity
.NOTES
     - Eligible users for roles may not have active assignments showing in their directoryrolememberships, but they have the potential to elevate to assigned roles
     - Large amounts of role assignments may take time process.
     - Must be connected to MS Graph with appropriate scopes for reading user, group, application, role, an sign in information .
      -- Connect-MgGraph -scopes RoleManagement.Read.Directory,UserAuthenticationMethod.Read.All,AuditLog.Read.All,User.Read.All,Group.Read.All,Application.Read.All
#>
function Find-MsIdUnprotectedUsersWithAdminRoles {
    [CmdletBinding()]
    [OutputType([string])]
    param (
        # Include Sign In log activity - Note this can cause the query to run slower in larger active environments
        [switch] $IncludeSignIns
    )

    begin {
        ## Initialize Critical Dependencies
        $CriticalError = $null
        if (!(Test-MgCommandPrerequisites 'Get-MgUser', 'Get-MgUserAuthenticationMethod', 'Get-MgGroupMember', 'Get-MgRoleManagementDirectoryRoleDefinition', 'Get-MgRoleManagementDirectoryRoleAssignmentSchedule', 'Get-MgRoleManagementDirectoryRoleEligibilitySchedule', 'Get-MgAuditLogSignIn' -ApiVersion beta -MinimumVersion 2.8.0 -RequireListPermissions -ErrorVariable CriticalError)) { return }


        if ($VerbosePreference -eq 'SilentlyContinue') {
            Write-Host "NOTE: This process may take awhile depending on the size of the environment. Please run with -Verbose switch for more details progress output."
        }

    }

    process {
        if ($CriticalError) { return }

        [array]$usersWithRoles = Get-UsersWithRoleAssignments

        $TotalUsersCount = $usersWithRoles.count
        Write-Verbose ("Checking {0} users with roles..." -f $TotalUsersCount)

        [array]$checkedUsers = @()
        $checkUsersCount = 0

        foreach ($user in $usersWithRoles) {

            $checkUsersCount++

            $userObject = $null
            try {
                $userObject = Get-MgUser -UserId $user.PrincipalId -Property signInActivity, UserPrincipalName, Id
            }
            catch {
                Write-Warning ("User object with UserId {0} with a role assignment was not found! Review assignment for orphaned user." -f $user.PrincipalId)
            }

            Write-Verbose ("User {0} of {1} - Evaluating {2} with role assignments...." -f $checkUsersCount, $TotalUsersCount, $userObject.Id)

            if ($Null -ne $userObject) {
                $UserAuthMethodStatus = Get-UserMfaRegisteredStatus -UserId $userObject.UserPrincipalName

                $checkedUser = [ordered] @{}
                $checkedUser.UserID = $userObject.Id
                $checkedUser.UserPrincipalName = $userObject.UserPrincipalName

                If ($null -eq $userObject.signInActivity.LastSignInDateTime) {
                    $checkedUser.LastSignInDateTime = "Unknown"
                    $checkedUser.LastSigninDaysAgo = "Unknown"
                }
                else {
                    $checkedUser.LastSignInDateTime = $userObject.signInActivity.LastSignInDateTime
                    $checkedUser.LastSigninDaysAgo = (New-TimeSpan -Start $checkedUser.LastSignInDateTime -End (Get-Date)).Days
                }
                $checkedUser.DirectoryRoleAssignments = $user.RoleName
                $checkedUser.DirectoryRoleAssignmentType = $user.AssignmentType
                $checkedUser.DirectoryRoleAssignmentCount = $user.RoleName.count
                $checkedUser.RoleAssignedBy = $user.RoleAssignedBy
                $checkedUser.IsMfaRegistered = $UserAuthMethodStatus.isMfaRegistered
                $checkedUser.Status = $UserAuthMethodStatus.Status

                if ($includeSignIns -eq $true) {
                    $signInInfo = Get-UserSignInSuccessHistoryAuth -userId $checkedUser.UserId

                    $checkedUser.SuccessSignIns = $signInInfo.SuccessSignIns
                    $checkedUser.MultiFactorSignIns = $signInInfo.MultiFactorSignIns
                    $checkedUser.SingleFactorSignIns = $signInInfo.SingleFactorSignIns
                    $checkedUser.RiskySignIns = $signInInfo.RiskySignIns
                }
                else {
                    $checkedUser.SuccessSignIns = "Skipped"
                    $checkedUser.MultiFactorSignIns = "Skipped"
                    $checkedUser.SingleFactorSignIns = "Skipped"
                    $checkedUser.RiskySignIns = "Skipped"
                }
                $checkedUsers += ([pscustomobject]$checkedUser)
            }
            else {

                $checkedUser = [ordered] @{}
                $checkedUser.UserID = $userObject.Id
                $checkedUser.Status = "Not Exists"

            }
        }

    }

    end {
        if ($CriticalError) { return }

        Write-Verbose ("{0} Users Evaluated!" -f $checkedUsers.count)
        Write-Verbose ("{0} Users with roles who are NOT registered for MFA!" -f ($checkedUsers | Where-Object -FilterScript { $_.isMfaRegistered -eq $false }).count)
        Write-Output $checkedUsers
    }
}

function Get-UserMfaRegisteredStatus ([string]$UserId) {

    $mfaMethods = @("#microsoft.graph.fido2AuthenticationMethod", "#microsoft.graph.softwareOathAuthenticationMethod", "#microsoft.graph.microsoftAuthenticatorAuthenticationMethod", "#microsoft.graph.windowsHelloForBusinessAuthenticationMethod", "#microsoft.graph.phoneAuthenticationMethod")

    $results = [pscustomobject]@{
        IsMfaRegistered = $null
        AuthMethodsRegistered = $null
        status = $null
    }

    try {
        $authMethods = (Get-MgUserAuthenticationMethod -UserId $UserId).AdditionalProperties."@odata.type"

        $isMfaRegistered = $false
        foreach ($mfa in $MfaMethods) { if ($authmethods -contains $mfa) { $isMfaRegistered = $true } }

        $results.IsMfaRegistered = $isMfaRegistered
        $results.AuthMethodsRegistered = $authMethods
        $results.status = "Checked"

    }
    catch {
        $results.status = "Unknown"
    }

    Write-Output $results

}

function Get-UserSignInSuccessHistoryAuth ([string]$userId) {

    $signinAuth = @{}
    $signinAuth.UserID = $userId
    $signinAuth.SuccessSignIns = 0
    $signinAuth.MultiFactorSignIns = 0
    $signinAuth.SingleFactorSignIns = 0
    $signInAuth.RiskySignIns = 0

    $filter = ("UserId eq '{0}' and status/errorCode eq 0" -f $userId)
    Write-Debug $filter
    [array]$signins = Get-MgAuditLogSignIn -Filter $filter -all:$True
    Write-Debug $signins.count

    if ($signins.count -gt 0) {

        $signinAuth.SuccessSignIns = $signins.count
        $groupedAuth = $signins | Group-Object -Property AuthenticationRequirement

        $MfaSignInsCount = 0
        $MfaSignInsCount = $groupedAuth | Where-Object -FilterScript { $_.Name -eq 'multiFactorAuthentication' } | Select-Object -ExpandProperty count
        if ($null -eq $MfaSignInsCount) {
            $MfaSignInsCount = 0
        }
        $signinAuth.MultiFactorSignIns = $MfaSignInsCount

        $singleFactorSignInsCount = 0
        $singleFactorSignInsCount = $groupedAuth | Where-Object -FilterScript { $_.Name -eq 'singleFactorAuthentication' } | Select-Object -ExpandProperty count


        if ($null -eq $singleFactorSignInsCount) {
            $singleFactorSignInsCount = 0
        }
        $signinAuth.SingleFactorSignIns = $singleFactorSignInsCount

        $signInAuth.RiskySignIns = ($signins | Where-Object -FilterScript { $_.RiskLevelDuringSignIn -ne 'none' } | Measure-Object | Select-Object -ExpandProperty Count)

    }

    Write-Output ([pscustomobject]$signinAuth)
}

function Get-UsersWithRoleAssignments() {
    [array]$uniquePrincipals = $null
    [array]$usersWithRoles = $Null
    [array]$groupsWithRoles = $null
    [array]$servicePrincipalsWithRoles = $null
    [array]$roleAssignments = @()
    [array]$activeRoleAssignments = $null
    [array]$eligibleRoleAssignments = $null
    [array]$AssignmentSchedule = @()

    Write-Verbose "Retrieving Active Role Assignments..."
    [array]$activeRoleAssignments = Get-MgRoleManagementDirectoryRoleAssignmentSchedule -All:$true -ExpandProperty Principal | Add-Member -MemberType NoteProperty -Name AssignmentScope -Value "Active" -Force -PassThru | Add-Member -MemberType ScriptProperty -Name PrincipalType -Value { $this.Principal.AdditionalProperties."@odata.type".split('.')[2] } -Force -PassThru
    Write-Verbose ("{0} Active Role Assignments..." -f $activeRoleAssignments.count)
    $AssignmentSchedule += $activeRoleAssignments

    Write-Verbose "Retrieving Eligible Role Assignments..."
    [array]$eligibleRoleAssignments = Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All:$true -ExpandProperty Principal | Add-Member -MemberType NoteProperty -Name AssignmentScope -Value "Eligible" -Force -PassThru | Add-Member -MemberType ScriptProperty -Name PrincipalType -Value { $this.Principal.AdditionalProperties."@odata.type".split('.')[2] } -Force -PassThru
    Write-Verbose ("{0} Eligible Role Assignments..." -f $eligibleRoleAssignments.count)
    $AssignmentSchedule += $eligibleRoleAssignments

    Write-Verbose ("{0} Total Role Assignments to all principals..." -f $AssignmentSchedule.count)
    [array]$uniquePrincipals = $AssignmentSchedule.PrincipalId | Get-Unique
    Write-Verbose ("{0} Total Role Assignments to unique principals..." -f $uniquePrincipals.count)

    foreach ($type in ($AssignmentSchedule | Group-Object PrincipalType)) {
        Write-Verbose ("{0} assignments to {1} type" -f $type.count, $type.name)
    }

    foreach ($assignment in ($AssignmentSchedule)) {

        if ($assignment.PrincipalType -eq 'user') {
            $roleAssignment = @{}
            $roleAssignment.PrincipalId = $assignment.PrincipalId
            $roleAssignment.PrincipalType = $assignment.PrincipalType
            $roleAssignment.AssignmentType = $assignment.AssignmentScope
            $roleAssignment.RoleDefinitionId = $assignment.RoleDefinitionId
            $roleAssignment.RoleAssignedBy = "user"
            $roleAssignment.RoleName = [array](Get-MgRoleManagementDirectoryRoleDefinition -UnifiedRoleDefinitionId $assignment.RoleDefinitionId | Select-Object -ExpandProperty displayName)
            $roleAssignments += ([pscustomobject]$roleAssignment)
        }

        if ($assignment.PrincipalType -eq 'group') {
            Write-Verbose ("Expanding Group Members for Role Assignable Group {0}" -f $assignment.PrincipalId)
            $groupMembers = Get-MgGroupMember -GroupId $assignment.PrincipalId | Select-Object -ExpandProperty Id

            [array]$RoleName = Get-MgRoleManagementDirectoryRoleDefinition -UnifiedRoleDefinitionId $assignment.RoleDefinitionId | Select-Object -ExpandProperty displayName

            foreach ($member in $groupMembers) {
                Write-Verbose ("Adding Group Member {0} for Role Assignable Group {0}" -f $member, $assignment.PrincipalId)

                $roleAssignment = @{}
                $roleAssignment.PrincipalId = $member
                $roleAssignment.PrincipalType = "user"
                $roleAssignment.AssignmentType = $assignment.AssignmentScope
                $roleAssignment.RoleDefinitionId = $assignment.RoleDefinitionId
                $roleAssignment.RoleAssignedBy = "group"
                $roleAssignment.RoleName = $RoleName
                $roleAssignments += ([pscustomobject]$roleAssignment)

            }
        }

    }

    [array]$usersWithRoles = $roleAssignments | Where-Object -FilterScript { $_.PrincipalType -eq 'user' }
    Write-Verbose ("{0} Total Role Assignments to Users" -f $usersWithRoles.count)

    Write-Output $usersWithRoles
}

#endregion

#region Get-MsIdProvisioningLogStatistics.ps1

<#
.SYNOPSIS
    Get Statistics for Set of Azure AD Provisioning Logs

.EXAMPLE
    PS > Get-MgAuditLogProvisioning -Filter "jobId eq '<jobId>'" | Get-MsIdProvisioningLogStatistics -SummarizeByCycleId -WriteToConsole

    Get Statistics for Set of Azure AD Provisioning Logs

#>
function Get-MsIdProvisioningLogStatistics {
    [CmdletBinding()]
    param (
        # Provisioning Logs
        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
        [object[]] $ProvisioningLogs,
        # Summarize Logs by CycleId
        [Parameter(Mandatory = $false)]
        [switch] $SummarizeByCycleId,
        # Write Summary to Host Console in addition to Standard Output
        [Parameter(Mandatory = $false)]
        [switch] $WriteToConsole
    )

    begin {
        function New-CycleSummary ($CycleId) {
            return [pscustomobject][ordered]@{
                CycleId          = $CycleId
                StartDateTime    = $null
                EndDateTime      = $null
                Changes          = 0
                Users            = 0
                ActionStatistics = @(
                    New-ActionStatusStatistics 'Create'
                    New-ActionStatusStatistics 'Update'
                    New-ActionStatusStatistics 'Delete'
                    New-ActionStatusStatistics 'Disable'
                    New-ActionStatusStatistics 'StagedDelete'
                    New-ActionStatusStatistics 'Other'
                )
            }
        }

        function New-ActionStatusStatistics ($Action) {
            return [PSCustomObject][ordered]@{
                Action  = $Action
                Success = 0
                Failure = 0
                Skipped = 0
                Warning = 0
            }
        }

        $CycleSummary = New-CycleSummary
        $CycleSummary.CycleId = New-Object 'System.Collections.Generic.List[string]'
        $CycleTracker = @{
            ChangeIds = New-Object 'System.Collections.Generic.HashSet[string]'
            UserIds   = New-Object 'System.Collections.Generic.HashSet[string]'
        }

        $CycleSummaries = [ordered]@{}
        $CycleTrackers = @{}
    }

    process {
        foreach ($ProvisioningLog in $ProvisioningLogs) {
            if ($SummarizeByCycleId) {
                if (!$CycleSummaries.Contains($ProvisioningLog.CycleId)) {
                    ## New CycleSummary object for new CycleId
                    $CycleSummaries[$ProvisioningLog.CycleId] = $CycleSummary = New-CycleSummary $ProvisioningLog.CycleId
                    $CycleTrackers[$ProvisioningLog.CycleId] = $CycleTracker = @{
                        ChangeIds = New-Object 'System.Collections.Generic.HashSet[string]'
                        UserIds   = New-Object 'System.Collections.Generic.HashSet[string]'
                    }
                }
                else {
                    $CycleSummary = $CycleSummaries[$ProvisioningLog.CycleId]
                    $CycleTracker = $CycleTrackers[$ProvisioningLog.CycleId]
                }
            }
            else {
                ## Add CycleId to a single summary object
                if (!$CycleSummary.CycleId.Contains($ProvisioningLog.CycleId)) { $CycleSummary.CycleId.Add($ProvisioningLog.CycleId) }
            }

            ## Update log date range
            if ($null -eq $CycleSummary.StartDateTime -or $ProvisioningLog.ActivityDateTime -lt $CycleSummary.StartDateTime) {
                $CycleSummary.StartDateTime = $ProvisioningLog.ActivityDateTime
            }
            if ($null -eq $CycleSummary.EndDateTime -or $ProvisioningLog.ActivityDateTime -gt $CycleSummary.EndDateTime) {
                $CycleSummary.EndDateTime = $ProvisioningLog.ActivityDateTime
            }

            ## Update summary object with statistics
            if ($CycleTracker.ChangeIds.Add($ProvisioningLog.ChangeId)) { $CycleSummary.Changes++ }
            if ($CycleTracker.UserIds.Add($ProvisioningLog.SourceIdentity.Id)) { $CycleSummary.Users++ }

            $CycleSummary.ActionStatistics | Where-Object Action -EQ $ProvisioningLog.ProvisioningAction | ForEach-Object { $_.($ProvisioningLog.ProvisioningStatusInfo.Status)++ }
        }
    }

    end {
        if ($SummarizeByCycleID) {
            [array] $CycleSummaries = $CycleSummaries.Values
        }
        else {
            [array] $CycleSummaries = $CycleSummary
        }

        foreach ($CycleSummary in $CycleSummaries) {
            Write-Output $CycleSummary

            if ($WriteToConsole) {
                Write-Host ('')
                Write-Host ("CycleId: {0}" -f ($CycleSummary.CycleId -join ', '))
                Write-Host ("Timespan: {0} - {1} ({2})" -f $CycleSummary.StartDateTime, $CycleSummary.EndDateTime, ($CycleSummary.EndDateTime - $CycleSummary.StartDateTime))
                Write-Host ("Total Changes: {0}" -f $CycleSummary.Changes)
                Write-Host ("Total Users: {0}" -f $CycleSummary.Users)
                Write-Host ('')

                $TableRowPattern = '{0,-12} {1,7} {2,7} {3,7} {4,7} {5,7}'
                Write-Host ($TableRowPattern -f 'Action', 'Success', 'Failure', 'Skipped', 'Warning', 'Total')
                Write-Host ($TableRowPattern -f '------', '-------', '-------', '-------', '-------', '-----')
                foreach ($row in $CycleSummary.ActionStatistics) {
                    Write-Host ($TableRowPattern -f $row.Action, $row.Success, $row.Failure, $row.Skipped, $row.Warning, ($row.Success + $row.Failure + $row.Skipped + $row.Warning))
                }
                Write-Host ('')
            }
        }
    }
}

#endregion

#region Get-MsIdAdfsSamlToken.ps1

<#
.SYNOPSIS
    Initiates a SAML logon request to and AD FS server to generate log activity and returns the user token.
.DESCRIPTION
    This command will generate log activity on the ADFS server, by requesting a SAML token using Windows or forms authentication.
.EXAMPLE
    PS > Get-MsIdAdfsSamlToken urn:microsoft:adfs:claimsxray -HostName adfs.contoso.com

    Sign in to an application on an AD FS server using logged user credentials using the SAML protocol.

.EXAMPLE
    PS > $credential = Get-Credential
    PS > Get-MsIdAdfsSamlToken urn:microsoft:adfs:claimsxray -HostName adfs.contoso.com

    Sign in to an application on an AD FS server using credentials provided by the user using the SAML endpoint and forms based authentication.

.EXAMPLE
    PS > $SamlIdentifiers = Get-AdfsRelyingPartyTrust | where { $_.WSFedEndpoint -eq $null } | foreach { $_.Identifier.Item(0) }
    PS > $SamlIdentifiers | foreach { Get-MsIdAdfsSamlToken $_ -HostName adfs.contoso.com }
    
    Get all SAML relying party trusts from the AD FS server and sign in using the logged user credentials.

#>
function Get-MsIdAdfsSamlToken 
{
  [CmdletBinding()]
  [OutputType([string])]
  param(
    # Application identifier
    [Parameter(Mandatory=$true,
      Position=0,
      ValueFromPipeline=$true,
      ValueFromPipelineByPropertyName=$true)]
    [string]$Issuer,
    # Enter host name for the AD FS server
    [Parameter(Mandatory=$true)]
    [string]$HostName,
    # Provide the credential for the user to be signed in
    [Parameter(Mandatory=$false)]
    [pscredential]$Credential
  )

  if ($null -ne $Credential) 
  {
    Write-Warning "Using credentials sends password in clear text over the network!"
  }


  $login = $null
  $loginFail = ""

  $EncodedSamlRequest = New-MsIdSamlRequest -Issuer $Issuer -DeflateAndEncode

  [System.UriBuilder] $uriAdfs = 'https://{0}/adfs/ls' -f $HostName
  $uriAdfs.Query = ConvertTo-QueryString @{
      SAMLRequest = $EncodedSamlRequest
  }  

  if ($null -ne $Credential) {
    $user = $Credential.UserName
    $form = New-AdfsLoginFormFields -Credential $Credential
    try{
      $login = Invoke-WebRequest -Uri $uriAdfs.Uri -Method POST -Body $form -UseBasicParsing -ErrorAction SilentlyContinue
    }
    catch [System.Net.WebException]{
      $loginFail = $_
    }
  }
  else {
    $userAgent = 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT; Windows NT 10.0; en-US)'
    $user = "$($env:USERDOMAIN)\$($env:UserName)"
    try{
      $login = Invoke-WebRequest -Uri $uriAdfs.Uri -UserAgent $userAgent -UseDefaultCredentials -UseBasicParsing -ErrorAction SilentlyContinue
    }
    catch [System.Net.WebException]{
      $loginFail = $_
    }
  }



  if ($null -eq $login) { Write-Error "HTTP request failed for issuer ""$($Issuer)"" and user: $($user). ERROR: $($loginFail)" }
  elseif ($login.StatusCode -ne 200) { Write-Error "HTTP request failed for issuer ""$($Issuer)"" and user: $($user). ERROR: HTTP status $($login.StatusCode)" }
  elseif ($login.InputFields.Count -le 0) {
    Write-Warning "Login failed for issuer ""$($Issuer)"" and user: $($user)"
  }
  elseif ($login.InputFields[0].outerHTML.Contains("SAMLResponse")) {
    Write-Host "Login sucessful for issuer ""$($Issuer)"" and user: $($user)"
    return $login.Content | Get-ParsedTokenFromResponse -Protocol SAML
  }
  else { Write-Warning "Login failed for issuer ""$($Issuer)"" and user: $($user)" }

  return
}

#endregion

#region Get-MsIdAdfsWsFedToken.ps1

<#
.SYNOPSIS
    Initiates a Ws-Fed logon request to and AD FS server to generate log activity and returns the user token.
.DESCRIPTION
    This command will generate log activity on the ADFS server, by requesting a Ws-Fed token using the windows or forms authentication.
.EXAMPLE
    PS > Get-MsIdAdfsWsFedToken urn:federation:MicrosoftOnline -HostName adfs.contoso.com

    Sign in to an application on an AD FS server using logged user credentials using the Ws-Fed protocol.

.EXAMPLE
    PS > $credential = Get-Credential
    PS > Get-MsIdAdfsWsFedToken urn:federation:MicrosoftOnline -HostName adfs.contoso.com

    Sign in to an application on an AD FS server using credentials provided by the user using the Ws-Fed endpoint and forms based authentication.

.EXAMPLE
    PS > $WsFedIdentifiers = Get-AdfsRelyingPartyTrust | where { $_.WSFedEndpoint -ne $null -and $_.Identifier -notcontains "urn:federation:MicrosoftOnline" } | foreach { $_.Identifier.Item(0) }
    PS > $WsFedIdentifiers | foreach { Get-MsIdAdfsWsFedToken $_ -HostName adfs.contoso.com }

    Get all Ws-Fed relying party trusts from the AD FS server excluding Azure AD and sign in using the logged user credentials.

#>
function Get-MsIdAdfsWsFedToken 
{
  [CmdletBinding()]
  [OutputType([string])]
  param(
    # Enter the application identifier
    [Parameter(Mandatory=$true,
      Position=0,
      ValueFromPipeline=$true,
      ValueFromPipelineByPropertyName=$true)]
    [string]$WtRealm,
    # Enter host name for the AD FS server
    [Parameter(Mandatory=$true)]
    [string]$HostName,
    # Provide the credential for the user to be signed in
    [Parameter(Mandatory=$false)]
    [pscredential]$Credential
  )

  $login = $null
  $loginFail = ""

  # Defaults to Ws-Fed request
  [System.UriBuilder] $uriAdfs = 'https://{0}/adfs/ls' -f $HostName
  $uriAdfs.Query = ConvertTo-QueryString @{
    'client-request-id' = New-Guid
    wa = 'wsignin1.0'
    wtrealm = $WtRealm
  }  

    
  if ($null -ne $Credential) {
    Write-Warning "Using credentials sends password in clear text over the network!"

    $user = $Credential.UserName
    $form = New-AdfsLoginFormFields -Credential $Credential
    try{
      $login = Invoke-WebRequest -Uri $uriAdfs.Uri -Method POST -Body $form -UseBasicParsing -ErrorAction SilentlyContinue
    }
    catch [System.Net.WebException]{
      $loginFail = $_
    }
  }
  else {
    $userAgent = 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT; Windows NT 10.0; en-US)'
    $user = "$($env:USERDOMAIN)\$($env:UserName)"
    try{
      $login = Invoke-WebRequest -Uri $uriAdfs.Uri -UserAgent $userAgent -UseDefaultCredentials -UseBasicParsing -ErrorAction SilentlyContinue
    }
    catch [System.Net.WebException]{
      $loginFail = $_
    }
  }


  if ($null -eq $login) { Write-Error "HTTP request failed for WtRealm ""$($WtRealm)"" and user: $($user). ERROR: $($loginFail)" }
  elseif ($login.StatusCode -ne 200) { Write-Error "HTTP request failed for WtRealm ""$($WtRealm)"" and user: $($user). ERROR: HTTP status $($login.StatusCode)" }
  elseif ($login.InputFields.Count -le 0) {
    Write-Warning "Login failed for WtRealm ""$($WtRealm)"" and user: $($user)" 
  }
  elseif ($login.InputFields[0].outerHTML.Contains("wsignin1.0")) {
    Write-Host "Login sucessful for WtRealm ""$($WtRealm)"" and user: $($user)"
    return $login.Content | Get-ParsedTokenFromResponse -Protocol WsFed
  }
  else { Write-Warning "Login failed for WtRealm ""$($WtRealm)"" and user: $($user)" }

  return
}

#endregion

#region Get-MsIdAdfsWsTrustToken.ps1

<#
.SYNOPSIS
    Initiates a Ws-Trust logon request to and AD FS server to generate log activity and returns the user token.
.DESCRIPTION
    This command will generate log activity on the ADFS server, by requesting a Ws-Trust token using the windows transport or user name mixed endpoint.
.EXAMPLE
    PS > Get-MsIdAdfsWsTrustToken urn:federation:MicrosoftOnline -HostName adfs.contoso.com
    
    Sign in to an application on an AD FS server using logged user credentials using the WindowsTransport endpoint.

.EXAMPLE
    PS > $credential = Get-Credential
    PS > Get-MsIdAdfsWsTrustToken urn:federation:MicrosoftOnline -HostName adfs.contoso.com -Credential $credential

    Sign in to an application on an AD FS server using credentials provided by the user using the UserNameMixed endpoint.

.EXAMPLE
    PS > $identifiers = Get-AdfsRelyingPartyTrust | foreach { $_.Identifier.Item(0) }
    PS > $identifiers | foreach { Get-MsIdAdfsWsTrustToken $_ -HostName adfs.contoso.com }

    Get all relying party trusts from the AD FS server and sign in using the logged user credentials.

#>
function Get-MsIdAdfsWsTrustToken 
{
  [CmdletBinding()]
  [OutputType([string])]
  param(
    # Enter the application identifier
    [Parameter(Mandatory=$true,
      Position=0,
      ValueFromPipeline=$true,
      ValueFromPipelineByPropertyName=$true)]
    [string]$Identifier,
    # Enter host name for the AD FS server
    [Parameter(Mandatory=$true)]
    [string]$HostName,
    # Provide the credential for the user to be signed in
    [Parameter(Mandatory=$false)]
    [pscredential]$Credential
  )

  $login = $null
  $loginFail = ""

  if ($null -ne $Credential) {
    $user = $Credential.UserName

    [System.UriBuilder] $uriAdfs = 'https://{0}/adfs/services/trust/2005/usernamemixed' -f $HostName

    $wstrustRequest = New-MsIdWsTrustRequest $Identifier -Endpoint $uriAdfs.Uri -Credential $Credential
    try{
      $login = Invoke-WebRequest $uriAdfs.Uri -Method Post -Body $wstrustRequest -ContentType "application/soap+xml" -UseBasicParsing -ErrorAction SilentlyContinue
    }
    catch [System.Net.WebException]{
      $loginFail = $_
    }
  }
  else {
    $user = "$($env:USERDOMAIN)\$($env:UserName)"

    [System.UriBuilder] $uriAdfs = 'https://{0}/adfs/services/trust/2005/windowstransport' -f $HostName

    $wstrustRequest = New-MsIdWsTrustRequest $Identifier -Endpoint $uriAdfs.Uri
    try{
      $login = Invoke-WebRequest $uriAdfs.Uri -Method Post -Body $wstrustRequest -ContentType "application/soap+xml" -UseDefaultCredentials -UseBasicParsing -ErrorAction SilentlyContinue
    }
    catch [System.Net.WebException]{
      $loginFail = $_
    }
  }



  if ($null -eq $login) { Write-Error "HTTP request failed for identifier ""$($identifier)"" and user: $($user). ERROR: $($loginFail)" }
  elseif ($login.StatusCode -ne 200) { Write-Error "HTTP request failed for identifier ""$($identifier)"" and user: $($user). ERROR: HTTP status $($login.StatusCode)" }
  elseif ($login.Headers["Content-Type"].Contains("application/soap+xml")) {
      Write-Host "Login sucessful for identifier ""$($Identifier)"" and user: $($user)"
      return $login.Content | ConvertFrom-SamlMessage
  }
  else { Write-Warning "Login failed for identifier ""$($Identifier)"" and user: $($user)" }

  return
}

#endregion

#region Get-MsIdApplicationIdByAppId.ps1

<#
.SYNOPSIS
    Lookup Application Registration by AppId

.EXAMPLE
    PS > Get-MsIdApplicationIdByAppId 10000000-0000-0000-0000-000000000001

    Return the application registration id matching appId, 10000000-0000-0000-0000-000000000001.

.INPUTS
    System.String

#>
function Get-MsIdApplicationIdByAppId {
    [CmdletBinding()]
    [OutputType([string])]
    param (
        # AppID of the Application Registration
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 1)]
        [string[]] $AppId
    )

    begin {
        ## Initialize Critical Dependencies
        $CriticalError = $null
        if (!(Test-MgCommandPrerequisites 'Get-MgApplication' -MinimumVersion 2.8.0 -ErrorVariable CriticalError)) { return }
    }

    process {
        if ($CriticalError) { return }

        foreach ($_AppId in $AppId) {
            ## Filter application registration by appId and return id
            Get-MgApplication -Filter "appId eq '$_AppId'" -Select id | Select-Object -ExpandProperty id
        }
    }
}

#endregion

#region Get-MsIdAuthorityUri.ps1

<#
.SYNOPSIS
    Build Microsoft Identity Provider Authority URI

.EXAMPLE
    PS > Get-MsIdAuthorityUri

    Get common Microsoft authority URI endpoint.

.EXAMPLE
    PS > Get-MsIdAuthorityUri -TenantId contoso.com

    Get Microsoft IdP authority URI endpoint for a specific organizational tenant (Azure AD).

.EXAMPLE
    PS > Get-MsIdAuthorityUri -AzureAd

    Get Microsoft IdP authority URI endpoint for any organizational account (Azure AD).

.EXAMPLE
    PS > Get-MsIdAuthorityUri -Msa

    Get Microsoft IdP authority URI endpoint for any Microsoft consumer account (MSA).

.EXAMPLE
    PS > Get-MsIdAuthorityUri -AzureAdB2c -TenantName contoso -Policy B2C_1_SignUp

    Get Microsoft IdP authority URI endpoint for a specific organization B2C tenant (Azure AD B2C) using the B2C_1_SignUp policy.
    
#>
function Get-MsIdAuthorityUri {
    [CmdletBinding(DefaultParameterSetName = 'Common')]
    [OutputType([string])]
    param (
        # Use endpoint for organizational accounts (Azure AD).
        [Parameter(Mandatory = $true, ParameterSetName = 'AzureAd')]
        [switch] $AzureAd,
        # Use endpoint for organizational B2C accounts (Azure AD B2C).
        [Parameter(Mandatory = $true, ParameterSetName = 'AzureAdB2c')]
        [switch] $AzureAdB2c,
        # Use endpoint for Microsoft consumer accounts (MSA).
        [Parameter(Mandatory = $true, ParameterSetName = 'Msa')]
        [switch] $Msa,
        # Name of Azure AD tenant. For example: <TenantName>.onmicrosoft.com
        [Parameter(Mandatory = $false, ParameterSetName = 'Common')]
        [Parameter(Mandatory = $false, ParameterSetName = 'AzureAd')]
        [Parameter(Mandatory = $true, ParameterSetName = 'AzureAdB2c')]
        [string] $TenantName,
        # Azure AD tenant GUID or verified domain name. For example: contoso.onmicrosoft.com or contoso.com
        [Parameter(Mandatory = $false, ParameterSetName = 'Common')]
        [Parameter(Mandatory = $false, ParameterSetName = 'AzureAd')]
        [Parameter(Mandatory = $false, ParameterSetName = 'AzureAdB2c')]
        [string] $TenantId,
        # Name of B2C Policy defined in Azure AD B2C tenant.
        [Parameter(Mandatory = $true, ParameterSetName = 'AzureAdB2c')]
        [string] $Policy,

        # Type of app integration ('OAuth2','Saml','WsFed'). 'OAuth2' is default.
        [Parameter(Mandatory = $false)]
        [ValidateSet('OAuth2', 'Saml', 'WsFed')]
        [string] $AppType = 'OAuth2',
        # OAuth2 endpoint version ('v1.0','v2.0'). v2.0 is default.
        [Parameter(Mandatory = $false, ParameterSetName = 'Common')]
        [Parameter(Mandatory = $false, ParameterSetName = 'AzureAd')]
        [ValidateSet('v1.0', 'v2.0')]
        [string] $OAuth2EndpointVersion = 'v2.0'
    )

    switch ($PSCmdlet.ParameterSetName) {
        "AzureAdB2c" {
            [uri] $BaseUri = "https://{0}.b2clogin.com/" -f $TenantName
        }
        default {
            [uri] $BaseUri = "https://login.microsoftonline.com/"
        }
    }

    switch ($PSCmdlet.ParameterSetName) {
        "AzureAd" {
            if (!$TenantId) {
                if ($TenantName) { $TenantId = "{0}.onmicrosoft.com" -f $TenantName }
                else { $TenantId = "organizations" }
            }
            break
        }
        "AzureAdB2c" {
            if (!$TenantId) { $TenantId = "{0}.onmicrosoft.com" -f $TenantName }
            break
        }
        "Msa" {
            if (!$TenantId) { $TenantId = "consumers" }
            break
        }
        default {
            if (!$TenantId) {
                if ($TenantName) { $TenantId = "{0}.onmicrosoft.com" -f $TenantName }
                else { $TenantId = "common" }
            }
        }
    }

    $uriMsftIdPAuthority = New-Object System.UriBuilder $BaseUri.AbsoluteUri
    $uriMsftIdPAuthority.Path = '/{0}' -f $TenantId
    if ($PSCmdlet.ParameterSetName -eq 'AzureAdB2c') { $uriMsftIdPAuthority.Path += '/{0}' -f $Policy }
    if ($AppType -eq 'OAuth2' -and $OAuth2EndpointVersion -ne 'v1.0') { $uriMsftIdPAuthority.Path += '/{0}' -f $OAuth2EndpointVersion }
    #if ($Policy) { $uriMsftIdPAuthority.Query = ConvertTo-QueryString @{ p = $Policy } }

    return $uriMsftIdPAuthority.Uri.AbsoluteUri
}

#endregion

#region Get-MsIdAzureIpRange.ps1

<#
.SYNOPSIS
    Get list of IP ranges for Azure

.EXAMPLE
    PS > Get-MsIdAzureIpRange -AllServiceTagsAndRegions

    Get list of IP ranges for Azure Public cloud catagorized by Service Tag and Region.

.EXAMPLE
    PS > Get-MsIdAzureIpRange -ServiceTag AzureActiveDirectory

    Get list of IP ranges for Azure Active Directory in Azure Public Cloud.

.EXAMPLE
    PS > Get-MsIdAzureIpRange -Region WestUS

    Get list of IP ranges for West US region of Azure Public Cloud.

.EXAMPLE
    PS > Get-MsIdAzureIpRange -Cloud China -Region ChinaEast -ServiceTag Storage

    Get list of IP ranges for Storage in ChinaEast region of Azure China Cloud.

.INPUTS
    System.String
    
#>
function Get-MsIdAzureIpRange {
    [CmdletBinding(DefaultParameterSetName = 'ById')]
    [OutputType([PSCustomObject], [string[]])]
    param(
        # Name of Azure Cloud. Valid values are: Public, Government, Germany, China
        [Parameter(Mandatory = $false, Position = 1)]
        [ValidateSet('Public', 'Government', 'Germany', 'China')]
        [string] $Cloud = 'Public',

        # Name of Region. Use AllServiceTagsAndRegions parameter to see valid regions.
        [Parameter(Mandatory = $false, Position = 2, ParameterSetName = 'ById')]
        [ValidateNotNullOrEmpty()]
        [ArgumentCompleter({
                param ( $commandName, $parameterName, $wordToComplete, $commandAst, $fakeBoundParameters )
                [string] $Cloud = 'Public'  # Default Cloud parameter value
                if ($fakeBoundParameters.ContainsKey('Cloud')) { $Cloud = $fakeBoundParameters.Cloud }
                [string] $ServiceTag = ''  # Default ServiceTag parameter value
                if ($fakeBoundParameters.ContainsKey('ServiceTag')) { $ServiceTag = $fakeBoundParameters.ServiceTag }

                #$StartPosition = $host.UI.RawUI.CursorPosition
                #Write-Host '...' -NoNewline

                [array] $AllServiceTagsAndRegions = Get-MsIdAzureIpRange -Cloud $Cloud -AllServiceTagsAndRegions -Verbose:$false
                #$AllServiceTagsAndRegions.values.properties.region | Select-Object -Unique | Where-Object { $_ }

                $listRegions = New-Object System.Collections.Generic.List[string]
                foreach ($Item in $AllServiceTagsAndRegions.values.name) {
                    if ($Item -like "$ServiceTag*.$wordToComplete*") {
                        $Region = $Item.Split('.')[1]
                        if (!$listRegions.Contains($Region)) { $listRegions.Add($Region) }
                    }
                }

                if ($listRegions) {
                    $listRegions #| ForEach-Object {$_}
                }

                #$host.UI.RawUI.CursorPosition = $StartPosition
                #Write-Host (' ') -NoNewline
            })]
        [string] $Region,

        # Name of Service Tag. Use AllServiceTagsAndRegions parameter to see valid service tags.
        [Parameter(Mandatory = $false, Position = 3, ParameterSetName = 'ById')]
        [ValidateNotNullOrEmpty()]
        [ArgumentCompleter({
                param ( $commandName, $parameterName, $wordToComplete, $commandAst, $fakeBoundParameters )
                [string] $Cloud = 'Public'  # Default Cloud parameter value
                if ($fakeBoundParameters.ContainsKey('Cloud')) { $Cloud = $fakeBoundParameters.Cloud }
                [string] $Region = ''  # Default Region parameter value
                if ($fakeBoundParameters.ContainsKey('Region')) { $Region = $fakeBoundParameters.Region }

                #Write-Host '...' -NoNewline
                [array] $AllServiceTagsAndRegions = Get-MsIdAzureIpRange -Cloud $Cloud -AllServiceTagsAndRegions -Verbose:$false
                #$AllServiceTagsAndRegions.values.properties.region | Select-Object -Unique | Where-Object { $_ }

                $listServiceTags = New-Object System.Collections.Generic.List[string]
                foreach ($Item in $AllServiceTagsAndRegions.values.name) {
                    if ($Item -like "$wordToComplete*?$Region*") {
                        $ServiceTag = $Item.Split('.')[0]
                        if (!$listServiceTags.Contains($ServiceTag)) { $listServiceTags.Add($ServiceTag) }
                    }
                }

                if ($listServiceTags) {
                    $listServiceTags #| ForEach-Object {$_}
                }
            })]
        [string] $ServiceTag,

        # List all IP ranges catagorized by Service Tag and Region.
        [Parameter(Mandatory = $false, ParameterSetName = 'AllServiceTagsAndRegions')]
        [switch] $AllServiceTagsAndRegions,

        # Bypass cache and download data again.
        [Parameter(Mandatory = $false)]
        [switch] $ForceRefresh
    )

    ## Get data cache
    if (!(Get-Variable cacheAzureIPRangesAndServiceTags -ErrorAction SilentlyContinue)) { New-Variable -Name cacheAzureIPRangesAndServiceTags -Scope Script -Value (New-Object hashtable) }

    ## Download data and update cache
    if ($ForceRefresh -or !$cacheAzureIPRangesAndServiceTags.ContainsKey($Cloud)) {
        Write-Verbose ('Downloading data for Cloud [{0}].' -f $Cloud)
        [hashtable] $MdcIdCloudMapping = @{
            Public     = 56519
            Government = 57063
            Germany    = 57064
            China      = 57062
        }

        [uri] $MdcUri = 'https://www.microsoft.com/en-us/download/confirmation.aspx?id={0}' -f $MdcIdCloudMapping[$Cloud]
        [uri] $MdcDirectUri = $null  # Example: https://download.microsoft.com/download/7/1/D/71D86715-5596-4529-9B13-DA13A5DE5B63/ServiceTags_Public_20191111.json

        $MdcResponse = Invoke-WebRequest -UseBasicParsing -Uri $MdcUri
        if ($MdcResponse -match 'https://download\.microsoft\.com/download/.+?/ServiceTags_.+?_[0-9]{6,8}\.json') {
            $MdcDirectUri = $Matches[0]
        }

        if ($MdcDirectUri) {
            $cacheAzureIPRangesAndServiceTags[$Cloud] = Invoke-RestMethod -UseBasicParsing -Uri $MdcDirectUri -ErrorAction Stop
        }
    }
    else {
        Write-Verbose ('Using cached data for Cloud [{0}]. Use -ForceRefresh parameter to bypass cache.' -f $Cloud)
    }
    $AzureServiceTagsAndRegions = $cacheAzureIPRangesAndServiceTags[$Cloud]

    ## Return the data
    if ($AllServiceTagsAndRegions) {
        return $AzureServiceTagsAndRegions
    }
    else {
        [string] $Id = 'AzureCloud'
        if ($ServiceTag) {
            $Id = $ServiceTag
        }
        if ($Region) {
            $Id += '.{0}' -f $Region
        }

        $FilteredServiceTagsAndRegions = $AzureServiceTagsAndRegions.values | Where-Object id -EQ $Id
        if ($FilteredServiceTagsAndRegions) {
            return $FilteredServiceTagsAndRegions.properties.addressPrefixes
        }
    }
}

#endregion

#region Get-MsIdCrossTenantAccessActivity.ps1

<#
.SYNOPSIS
    Gets cross tenant user sign-in activity

.DESCRIPTION
    Gets user sign-in activity associated with external tenants. By default, shows both connections
    from local users access an external tenant (outbound), and external users accessing the local
    tenant (inbound).

    Has a parameter, -AccessDirection, to further refine results, using the following values:

      * Outboud - lists sign-in events of external tenant IDs accessed by local users
      * Inbound - list sign-in events of external tenant IDs of external users accessing local tenant

    Has a parameter, -ExternalTenantId, to target a single external tenant ID.

    Has a switch, -SummaryStats, to show summary statistics for each external tenant. This also works
    when targeting a single tenant. It is best to use this with Format-Table and Out-Gridview to ensure
    a table is produced.

    Has a switch, -ResolvelTenantId, to return additional details on the external tenant ID.

    -Verbose will give insight into the cmdlets activities.

    Requires AuditLog.Read.All scope (to access logs) and CrossTenantInfo.ReadBasic.All scope
    (for -ResolveTenantId), i.e. Connect-MgGraph -Scopes AuditLog.Read.All


.EXAMPLE
    Get-MsIdCrossTenantAccessActivity

    Gets all available sign-in events for external users accessing resources in the local tenant and
    local users accessing resources in an external tenant.

    Lists by external tenant ID.


.EXAMPLE
    Get-MsIdCrossTenantAccessActivity -ResolveTenantId -Verbose

    Gets all available sign-in events for external users accessing resources in the local tenant and
    local users accessing resources in an external tenant.

    Lists by external tenant ID. Attempts to resolve the external tenant ID GUID.

    Provides verbose output for insight into the cmdlet's execution.


.EXAMPLE
    Get-MsIdCrossTenantAccessActivity -SummaryStats | Format-Table

    Provides a summary for sign-in information for the external tenant 3ce14667-9122-45f5-bcd4-f618957d9ba1, for both external
    users accessing resources in the local tenant and local users accessing resources in an external tenant.

    Use Format-Table to ensure a table is returned.


.EXAMPLE
    Get-MsIdCrossTenantAccessActivity -ExternalTenantId 3ce14667-9122-45f5-bcd4-f618957d9ba1

    Gets all available sign-in events for local users accessing resources in the external tenant 3ce14667-9122-45f5-bcd4-f618957d9ba1,
    and external users from tenant 3ce14667-9122-45f5-bcd4-f618957d9ba1 accessing resources in the local tenant.

    Lists by targeted external tenant.


.EXAMPLE
    Get-MsIdCrossTenantAccessActivity -AccessDirection Outbound

    Gets all available sign-in events for local users accessing resources in an external tenant.

    Lists by unique external tenant.


.EXAMPLE
    Get-MsIdCrossTenantAccessActivity -AccessDirection Outbound -Verbose

    Gets all available sign-in events for local users accessing resources in an external tenant.

    Lists by unique external tenant.

    Provides verbose output for insight into the cmdlet's execution.


.EXAMPLE
    Get-MsIdCrossTenantAccessActivity -AccessDirection Outbound -SummaryStats -ResolveTenantId

    Provides a summary of sign-ins for local users accessing resources in an external tenant.

    Attempts to resolve the external tenant ID GUID.


.EXAMPLE
    Get-MsIdCrossTenantAccessActivity -AccessDirection Outbound -ExternalTenantId 3ce14667-9122-45f5-bcd4-f618957d9ba1

    Gets all available sign-in events for local users accessing resources in the external tenant 3ce14667-9122-45f5-bcd4-f618957d9ba1.

    Lists by unique external tenant.


.EXAMPLE
    Get-MsIdCrossTenantAccessActivity -AccessDirection Inbound

    Gets all available sign-in events for external users accessing resources in the local tenant.

    Lists by unique external tenant.


.EXAMPLE
    Get-MsIdCrossTenantAccessActivity -AccessDirection Inbound -Verbose

    Gets all available sign-in events for external users accessing resources in the local tenant.

    Lists by unique external tenant.

    Provides verbose output for insight into the cmdlet's execution.


.EXAMPLE
    Get-MsIdCrossTenantAccessActivity -AccessDirection Inbound -SummaryStats | Out-Gridview

    Provides a summary of sign-ins for external users accessing resources in the local tenant.

    Use Out-Gridview to display a table in the Out-Gridview window.


.EXAMPLE
    Get-MsIdCrossTenantAccessActivity -AccessDirection Inbound -ExternalTenantId 3ce14667-9122-45f5-bcd4-f618957d9ba1

    Gets all available sign-in events for external user from external tenant 3ce14667-9122-45f5-bcd4-f618957d9ba1 accessing
    resources in the local tenant.

    Lists by unique external tenant.


.NOTES
    THIS CODE-SAMPLE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR
    FITNESS FOR A PARTICULAR PURPOSE.

    This sample is not supported under any Microsoft standard support program or service.
    The script is provided AS IS without warranty of any kind. Microsoft further disclaims all
    implied warranties including, without limitation, any implied warranties of merchantability
    or of fitness for a particular purpose. The entire risk arising out of the use or performance
    of the sample and documentation remains with you. In no event shall Microsoft, its authors,
    or anyone else involved in the creation, production, or delivery of the script be liable for
    any damages whatsoever (including, without limitation, damages for loss of business profits,
    business interruption, loss of business information, or other pecuniary loss) arising out of
    the use of or inability to use the sample or documentation, even if Microsoft has been advised
    of the possibility of such damages, rising out of the use of or inability to use the sample script,
    even if Microsoft has been advised of the possibility of such damages.


#>
function Get-MsIdCrossTenantAccessActivity {

    [CmdletBinding()]
    param(

        #Return events based on external tenant access direction, either 'Inbound', 'Outbound', or 'Both'
        [Parameter(Position = 0)]
        [ValidateSet('Inbound', 'Outbound')]
        [string]$AccessDirection,

        #Return events for the supplied external tenant ID
        [Parameter(Position = 1)]
        [guid]$ExternalTenantId,

        #Show summary statistics by tenant
        [switch]$SummaryStats,

        #Atemmpt to resolve the external tenant ID
        [switch]$ResolveTenantId

    )

    begin {
        ## Initialize Critical Dependencies
        $CriticalError = $null
        if (!(Test-MgCommandPrerequisites 'Get-MgBetaAuditLogSignIn' -MinimumVersion 2.8.0 -ErrorVariable CriticalError)) { return }

        #External Tenant ID check

        if ($ExternalTenantId) {

            Write-Verbose -Message "$(Get-Date -f T) - Checking supplied external tenant ID - $ExternalTenantId..."

            if ($ExternalTenantId -eq (Get-MgContext).TenantId) {

                Write-Error "$(Get-Date -f T) - Supplied external tenant ID ($ExternalTenantId) cannot match connected tenant ID ($((Get-MgContext).TenantId)))" -ErrorAction Stop

            }
            else {

                Write-Verbose -Message "$(Get-Date -f T) - Supplied external tenant ID OK"
            }

        }

    }

    process {
        ## Return Immediately On Critical Error
        if ($CriticalError) { return }

        #Get filtered sign-in logs and handle parameters

        if ($AccessDirection -eq "Outbound") {

            if ($ExternalTenantId) {

                Write-Verbose -Message "$(Get-Date -f T) - Access direction 'Outbound' selected"
                Write-Verbose -Message "$(Get-Date -f T) - Outbound: getting sign-ins for local users accessing external tenant ID - $ExternalTenantId"

                $SignIns = Get-MgBetaAuditLogSignIn -Filter ("CrossTenantAccessType ne 'none' and ResourceTenantId eq '{0}'" -f $ExternalTenantId) -All | Group-Object ResourceTenantID

            }
            else {

                Write-Verbose -Message "$(Get-Date -f T) - Access direction 'Outbound' selected"
                Write-Verbose -Message "$(Get-Date -f T) - Outbound: getting external tenant IDs accessed by local users"

                $SignIns = Get-MgBetaAuditLogSignIn -Filter ("CrossTenantAccessType ne 'none' and ResourceTenantId ne '{0}'" -f (Get-MgContext).TenantId) -All | Group-Object ResourceTenantID

            }

        }
        elseif ($AccessDirection -eq 'Inbound') {

            if ($ExternalTenantId) {

                Write-Verbose -Message "$(Get-Date -f T) - Access direction 'Inbound' selected"
                Write-Verbose -Message "$(Get-Date -f T) - Inbound: getting sign-ins for users accessing local tenant from external tenant ID - $ExternalTenantId"

                $SignIns = Get-MgBetaAuditLogSignIn -Filter ("CrossTenantAccessType ne 'none' and HomeTenantId eq '{0}' and TokenIssuerType eq 'AzureAD'" -f $ExternalTenantId) -All | Group-Object HomeTenantID

            }
            else {

                Write-Verbose -Message "$(Get-Date -f T) - Access direction 'Inbound' selected"
                Write-Verbose -Message "$(Get-Date -f T) - Inbound: getting external tenant IDs for external users accessing local tenant"

                $SignIns = Get-MgBetaAuditLogSignIn -Filter ("CrossTenantAccessType ne 'none' and HomeTenantId ne '{0}' and TokenIssuerType eq 'AzureAD'" -f (Get-MgContext).TenantId) -All | Group-Object HomeTenantID

            }

        }
        else {

            if ($ExternalTenantId) {

                Write-Verbose -Message "$(Get-Date -f T) - Default access direction 'Both'"
                Write-Verbose -Message "$(Get-Date -f T) - Outbound: getting sign-ins for local users accessing external tenant ID - $ExternalTenantId"

                $Outbound = Get-MgBetaAuditLogSignIn -Filter ("CrossTenantAccessType ne 'none' and ResourceTenantId eq '{0}'" -f $ExternalTenantId) -All | Group-Object ResourceTenantID


                Write-Verbose -Message "$(Get-Date -f T) - Inbound: getting sign-ins for users accessing local tenant from external tenant ID - $ExternalTenantId"

                $Inbound = Get-MgBetaAuditLogSignIn -Filter ("CrossTenantAccessType ne 'none' and HomeTenantId eq '{0}' and TokenIssuerType eq 'AzureAD'" -f $ExternalTenantId) -All | Group-Object HomeTenantID


            }
            else {

                Write-Verbose -Message "$(Get-Date -f T) - Default access direction 'Both'"
                Write-Verbose -Message "$(Get-Date -f T) - Outbound: getting external tenant IDs accessed by local users"

                $Outbound = Get-MgBetaAuditLogSignIn -Filter ("CrossTenantAccessType ne 'none' and ResourceTenantId ne '{0}'" -f (Get-MgContext).TenantId) -All | Group-Object ResourceTenantID


                Write-Verbose -Message "$(Get-Date -f T) - Inbound: getting external tenant IDs for external users accessing local tenant"

                $Inbound = Get-MgBetaAuditLogSignIn -Filter ("CrossTenantAccessType ne 'none' and HomeTenantId ne '{0}' and TokenIssuerType eq 'AzureAD'" -f (Get-MgContext).TenantId) -All | Group-Object HomeTenantID



            }

            #Combine outbound and inbound results

            [array]$SignIns = $Outbound
            $SignIns += $Inbound



        }


        #Analyse sign-in logs

        Write-Verbose -Message "$(Get-Date -f T) - Checking for sign-ins..."

        if ($SignIns) {

            Write-Verbose -Message "$(Get-Date -f T) - Sign-ins obtained"
            Write-Verbose -Message "$(Get-Date -f T) - Iterating Sign-ins..."

            foreach ($TenantID in $SignIns) {

                #Handle resolving tenant ID

                if ($ResolveTenantId) {

                    Write-Verbose -Message "$(Get-Date -f T) - Attempting to resolve external tenant - $($TenantId.Name)"

                    #Nullify $ResolvedTenant value

                    $ResolvedTenant = $null


                    #Attempt to resolve tenant ID

                    try { $ResolvedTenant = Resolve-MsIdTenant -TenantId $TenantId.Name -ErrorAction Stop }
                    catch { Write-Warning $_.Exception.Message; Write-Verbose -Message "$(Get-Date -f T) - Issue resolving external tenant - $($TenantId.Name)" }

                    if ($ResolvedTenant) {

                        if ($ResolvedTenant.Result -eq 'Resolved') {

                            $ExternalTenantName = $ResolvedTenant.DisplayName
                            $DefaultDomainName = $ResolvedTenant.DefaultDomainName


                        }
                        else {

                            $ExternalTenantName = $ResolvedTenant.Result
                            $DefaultDomainName = $ResolvedTenant.Result

                        }

                        if ($ResolvedTenant.oidcMetadataResult -eq 'Resolved') {

                            $oidcMetadataTenantRegionScope = $ResolvedTenant.oidcMetadataTenantRegionScope

                        }
                        else {

                            $oidcMetadataTenantRegionScope = 'NotFound'

                        }

                    }
                    else {

                        $ExternalTenantName = "NotFound"
                        $DefaultDomainName = "NotFound"
                        $oidcMetadataTenantRegionScope = 'NotFound'


                    }

                }

                #Handle access direction

                if (($AccessDirection -eq 'Inbound') -or ($AccessDirection -eq 'Outbound')) {

                    $Direction = $AccessDirection

                }
                else {

                    if ($TenantID.Name -eq $TenantID.Group[0].HomeTenantId) {

                        $Direction = "Inbound"

                    }
                    elseif ($TenantID.Name -eq $TenantID.Group[0].ResourceTenantId) {

                        $Direction = "Outbound"

                    }

                }

                #Provide summary

                if ($SummaryStats) {

                    Write-Verbose -Message "$(Get-Date -f T) - Creating summary stats for external tenant - $($TenantId.Name)"

                    #Handle resolving tenant ID

                    if ($ResolveTenantId) {

                        $Analysis = [pscustomobject]@{

                            ExternalTenantId          = $TenantId.Name
                            ExternalTenantName        = $ExternalTenantName
                            ExternalTenantRegionScope = $oidcMetadataTenantRegionScope
                            AccessDirection           = $Direction
                            SignIns                   = ($TenantId).count
                            SuccessSignIns            = ($TenantID.Group.Status | Where-Object { $_.ErrorCode -eq 0 } | Measure-Object).count
                            FailedSignIns             = ($TenantID.Group.Status | Where-Object { $_.ErrorCode -ne 0 } | Measure-Object).count
                            UniqueUsers               = ($TenantID.Group | Select-Object UserId -Unique | Measure-Object).count
                            UniqueResources           = ($TenantID.Group | Select-Object ResourceId -Unique | Measure-Object).count

                        }

                    }
                    else {

                        #Build custom output object

                        $Analysis = [pscustomobject]@{

                            ExternalTenantId = $TenantId.Name
                            AccessDirection  = $Direction
                            SignIns          = ($TenantId).count
                            SuccessSignIns   = ($TenantID.Group.Status | Where-Object { $_.ErrorCode -eq 0 } | Measure-Object).count
                            FailedSignIns    = ($TenantID.Group.Status | Where-Object { $_.ErrorCode -ne 0 } | Measure-Object).count
                            UniqueUsers      = ($TenantID.Group | Select-Object UserId -Unique | Measure-Object).count
                            UniqueResources  = ($TenantID.Group | Select-Object ResourceId -Unique | Measure-Object).count

                        }


                    }

                    Write-Verbose -Message "$(Get-Date -f T) - Adding stats for $($TenantId.Name) to total analysis object"

                    [array]$TotalAnalysis += $Analysis

                }
                else {

                    #Get individual events by external tenant

                    Write-Verbose -Message "$(Get-Date -f T) - Getting individual sign-in events for external tenant - $($TenantId.Name)"


                    foreach ($Event in $TenantID.group) {


                        if ($ResolveTenantId) {

                            $CustomEvent = [pscustomobject]@{

                                ExternalTenantId          = $TenantId.Name
                                ExternalTenantName        = $ExternalTenantName
                                ExternalDefaultDomain     = $DefaultDomainName
                                ExternalTenantRegionScope = $oidcMetadataTenantRegionScope
                                AccessDirection           = $Direction
                                UserDisplayName           = $Event.UserDisplayName
                                UserPrincipalName         = $Event.UserPrincipalName
                                UserId                    = $Event.UserId
                                UserType                  = $Event.UserType
                                CrossTenantAccessType     = $Event.CrossTenantAccessType
                                AppDisplayName            = $Event.AppDisplayName
                                AppId                     = $Event.AppId
                                ResourceDisplayName       = $Event.ResourceDisplayName
                                ResourceId                = $Event.ResourceId
                                SignInId                  = $Event.Id
                                CreatedDateTime           = $Event.CreatedDateTime
                                StatusCode                = $Event.Status.Errorcode
                                StatusReason              = $Event.Status.FailureReason


                            }

                            $CustomEvent

                        }
                        else {

                            $CustomEvent = [pscustomobject]@{

                                ExternalTenantId      = $TenantId.Name
                                AccessDirection       = $Direction
                                UserDisplayName       = $Event.UserDisplayName
                                UserPrincipalName     = $Event.UserPrincipalName
                                UserId                = $Event.UserId
                                UserType              = $Event.UserType
                                CrossTenantAccessType = $Event.CrossTenantAccessType
                                AppDisplayName        = $Event.AppDisplayName
                                AppId                 = $Event.AppId
                                ResourceDisplayName   = $Event.ResourceDisplayName
                                ResourceId            = $Event.ResourceId
                                SignInId              = $Event.Id
                                CreatedDateTime       = $Event.CreatedDateTime
                                StatusCode            = $Event.Status.Errorcode
                                StatusReason          = $Event.Status.FailureReason


                            }

                            $CustomEvent

                        }


                    }


                }

            }

        }
        else {

            Write-Warning "$(Get-Date -f T) - No sign-ins matching the selected criteria found."

        }

        #Display summary table

        if ($SummaryStats) {

            #Show array of summary objects for each external tenant

            Write-Verbose -Message "$(Get-Date -f T) - Displaying total analysis object"

            if (!$AccessDirection) {

                $TotalAnalysis | Sort-Object ExternalTenantId

            }
            else {

                $TotalAnalysis | Sort-Object SignIns -Descending

            }

        }


    }

    end {
        if ($CriticalError) { return }
    }
}

#endregion

#region Get-MsIdGroupWithExpiration.ps1

<#
.SYNOPSIS
    Return groups with an expiration date via lifecycle policy.

.EXAMPLE
    PS > Get-MsIdGroupWithExpiration | ft Id,DisplayName,ExpirationDateTime,RenewedDateTime

    Return all groups with an expiration date.

.EXAMPLE
    PS > Get-MsIdGroupWithExpiration -After (Get-Date).AddDays(-30) -Before (Get-Date).AddDays(30) | ft Id,DisplayName,ExpirationDateTime,RenewedDateTime

    Return all groups with an expiration date between 30 days before today and 30 days after today.

.EXAMPLE
    PS > Get-MsIdGroupWithExpiration -Days 30 | ft Id,DisplayName,ExpirationDateTime,RenewedDateTime

    Return all groups with an expiration date between now and 30 days from now.

.INPUTS
    None

#>
function Get-MsIdGroupWithExpiration {
    [CmdletBinding(DefaultParameterSetName = 'DateTimeSpan')]
    param (
        # Numbers of days
        [Parameter(Mandatory = $false, Position = 0, ParameterSetName = 'Days')]
        [int] $Days,
        # Start of DateTime range
        [Parameter(Mandatory = $false, Position = 0, ParameterSetName = 'DateTimeSpan')]
        [datetime] $After = [datetime]::MinValue,
        # End of DateTime range
        [Parameter(Mandatory = $false, Position = 1, ParameterSetName = 'DateTimeSpan')]
        [datetime] $Before = [datetime]::MaxValue
    )

    ## Initialize Critical Dependencies
    if (!(Test-MgCommandPrerequisites 'Get-MgGroup' -MinimumVersion 2.8.0 -ErrorVariable CriticalError)) { return }

    if ($PSCmdlet.ParameterSetName -eq 'Days') {
        [datetime] $After = Get-Date
        [datetime] $Before = $After.AddDays($Days)
    }

    ## Filter for groups with an expiration date
    Get-MgGroup -Filter "expirationDateTime ge $($After.ToUniversalTime().ToString('o')) and expirationDateTime le $($Before.ToUniversalTime().ToString('o'))" -All -CountVariable MgCount -ConsistencyLevel eventual | Sort-Object expirationDateTime
}

#endregion

#region Get-MsIdMsftIdentityAssociation.ps1

<#
.SYNOPSIS
    Parse Microsoft Identity Association Configuration for a Public Domain (such as published apps)

.EXAMPLE
    PS > Get-MsIdMsftIdentityAssociation https://contoso.com/
    
    Get Microsoft Identity Association Configuration for contoso domain.

.INPUTS
    System.Uri

#>
function Get-MsIdMsftIdentityAssociation {
    [CmdletBinding()]
    [OutputType([PsCustomObject[]])]
    param (
        # Publisher Domain. For example: https://contoso.com/
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 1)]
        [uri] $Publisher
    )
    ## Build common OpenId provider configuration URI
    $uriMsftIdentityAssociation = New-Object System.UriBuilder $Publisher.AbsoluteUri
    if (!$uriMsftIdentityAssociation.Path.EndsWith('/.well-known/microsoft-identity-association.json')) { $uriMsftIdentityAssociation.Path += '/.well-known/microsoft-identity-association.json' }

    ## Download and parse configuration
    $MsftIdentityAssociation = Invoke-RestMethod -UseBasicParsing -Uri $uriMsftIdentityAssociation.Uri.AbsoluteUri  # Should return ContentType 'application/json'
    return $MsftIdentityAssociation
}

#endregion

#region Get-MsIdO365Endpoints.ps1

<#
.SYNOPSIS
    Get list of URLs and IP ranges for O365
    
.DESCRIPTION
    http://aka.ms/ipurlws

.EXAMPLE
    PS > Get-MsIdO365Endpoints

    Get list of URLs and IP ranges for O365 Worldwide cloud.

.EXAMPLE
    PS > Get-MsIdO365Endpoints -Cloud China -ServiceAreas Exchange,SharePoint

    Get list of URLs and IP ranges for Exchange and SharePoint in O365 China Cloud.

.EXAMPLE
    PS > Get-MsIdO365Endpoints -Cloud Worldwide -ServiceAreas Common | Where-Object id -In 54,56,59,96

    Get list of URLs and IP ranges related to Azure Active Directory.

.INPUTS
    System.String

#>
function Get-MsIdO365Endpoints {
    [CmdletBinding()]
    [OutputType([PSCustomObject])]
    param(
        # Name of O365 Cloud. Valid values are: 'Worldwide','USGovGCCHigh','USGovDoD','Germany','China'
        [Parameter(Mandatory = $false, Position = 1)]
        [ValidateSet('Worldwide', 'USGovGCCHigh', 'USGovDoD', 'Germany', 'China')]
        [string] $Cloud = 'Worldwide',
        # Office 365 tenant name.
        [Parameter(Mandatory = $false)]
        [string] $TenantName,
        # Exclude IPv6 addresses from the output
        [Parameter(Mandatory = $false)]
        [switch] $NoIPv6,
        # Name of Service Area.
        [Parameter(Mandatory = $false)]
        [ValidateSet('Common', 'Exchange', 'SharePoint', 'Skype')]
        [string[]] $ServiceAreas,
        # Client Request Id.
        [Parameter(Mandatory = $false)]
        [guid] $ClientRequestId = (New-Guid)
    )

    [hashtable] $EndpointsParameters = @{
        clientrequestid = $ClientRequestId
    }
    if ($TenantName) { $EndpointsParameters.Add('TenantName', $TenantName) }
    if ($NoIPv6) { $EndpointsParameters.Add('NoIPv6', $NoIPv6) }
    if ($ServiceAreas) { $EndpointsParameters.Add('ServiceAreas', ($ServiceAreas -join ',')) }

    [System.UriBuilder] $O365EndpointsUri = 'https://endpoints.office.com/endpoints/{0}' -f $Cloud
    $O365EndpointsUri.Query = ConvertTo-QueryString $EndpointsParameters

    $O365Endpoints = Invoke-RestMethod -UseBasicParsing -Uri $O365EndpointsUri.Uri -ErrorAction Stop
    return $O365Endpoints
}

#endregion

#region Get-MsIdOpenIdProviderConfiguration.ps1

<#
.SYNOPSIS
    Parse OpenId Provider Configuration and Keys
    
.EXAMPLE
    PS > Get-MsIdAuthorityUri -TenantId tenant.onmicrosoft.com | Get-MsIdOpenIdProviderConfiguration

    Get OpenId Provider Configuration for a specific Microsoft organizational tenant (Azure AD).

.EXAMPLE
    PS > Get-MsIdAuthorityUri -TenantId tenant.onmicrosoft.com | Get-MsIdOpenIdProviderConfiguration -Keys

    Get public keys for OpenId Provider for a specific Microsoft organizational tenant (Azure AD).

.EXAMPLE
    PS > Get-MsIdAuthorityUri -Msa | Get-MsIdOpenIdProviderConfiguration

    Get OpenId Provider Configuration for Microsoft consumer accounts (MSA).

.INPUTS
    System.Uri

#>
function Get-MsIdOpenIdProviderConfiguration {
    [CmdletBinding()]
    [OutputType([PsCustomObject[]])]
    param (
        # Identity Provider Authority URI
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 1)]
        [uri] $Issuer,
        # Return configuration keys
        [Parameter(Mandatory = $false)]
        [switch] $Keys
    )

    process {
        Get-OpenIdProviderConfiguration @PSBoundParameters
    }
}

#endregion

#region Get-MsIdSamlFederationMetadata.ps1

<#
.SYNOPSIS
    Parse Federation Metadata
    
.EXAMPLE
    PS > Get-MsIdAuthorityUri -TenantId tenant.onmicrosoft.com -AppType 'Saml' | Get-MsIdSamlFederationMetadata

    Get SAML or WS-Fed Federation Metadata for a specific Microsoft tenant.

.EXAMPLE
    PS > Get-MsIdAuthorityUri -TenantId tenant.onmicrosoft.com -AppType 'Saml' | Get-MsIdSamlFederationMetadata -AppId 00000000-0000-0000-0000-000000000000

    Get SAML or WS-Fed Federation Metadata for a specific application within a specific Microsoft tenant.

.EXAMPLE
    PS > Get-MsIdSamlFederationMetadata 'https://adfs.contoso.com'

    Get SAML or WS-Fed Federation Metadata for an ADFS farm.

.INPUTS
    System.Uri

#>
function Get-MsIdSamlFederationMetadata {
    [CmdletBinding()]
    [Alias('Get-MsIdWsFedFederationMetadata')]
    [OutputType([xml], [System.Xml.XmlElement[]])]
    param (
        # Identity Provider Authority URI
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 1)]
        [uri] $Issuer,
        # Azure AD Application Id
        [Parameter(Mandatory = $false, Position = 2)]
        [guid] $AppId
    )

    process {
        Get-SamlFederationMetadata @PSBoundParameters
    }
}

#endregion

#region Get-MsIdServicePrincipalIdByAppId.ps1

<#
.SYNOPSIS
    Lookup Service Principal by AppId

.EXAMPLE
    PS > Get-MsIdServicePrincipalIdByAppId 10000000-0000-0000-0000-000000000001

    Return the service principal id matching appId, 10000000-0000-0000-0000-000000000001.

.INPUTS
    System.String

#>
function Get-MsIdServicePrincipalIdByAppId {
    [CmdletBinding()]
    [OutputType([string])]
    param (
        # AppID of the Service Principal
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 1)]
        [string[]] $AppId
    )

    begin {
        ## Initialize Critical Dependencies
        $CriticalError = $null
        if (!(Test-MgCommandPrerequisites 'Get-MgServicePrincipal' -MinimumVersion 2.8.0 -ErrorVariable CriticalError)) { return }
    }

    process {
        if ($CriticalError) { return }

        foreach ($_AppId in $AppId) {
            ## Filter service principals by appId and return id
            Get-MgServicePrincipal -Filter "appId eq '$_AppId'" -Select id | Select-Object -ExpandProperty id
        }
    }
}

#endregion

#region Get-MsIdUnmanagedExternalUser.ps1

<#
.SYNOPSIS
    Returns a list of all the external users in the tenant that are unmanaged (viral users).

.EXAMPLE
    PS > Get-MsIdUnmanagedExternalUser

    Gets a list of all the unmanaged/viral external users.

.EXAMPLE
    PS > Get-MsIdUnmanagedExternalUser -Type ExternalAzureADViral

    Gets a list of all the unmanaged/viral external users. This is the same as running Get-MsIdUnmanagedExternalUser without any parameters.

.EXAMPLE
    PS > Get-MsIdUnmanagedExternalUser -Type MicrosoftAccount

    Gets a list of all the external users with a personal Microsoft Account.

.EXAMPLE
    PS > Get-MsIdUnmanagedExternalUser -Type All

    Gets a list of all the external users that are from an unmanaged/viral tenant or have a personal Microsoft Account.

#>
function Get-MsIdUnmanagedExternalUser {
    [CmdletBinding()]

    param (
        # The type of unmanaged user to return
        [Parameter(Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, ValueFromRemainingArguments = $false)]
        [ValidateSet("ExternalAzureADViral", "MicrosoftAccount", "All")]
        [string] $Type = "ExternalAzureADViral"
    )

    ## Initialize Critical Dependencies
    $CriticalError = $null
    if (!(Test-MgCommandPrerequisites 'Get-MgUser' -MinimumVersion 2.8.0 -RequireListPermissions -ErrorVariable CriticalError)) { return }

    $graphBaseUri = "https://graph.microsoft.com/beta"
    $pageCount = 999
    $guestUserUri = $graphBaseUri + "/users?`$filter=userType eq 'Guest'&`$select=id,userPrincipalName,mail,displayName,identities&`$count=true&`$top=$pageCount"

    $results = Invoke-MgGraphRequest -Uri $guestUserUri -Headers @{ ConsistencyLevel = 'eventual' }
    $count = Get-ObjectPropertyValue $results '@odata.count'
    $currentPage = 0
    $hasMoreData = $true
    $userIndex = 1

    #Declare $user as GraphUser object

    if ($count -eq 0) {
        Write-Host "No guest users in this tenant."
    }
    elseif ($count -gt 0) {
        while ($hasMoreData) {
            $percentCompleted = $currentPage * $pageCount / $count * 100
            $currentPage += 1
            Write-Progress -Activity "Checking Guest Users" -PercentComplete $percentCompleted

            foreach ($userObject in (Get-ObjectPropertyValue $results 'value')) {
                $user = $userObject

                Write-Verbose "$userIndex / $count"
                $userIndex += 1

                $isAzureAdUser = $false
                $isMsaUser = $false
                $mail = Get-ObjectPropertyValue $user 'mail'

                foreach ($identity in (Get-ObjectPropertyValue $user 'identities')) {
                    $issuer = Get-ObjectPropertyValue $identity 'issuer'
                    Write-Verbose "$($mail) Issuer = $($issuer) [$($user.userPrincipalName)]"
                    switch ($issuer) {
                        'ExternalAzureAD' { $isAzureAdUser = $true }
                        'MicrosoftAccount' { $isMsaUser = $true }
                    }
                }

                $isViralUser = $false
                if($Type -eq 'ExternalAzureADViral' -or $Type -eq 'All')
                {
                    if ($isAzureAdUser) {

                        Write-Verbose "Checking if user $($mail) is viral user. [$($user.userPrincipalName)]"

                        if (![string]::IsNullOrEmpty($mail)) {
                            $isViralUser = Get-MsIdIsViralUser -Mail $mail
                        }
                        else {
                            Write-Verbose "Skipping viral check. $($user.userPrincipalName) does not have a mail address."
                        }
                    }
                    else {
                        Write-Verbose "Skipping viral check. $($mail) <> ExternalAzureAD managed user"
                    }
                }

                if(($Type -eq 'ExternalAzureADViral' -or $Type -eq 'All') -and $isViralUser)
                {
                    Write-Verbose "$($mail) = viral user [$($user.userPrincipalName)]"
                    Write-Output $user
                }
                if(($Type -eq 'MicrosoftAccount' -or $Type -eq 'All') -and $isMsaUser)
                {
                    Write-Verbose "$($mail) = Microsoft Account [$($user.userPrincipalName)]"
                    Write-Output $user
                }

            }

            $nextLink = Get-ObjectPropertyValue $results '@odata.nextLink'
            if ($nextLink) {
                $results = Invoke-MgGraphRequest -Uri $nextLink -Headers @{ ConsistencyLevel = 'eventual' }
            }
            else {
                $hasMoreData = $false
            }

        }
        Write-Progress -Activity "Checking Guest Users" -Completed
    }
}

#endregion

#region Invoke-MsIdAzureAdSamlRequest.ps1

<#
.SYNOPSIS
    Invoke Saml Request on Azure AD.
   
.EXAMPLE
    PS > $samlRequest = New-MsIdSamlRequest -Issuer 'urn:microsoft:adfs:claimsxray'
    PS > Invoke-MsIdAzureAdSamlRequest $samlRequest.OuterXml

    Create new Saml Request for Claims X-Ray and Invoke on Azure AD.

.INPUTS
    System.String

#>
function Invoke-MsIdAzureAdSamlRequest {
    [CmdletBinding()]
    [OutputType()]
    param (
        # SAML Request
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [object[]] $SamlRequest,
        # Azure AD Tenant Id
        [Parameter(Mandatory = $false)]
        [string] $TenantId = 'common'
    )

    process {
        foreach ($_SamlRequest in $SamlRequest) {
            if ($_SamlRequest -is [string]) {
                $xmlSamlRequest = ConvertFrom-SamlMessage $_SamlRequest
            }
            else {
                $xmlSamlRequest = $_SamlRequest
            }
            $EncodedSamlRequest = $xmlSamlRequest.OuterXml | Compress-Data | ConvertTo-Base64String

            [System.UriBuilder] $uriAzureAD = 'https://login.microsoftonline.com/{0}/saml2' -f $TenantId
            $uriAzureAD.Query = ConvertTo-QueryString @{
                SAMLRequest = $EncodedSamlRequest
            }

            Write-Verbose ('Invoking Azure AD SAML2 Endpoint [{0}]' -f $uriAzureAD.Uri.AbsoluteUri)
            Start-Process $uriAzureAD.Uri.AbsoluteUri
        }
    }
}

#endregion

#region New-MsIdClientSecret.ps1

<#
.SYNOPSIS
    Generate Random Client Secret for application registration or service principal in Azure AD.
    
.EXAMPLE
    PS > New-MsIdClientSecret

    Generates a new client secret 32 characters long.
    
.EXAMPLE
    PS > New-MsIdClientSecret -Length 64 -Base64Encode

    Generates a new client secret 64 bytes long and then base64 encodes it.

#>
function New-MsIdClientSecret {
    [CmdletBinding()]
    [OutputType([securestring])]
    param (
        # Specifies the number of random characters or bytes to generate.
        [Parameter(Mandatory = $false)]
        [int] $Length = 32,
        # Generate a binary key and encode it to base64.
        [Parameter(Mandatory = $false)]
        [switch] $Base64Encode
    )

    if ($Base64Encode) {
        [securestring] $Secret = ConvertTo-SecureString (ConvertTo-Base64String ([byte[]](Get-Random -InputObject ((([byte]::MinValue)..([byte]::MaxValue)) * $Length) -Count $Length))) -AsPlainText -Force
    }
    else {
        [char[]] $Numbers = (48..57)
        [char[]] $UpperCaseLetters = (65..90)
        [char[]] $LowerCaseLetters = (97..122)
        [char[]] $Symbols = '*+-./:=?@[]_'
        [securestring] $Secret = ConvertTo-SecureString ((Get-Random -InputObject (($UpperCaseLetters + $LowerCaseLetters + $Numbers + $Symbols) * $Length) -Count $Length) -join '') -AsPlainText -Force
    }
    return $Secret
}

#endregion

#region New-MsIdSamlRequest.ps1

<#
.SYNOPSIS
   Create New Saml Request.
   
.EXAMPLE
    PS > New-MsIdSamlRequest -Issuer 'urn:microsoft:adfs:claimsxray'

    Create New Saml Request for Claims X-Ray.

.INPUTS
    System.String

.OUTPUTS
    SamlMessage : System.Xml.XmlDocument, System.String

#>
function New-MsIdSamlRequest {
    [CmdletBinding()]
    #[OutputType([xml], [string])]
    param (
        # Azure AD uses this attribute to populate the InResponseTo attribute of the returned response.
        [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)]
        [string] $Issuer,
        # If provided, this parameter must match the RedirectUri of the cloud service in Azure AD.
        [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)]
        [string] $AssertionConsumerServiceURL,
        # If this is true, Azure AD will attempt to authenticate the user silently using the session cookie.
        [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)]
        [switch] $IsPassive,
        # If true, it means that the user will be forced to re-authenticate, even if they have a valid session with Azure AD.
        [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)]
        [switch] $ForceAuthn,
        # Tailors the name identifier in the subjects of assertions.
        [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)]
        [ArgumentCompleter({
                param ( $commandName, $parameterName, $wordToComplete, $commandAst, $fakeBoundParameters )
                'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
                'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
                'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
                'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'
            })]
        [string] $NameIDPolicyFormat,
        # Specifies the authentication context requirements of authentication statements returned in response to a request or query.
        [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)]
        [ArgumentCompleter({
                param ( $commandName, $parameterName, $wordToComplete, $commandAst, $fakeBoundParameters )
                'urn:oasis:names:tc:SAML:2.0:ac:classes:Password'
                'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
                'urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword'
                'urn:oasis:names:tc:SAML:2.0:ac:classes:SecureRemotePassword'
                'urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos'
                'urn:oasis:names:tc:SAML:2.0:ac:classes:X509'
                'urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient'
                'urn:oasis:names:tc:SAML:2.0:ac:classes:Unspecified'
                'urn:oasis:names:tc:SAML:1.0:am:password'
                'urn:oasis:names:tc:SAML:1.0:am:X509-PKI'
                'urn:federation:authentication:windows'
                'http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password'
                'http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/secureremotepassword'
                'http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/windows'
                'http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/kerberos'
                'http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/tlsclient'
                'urn:ietf:rfc:1510'
                'urn:ietf:rfc:2246'
                'urn:ietf:rfc:2945'
            })]
        [string[]] $RequestedAuthnContext,
        # Specifies the comparison method used to evaluate the requested context classes or statements, one of "exact", "minimum", "maximum", or "better".
        [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)]
        [ValidateSet('exact', 'minimum', 'maximum', 'better')]
        [string] $RequestedAuthnContextComparison,
        # Deflate and Base64 Encode the Saml Request
        [Parameter(Mandatory = $false)]
        [switch] $DeflateAndEncode,
        # Url Encode the Deflated and Base64 Encoded Saml Request
        [Parameter(Mandatory = $false)]
        [switch] $UrlEncode
    )

    begin {
        $pathSamlRequest = Join-Path $PSScriptRoot 'internal\SamlRequestTemplate.xml'
    }

    process {
        $xmlSamlRequest = New-Object SamlMessage
        $xmlSamlRequest.Load($pathSamlRequest)
        $xmlSamlRequest.AuthnRequest.ID = 'id{0}' -f (New-Guid).ToString("N")
        $xmlSamlRequest.AuthnRequest.IssueInstant = (Get-Date).ToUniversalTime().ToString('o')
        $xmlSamlRequest.AuthnRequest.Issuer.'#text' = $Issuer
        if ($AssertionConsumerServiceURL) { $xmlSamlRequest.AuthnRequest.SetAttribute('AssertionConsumerServiceURL', $AssertionConsumerServiceURL) }
        if ($PSBoundParameters.ContainsKey('IsPassive')) { $xmlSamlRequest.AuthnRequest.SetAttribute('IsPassive', $IsPassive.ToString().ToLowerInvariant()) }
        if ($PSBoundParameters.ContainsKey('ForceAuthn')) { $xmlSamlRequest.AuthnRequest.SetAttribute('ForceAuthn', $ForceAuthn.ToString().ToLowerInvariant()) }
        if ($NameIDPolicyFormat) { (Resolve-XmlElement $xmlSamlRequest.DocumentElement -Prefix samlp -LocalName NameIDPolicy -NamespaceURI $xmlSamlRequest.DocumentElement.NamespaceURI -CreateMissing).SetAttribute('Format', $NameIDPolicyFormat) }
        if ($RequestedAuthnContext) {
            $AuthnContextClassRefTemplate = $xmlSamlRequest.AuthnRequest.RequestedAuthnContext.ChildNodes[0]
            foreach ($AuthnContext in $RequestedAuthnContext) {
                $AuthnContextClassRef = $AuthnContextClassRefTemplate.Clone()
                $AuthnContextClassRef.'#text' = $AuthnContext
                [void]$xmlSamlRequest.AuthnRequest.RequestedAuthnContext.AppendChild($AuthnContextClassRef)
            }
            [void]$xmlSamlRequest.AuthnRequest.RequestedAuthnContext.RemoveChild($AuthnContextClassRefTemplate)
            if ($RequestedAuthnContextComparison) { $xmlSamlRequest.AuthnRequest.RequestedAuthnContext.SetAttribute('Comparison', $RequestedAuthnContextComparison) }
        }

        if ($DeflateAndEncode) {
            $EncodedSamlRequest = $xmlSamlRequest.OuterXml | Compress-Data | ConvertTo-Base64String
            if ($UrlEncode) { Write-Output ([System.Net.WebUtility]::UrlEncode($EncodedSamlRequest)) }
            else { Write-Output $EncodedSamlRequest }
        }
        else {
            Write-Output $xmlSamlRequest
        }
    }
}

#endregion

#region New-MsIdTemporaryUserPassword.ps1

<#
.SYNOPSIS
    Generate Random password for user in Azure AD.
    
.EXAMPLE
    PS > New-MsIdTemporaryUserPassword

    Generates a new password.

#>
function New-MsIdTemporaryUserPassword {
    [CmdletBinding()]
    [OutputType([securestring])]
    param ()

    [char[]] $Consonants = 'bcdfghjklmnpqrstvwxyz'
    [char[]] $Vowels = 'aou'
    [securestring] $Password = ConvertTo-SecureString ('{0}{1}{2}{3}{4}' -f (Get-Random -InputObject $Consonants).ToString().ToUpper(), (Get-Random -InputObject $Vowels), (Get-Random -InputObject $Consonants), (Get-Random -InputObject $Vowels), (Get-Random -Minimum 1000 -Maximum 9999)) -AsPlainText -Force
    return $Password
}

#endregion

#region New-MsIdWsTrustRequest.ps1

<#
.SYNOPSIS
    Create a WS-Trust request.
.EXAMPLE
    PS > New-MsIdWsTrustRequest urn:federation:MicrosoftOnline -Endpoint https://adfs.contoso.com/adfs/services/trust/2005/windowstransport

    Create a Ws-Trust request for the application urn:federation:MicrosoftOnline.

#>
function New-MsIdWsTrustRequest {
    [CmdletBinding()]
    [OutputType([string])]
    param (
        # Application identifier
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [string] $Identifier,
        # Host name for the AD FS server
        [Parameter(Mandatory=$true)]
        [string]$Endpoint,
        # Credential for the user to be signed in
        [Parameter(Mandatory=$false)]
        [pscredential]$Credential
    )

    if ($Credential -ne $null)
    {
        Write-Warning "Using credentials sends password in clear text over the network!"
      
        $username = $Credential.UserName
        $password = ConvertFrom-SecureStringAsPlainText $Credential.Password -Force
        $request = [String]::Format(
            '<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><s:Header><a:Action s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</a:Action><a:ReplyTo><a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address></a:ReplyTo><a:To s:mustUnderstand="1">{0}</a:To><o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><o:UsernameToken u:Id="uuid-52bba51d-e0c7-4bb1-8c99-6f97220eceba-5"><o:Username>{1}</o:Username><o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">{2}</o:Password></o:UsernameToken></o:Security></s:Header><s:Body><t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust"><wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"><a:EndpointReference><a:Address>{3}</a:Address></a:EndpointReference></wsp:AppliesTo><t:KeySize>0</t:KeySize><t:KeyType>http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey</t:KeyType><t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType><t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</t:TokenType></t:RequestSecurityToken></s:Body></s:Envelope>', `
                $Endpoint,
                $username,
                $password,
                $Identifier)
    }
    else
    {
        $request = [String]::Format(
            '<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><s:Header><a:Action s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</a:Action><a:ReplyTo><a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address></a:ReplyTo><a:To s:mustUnderstand="1">{0}</a:To></s:Header><s:Body><t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust"><wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"><a:EndpointReference><a:Address>{1}</a:Address></a:EndpointReference></wsp:AppliesTo><t:KeySize>0</t:KeySize><t:KeyType>http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey</t:KeyType><t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType><t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</t:TokenType></t:RequestSecurityToken></s:Body></s:Envelope>', `
                $Endpoint,
                $Identifier)
    }

    return $request
}
#endregion

#region Reset-MsIdExternalUser.ps1

<#
.SYNOPSIS
    Resets the redemption state of an external user.

.EXAMPLE
    PS > Reset-MsIdExternalUser -UserId 1468b68b-8536-4bc5-ab1f-6014175b836d

    Resets the invitation state of an external user.

.EXAMPLE
    PS > Reset-MsIdExternalUser -UserId 1468b68b-8536-4bc5-ab1f-6014175b836d -SendInvitationMessage

    Resets the invitation state of an external user and sends them the invitation redemption mail.

.EXAMPLE
    PS > $user = Get-MgUser -Filter "startsWith(mail, 'john.doe@fabrikam.net')"
    PS > Reset-MsIdExternalUser -UserId $user.Id

    Resets the invitation state of an external user with the email address john.doe@fabrikam.net.

.EXAMPLE
    PS > $users = Get-MgUser -Filter "endsWith(mail, '@fabrikam.net')"
    PS > $users | Reset-MsIdExternalUser -UserId $user.Id -SendInvitationMessage

    Resets the invitation state of all external users from fabrikam.net and sends them an invitation mail.

.EXAMPLE
    PS > Get-MsIdUnmanagedExternalUser | Reset-MsIdExternalUser

    Resets the invitation state of all unmanaged external users in the tenant.

#>
function Reset-MsIdExternalUser {
    [CmdletBinding(DefaultParameterSetName = 'ObjectId')]
    param (
        # ObjectId of external user
        [Parameter(Mandatory = $true, ParameterSetName = 'ObjectId', Position = 0, ValueFromPipeline = $true)]
        [string] $UserId,

        # User object of external user
        [Parameter(Mandatory = $true, ParameterSetName = 'GraphUser', Position = 0, ValueFromPipeline = $true)]
        [psobject] $User,

        # The url to redirect the user to after they redeem the link
        # Defaults to My Apps page of the inviter's home tenant. https://myapps.microsoft.com?tenantId={tenantId}
        [Parameter(Mandatory = $false, ParameterSetName = 'ObjectId', Position = 1, ValueFromPipeline = $false)]
        [Parameter(Mandatory = $false, ParameterSetName = 'GraphUser', Position = 1, ValueFromPipeline = $false)]
        [string] $InviteRedirectUrl,

        # Sends an email notification to the user with the guest invitation redemption link
        [Parameter(Mandatory = $false, ParameterSetName = 'ObjectId', Position = 2, ValueFromPipeline = $false)]
        [Parameter(Mandatory = $false, ParameterSetName = 'GraphUser', Position = 2, ValueFromPipeline = $false)]
        [switch] $SendInvitationMessage
    )

    begin {
        ## Initialize Critical Dependencies
        $CriticalError = $null
        if (!(Test-MgCommandPrerequisites 'Get-MgUser', 'New-MgInvitation' -MinimumVersion 2.8.0 -RequireListPermissions -ErrorVariable CriticalError)) { return }

        if (!$InviteRedirectUrl) {
            $tenantId = (Get-MgContext).TenantId
            $InviteRedirectUrl = "https://myapps.microsoft.com?tenantId=$tenantId"
        }
        $doSendInvitationMessage = $SendInvitationMessage.IsPresent
    }

    process {
        function Send-Invitation {
            [CmdletBinding()]
            param (
                [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
                [psobject]$GraphUser
            )

            # check that object has requried properties
            if ($GraphUser.psobject.Properties.Name -inotcontains "id") {
                Write-Error "No provided user id"
            }
            if ($GraphUser.psobject.Properties.Name -inotcontains "mail") {
                Write-Error "No provided user mail"
            }
            # check that values are not empty
            if ([string]::IsNullOrWhiteSpace($GraphUser.Id)) {
                Write-Error "Provided user id is empty"
            }
            if ([string]::IsNullOrWhiteSpace($GraphUser.Mail)) {
                Write-Error "Provided user mail is empty"
            }
            # send the invitation
            New-MgInvitation `
                -InvitedUserEmailAddress $GraphUser.Mail `
                -InviteRedirectUrl $InviteRedirectUrl `
                -ResetRedemption `
                -SendInvitationMessage:$doSendInvitationMessage `
                -InvitedUser @{ "id" = $GraphUser.Id }
        }

        # don't process further if there is a critical error
        if ($CriticalError) {
            return
        }

        switch ($PSCmdlet.ParameterSetName) {
            "ObjectId" {
                $graphUser = Get-MgUser -UserId $UserId
                if ($graphUser) {
                    Send-Invitation $graphUser
                }
                else {
                    Write-Error "User not found."
                }
                break
            }
            "GraphUser" {
                Send-Invitation $User
                break
            }
        }
    }

    end {
        if ($CriticalError) { return }
    }
}

#endregion

#region Resolve-MsIdAzureIpAddress.ps1

<#
.SYNOPSIS
    Lookup Azure IP address for Azure Cloud, Region, and Service Tag.
    
.EXAMPLE
    PS > $IpAddress = Resolve-DnsName login.microsoftonline.com | Where-Object QueryType -eq A | Select-Object -First 1 -ExpandProperty IPAddress
    PS > Resolve-MsIdAzureIpAddress $IpAddress

    Lookup Azure IP address for Azure Cloud, Region, and Service Tag.

.EXAMPLE
    PS > Resolve-MsIdAzureIpAddress graph.microsoft.com

    Lookup Azure IP address for Azure Cloud, Region, and Service Tag.

.INPUTS
    System.String
    System.Net.IPAddress

#>
function Resolve-MsIdAzureIpAddress {
    [CmdletBinding()]
    [OutputType([PSCustomObject])]
    param(
        # DNS Name or IP Address
        [Parameter(Mandatory = $true, ParameterSetName = 'InputObject', ValueFromPipeline = $true, Position = 0)]
        [object[]] $InputObjects,
        # IP Address of Azure Service
        [Parameter(Mandatory = $true, ParameterSetName = 'IpAddress', Position = 1)]
        [ipaddress[]] $IpAddresses,
        # Name of Azure Cloud. Valid values are: Public, Government, Germany, China
        [Parameter(Mandatory = $false)]
        [ValidateSet('Public', 'Government', 'Germany', 'China')]
        [string[]] $Clouds = @('Public', 'Government', 'Germany', 'China'),
        # Bypass cache and download data again.
        [Parameter(Mandatory = $false)]
        [switch] $ForceRefresh
    )

    begin {
        #[string[]] $Clouds = 'Public', 'Government', 'Germany', 'China'
        [hashtable] $ServiceTagAndRegions = @{}
        $PreviousProgressPreference = $ProgressPreference
        $ProgressPreference = 'SilentlyContinue'
        Write-Verbose 'Getting Azure IP Ranges and Service Tag Data...'
        foreach ($Cloud in $Clouds) {
            $ServiceTagAndRegions.Add($Cloud, (Get-MsIdAzureIpRange -Cloud $Cloud -AllServiceTagsAndRegions -ForceRefresh:$ForceRefresh -Verbose:$false))
        }
        $ProgressPreference = $PreviousProgressPreference
        Write-Verbose 'Resolving IP Address to Azure Service Tags...'
    }

    process {
        ## Parse InputObject
        if ($PSCmdlet.ParameterSetName -eq 'InputObject') {
            $listIpAddresses = New-Object System.Collections.Generic.List[ipaddress]
            foreach ($InputObject in $InputObjects) {
                if ($InputObject -is [ipaddress] -or $InputObject -is [int] -or $InputObject -is [UInt32]) {
                    $listIpAddresses.Add($InputObject)
                }
                elseif ($InputObject -is [string]) {
                    if ($InputObject -match '^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$' -or $InputObject -match '^(?:(?::{1,2})?[0-9a-fA-F]{1,4}(?::{1,2})?){1,8}$') {
                        try {
                            [ipaddress] $IpAddress = $InputObject
                            $listIpAddresses.Add($IpAddress)
                        }
                        catch { throw }
                    }
                    else {
                        $DnsNames = Resolve-DnsName $InputObject -Type A -ErrorAction Stop | Where-Object QueryType -EQ A
                        foreach ($DnsName in $DnsNames) {
                            $listIpAddresses.Add($DnsName.IPaddress)
                        }
                    }
                }
                else {
                    $Exception = New-Object ArgumentException -ArgumentList ('Cannot parse input of type {0} to IP address or DNS name.' -f $InputObject.GetType())
                    Write-Error -Exception $Exception -Category ([System.Management.Automation.ErrorCategory]::ParserError) -CategoryActivity $MyInvocation.MyCommand -ErrorId 'ResolveAzureIpAddressFailureTypeNotSupported' -TargetObject $InputObject
                }
            }
            [ipaddress[]] $IpAddresses = $listIpAddresses.ToArray()
        }

        ## Lookup IP Address
        foreach ($IpAddress in $IpAddresses) {
            $listResults = New-Object System.Collections.Generic.List[pscustomobject]
            foreach ($Cloud in $ServiceTagAndRegions.Keys) {
                foreach ($ServiceTagAndRegion in $ServiceTagAndRegions[$Cloud].values) {
                    if (Test-IpAddressInSubnet $IpAddress -Subnets $ServiceTagAndRegion.properties.addressPrefixes) {
                        $ServiceTagAndRegion | Add-Member -Name cloud -MemberType NoteProperty -Value $Cloud -Force
                        $ServiceTagAndRegion | Add-Member -Name ipAddress -MemberType NoteProperty -Value $IpAddress -Force
                        $listResults.Add(($ServiceTagAndRegion | Select-Object ipAddress, cloud, id, properties))
                    }
                }
            }
            if ($listResults.Count -gt 1) { Write-Output $listResults.ToArray() -NoEnumerate }
            elseif ($listResults.Count -eq 1) { Write-Output $listResults.ToArray() }
        }
    }
}

#endregion

#region Revoke-MsIdServicePrincipalConsent.ps1

<#
.SYNOPSIS
    Revoke Existing Consent to an Azure AD Service Principal.

.DESCRIPTION
    This command requires the MS Graph SDK PowerShell Module to have a minimum of the following consented scopes:
    Application.Read.All
    DelegatedPermissionGrant.ReadWrite.All or AppRoleAssignment.ReadWrite.All

.EXAMPLE
    PS > Revoke-MsIdServicePrincipalConsent '10000000-0000-0000-0000-000000000001' -All

    Revoke all consent for servicePrincipal '10000000-0000-0000-0000-000000000001'.

.EXAMPLE
    PS > Get-MgServicePrincipal -ServicePrincipalId '10000000-0000-0000-0000-000000000001' | Revoke-MsIdServicePrincipalConsent -Scope User.Read.All -All

    Revoke all consent of 'User.Read.All' scope for piped in servicePrincipal '10000000-0000-0000-0000-000000000001'.

.EXAMPLE
    PS > Revoke-MsIdServicePrincipalConsent '10000000-0000-0000-0000-000000000001' -UserId '20000000-0000-0000-0000-000000000002'

    Revoke existing consent for servicePrincipal '10000000-0000-0000-0000-000000000001' by user '20000000-0000-0000-0000-000000000002'.

.EXAMPLE
    PS > Revoke-MsIdServicePrincipalConsent '10000000-0000-0000-0000-000000000001' -Scope User.Read.All -UserConsent -AdminConsentDelegated

    Revoke 'User.Read.All' scope from all user consent and tenant-wide admin consent of delegated permissions for servicePrincipal '10000000-0000-0000-0000-000000000001'.

.EXAMPLE
    PS > Revoke-MsIdServicePrincipalConsent '10000000-0000-0000-0000-000000000001' -Scope 'User.Read.All','User.ReadWrite.All' -AdminConsentApplication

    Revoke 'User.Read.All' scope from tenant-wide admin consent of application permissions for servicePrincipal '10000000-0000-0000-0000-000000000001'.

.INPUTS
    System.String

#>
function Revoke-MsIdServicePrincipalConsent {
    [CmdletBinding(DefaultParameterSetName = 'Granular')]
    [Alias('Revoke-MsIdApplicationConsent')]
    [OutputType()]
    param (
        # AppId or ObjectId of service principal
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, Position = 1)]
        [Alias('Id')]
        [string[]] $ClientId,
        # Limit which scopes are cleared to specified list
        [Parameter(Mandatory = $false)]
        [string[]] $Scope,
        # Revoke all existing consent for service principal
        [Parameter(Mandatory = $true, ParameterSetName = 'All')]
        [switch] $All,
        # Revoke user consent for service principal
        [Parameter(Mandatory = $false, ParameterSetName = 'Granular')]
        [switch] $UserConsent,
        # Revoke user consent for service principal for specified users
        [Parameter(Mandatory = $false, ParameterSetName = 'Granular')]
        [Alias('PrincipalId')]
        [string[]] $UserId,
        # Revoke tenant-wide admin consent of user delegated permissions for service principal
        [Parameter(Mandatory = $false, ParameterSetName = 'Granular')]
        [switch] $AdminConsentDelegated,
        # Revoke tenant-wide admin consent of application permissions for service principal
        [Parameter(Mandatory = $false, ParameterSetName = 'Granular')]
        [switch] $AdminConsentApplication
    )

    begin {
        ## Parameter Set Check
        if (!$All -and !($UserConsent -or $UserId -or $AdminConsentDelegated -or $AdminConsentApplication)) {
            Write-Warning "Your current parameter set will not clear any consent. Add switch for types of consent to clear or add 'All' to clear all consent types."
        }

        ## Initialize Critical Dependencies
        $CriticalError = $null
        if (!(Test-MgCommandPrerequisites 'Get-MgServicePrincipal' -MinimumVersion 2.8.0 -ErrorVariable CriticalError) -and $CriticalError[-1].CategoryInfo.Reason -Contains 'AuthenticationException') { return }

        if ($All -or $UserConsent -or $UserId -or $AdminConsentDelegated) {
            if (!(Test-MgCommandPrerequisites 'Get-MgServicePrincipalOauth2PermissionGrant', 'Update-MgOauth2PermissionGrant', 'Remove-MgOauth2PermissionGrant' -MinimumVersion 2.8.0 -ErrorVariable CriticalError)) { return }
        }
        elseif ($All -or $AdminConsentApplication) {
            if (!(Test-MgCommandPrerequisites 'Remove-MgServicePrincipalAppRoleAssignment' -MinimumVersion 2.8.0 -ErrorVariable CriticalError)) { return }
        }
    }

    process {
        if ($CriticalError) { return }

        foreach ($_ClientId in $ClientId) {

            ## Check for service principal by appId
            $servicePrincipalId = Get-MgServicePrincipal -Filter "appId eq '$_ClientId'" -Select id | Select-Object -ExpandProperty id
            ## If nothing is returned, use provided ClientId as servicePrincipalId
            if (!$servicePrincipalId) { $servicePrincipalId = $_ClientId }

            ## Get Service Principal details
            $servicePrincipal = Get-MgServicePrincipal -ServicePrincipalId $servicePrincipalId -Select id -Expand appRoleAssignments
            if ($servicePrincipal) {

                if ($All -or $AdminConsentApplication) {

                    ## Revoke Application Permissions with Tenant-Wide Admin Consent
                    foreach ($appRoleAssignment in $servicePrincipal.AppRoleAssignments) {
                        $spResource = Get-MgServicePrincipal -ServicePrincipalId $appRoleAssignment.ResourceId -Select id, appRoles
                        $ScopeValue = $spResource.AppRoles | Where-Object Id -EQ $appRoleAssignment.AppRoleId | Select-Object -ExpandProperty Value
                        if (!$Scope -or $ScopeValue -in $Scope) {
                            Remove-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $appRoleAssignment.PrincipalId -AppRoleAssignmentId $appRoleAssignment.Id
                        }
                    }

                }

                if ($All -or $UserConsent -or $UserId -or $AdminConsentDelegated) {

                    ## Get all oauth2PermissionGrants and loop through each one
                    $oauth2PermissionGrants = Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $servicePrincipalId
                    foreach ($oauth2PermissionGrant in $oauth2PermissionGrants) {

                        if ($Scope) {
                            [System.Collections.Generic.List[string]] $UpdatedScopes = $oauth2PermissionGrant.Scope -split ' '
                            foreach ($_Scope in $Scope) { [void]$UpdatedScopes.Remove($_Scope) }
                        }

                        if ($Scope -and $UpdatedScopes) {
                            ## Update scopes for requested entries
                            if ($oauth2PermissionGrant.ConsentType -eq 'Principal' -and ($All -or ($UserConsent -and !$UserId) -or ($oauth2PermissionGrant.PrincipalId -in $UserId))) {
                                Update-MgOauth2PermissionGrant -OAuth2PermissionGrantId $oauth2PermissionGrant.Id -Scope ($UpdatedScopes -join ' ')
                            }
                            elseif ($oauth2PermissionGrant.ConsentType -eq 'AllPrincipals' -and ($All -or $AdminConsentDelegated)) {
                                Update-MgOauth2PermissionGrant -OAuth2PermissionGrantId $oauth2PermissionGrant.Id -Scope ($UpdatedScopes -join ' ')
                            }
                        }
                        else {
                            ## Revoke all scopes for requested entries
                            if ($oauth2PermissionGrant.ConsentType -eq 'Principal' -and ($All -or ($UserConsent -and !$UserId) -or ($oauth2PermissionGrant.PrincipalId -in $UserId))) {
                                Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId $oauth2PermissionGrant.Id
                            }
                            elseif ($oauth2PermissionGrant.ConsentType -eq 'AllPrincipals' -and ($All -or $AdminConsentDelegated)) {
                                Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId $oauth2PermissionGrant.Id
                            }
                        }
                    }

                }

            }
        }
    }
}

#endregion

#region Show-MsIdJwtToken.ps1

<#
.SYNOPSIS
   Show Json Web Token (JWT) decoded in Web Browser using diagnostic web app.
   
.EXAMPLE
    PS > $MsalToken.IdToken | Show-MsIdJwtToken

    Show OAuth IdToken JWT decoded in Web Browser.

.INPUTS
    System.String

#>
function Show-MsIdJwtToken {
    [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'High')]
    [Alias('Show-Jwt')]
    param (
        # JSON Web Token (JWT)
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [string[]] $Tokens,
        # OAuth2 Redirect Uri of test application to send Json Web Token
        [Parameter(Mandatory = $false)]
        [uri] $OAuth2RedirectUri = 'https://jwt.ms/',
        # Suppress Prompts
        [Parameter(Mandatory = $false)]
        [switch] $Force
    )

    begin {
        if ($Force -and -not (Get-Variable Confirm -ValueOnly -ErrorAction Ignore)) { $ConfirmPreference = 'None' }
    }

    process {
        foreach ($Token in $Tokens) {

            if ($OAuth2RedirectUri.AbsoluteUri -ne 'https://jwt.ms/') {
                Write-Warning ('The token is being sent to the following web service [{0}]. This command is intended for troubleshooting and should only be used if you trust the service endpoint receiving the token.' -f $OAuth2RedirectUri.AbsoluteUri)
                if (!$PSCmdlet.ShouldProcess($OAuth2RedirectUri.AbsoluteUri, "Send token")) { continue }
            }

            $OAuth2RedirectUriWithToken = New-Object System.UriBuilder $OAuth2RedirectUri -Property @{ Fragment = "id_token=$Token" }
            Start-Process $OAuth2RedirectUriWithToken.Uri.AbsoluteUri
        }
    }
}

#endregion

#region Show-MsIdSamlToken.ps1

<#
.SYNOPSIS
   Show Saml Security Token decoded in Web Browser using diagnostic web app.
   
.EXAMPLE
    PS > Show-MsIdSamlToken 'Base64String'

    Show Saml Security Token decoded in Web Browser.

.INPUTS
    System.String

#>
function Show-MsIdSamlToken {
    [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'High')]
    [Alias('Show-SamlResponse')]
    param (
        # SAML Security Token
        [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
        [string[]] $Tokens,
        # URL Endpoint to send SAML Security Token
        [Parameter(Mandatory = $false)]
        [string] $SamlEndpoint = 'https://adfshelp.microsoft.com/ClaimsXray/TokenResponse',
        # Suppress Prompts
        [Parameter(Mandatory = $false)]
        [switch] $Force
    )

    begin {
        if ($Force -and -not (Get-Variable Confirm -ValueOnly -ErrorAction Ignore)) { $ConfirmPreference = 'None' }

        function GetAvailableLocalTcpPort {
            $TcpListner = New-Object System.Net.Sockets.TcpListener -ArgumentList ([ipaddress]::Loopback, 0)
            try {
                $TcpListner.Start();
                return $TcpListner.LocalEndpoint.Port
            }
            finally { $TcpListner.Stop() }
        }

        function RespondToLocalHttpRequest {
            [CmdletBinding()]
            param (
                # HttpListener Object
                [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true)]
                [System.Net.HttpListener] $HttpListener,
                # HTTP Message Body
                [Parameter(Mandatory = $true)]
                [byte[]] $MessageBody
            )

            ## Wait for HTTP Request
            $HttpListenerContext = $HttpListener.GetContext()

            ## Response to HTTP Request
            Write-Verbose ('{0} => {1}' -f $HttpListenerContext.Request.UserHostAddress, $HttpListenerContext.Request.Url)
            #$MessageBody = [System.Text.Encoding]::UTF8.GetBytes($Html)
            $HttpListenerContext.Response.ContentLength64 = $MessageBody.Length
            $HttpListenerContext.Response.OutputStream.Write($MessageBody, 0, $MessageBody.Length)
            $HttpListenerContext.Response.OutputStream.Close()
        }

        ## Get HTML Content
        $pathHtml = Join-Path $PSScriptRoot 'internal\SamlRedirect.html'
        if ($PSVersionTable.PSVersion -ge [version]'6.0') {
            $bytesHtml = Get-Content $pathHtml -Raw -AsByteStream
        }
        else {
            $bytesHtml = Get-Content $pathHtml -Raw -Encoding Byte
        }

        ## Generate local HTTP URL and Listener
        [System.UriBuilder] $uriSamlRedirect = New-Object System.UriBuilder -Property @{
            Scheme = 'http'
            Host   = 'localhost'
            Port   = GetAvailableLocalTcpPort
        }
        $HttpListener = New-Object System.Net.HttpListener
        $HttpListener.Prefixes.Add($uriSamlRedirect.Uri.AbsoluteUri)
    }

    process {
        foreach ($Token in $Tokens) {

            if ($SamlEndpoint -ne 'https://adfshelp.microsoft.com/ClaimsXray/TokenResponse') {
                Write-Warning ('The token is being sent to the following web service [{0}]. This command is intended for troubleshooting and should only be used if you trust the service endpoint receiving the token.' -f $SamlEndpoint)
                if (!$PSCmdlet.ShouldProcess($SamlEndpoint, "Send token")) { continue }
            }

            $uriSamlRedirect.Fragment = ConvertTo-QueryString @{
                SAMLResponse = $Token
                ReplyURL     = $SamlEndpoint
            }

            try {
                $HttpListener.Start()
                Start-Process $uriSamlRedirect.Uri.AbsoluteUri
                $HttpListener | RespondToLocalHttpRequest -MessageBody $bytesHtml
            }
            finally { $HttpListener.Stop() }
        }
    }

    end {
        $HttpListener.Dispose()
    }
}

#endregion

#region Test-MsIdAzureAdDeviceRegConnectivity.ps1

<#
.SYNOPSIS
    Test connectivity on Windows OS for Azure AD Device Registration
    
.EXAMPLE
    PS > Test-MsIdAzureAdDeviceRegConnectivity

    Test required hostnames

.EXAMPLE
    PS > Test-MsIdAzureAdDeviceRegConnectivity -AdfsHostname 'adfs.contoso.com'

    Test required hostnames and ADFS server

.INPUTS
    System.String

.LINK
    https://docs.microsoft.com/en-us/samples/azure-samples/testdeviceregconnectivity/testdeviceregconnectivity/

#>
function Test-MsIdAzureAdDeviceRegConnectivity {
    [CmdletBinding()]
    param (
        # ADFS Server
        [Parameter(Mandatory = $false)]
        [string] $AdfsHostname
    )

    begin {
        ## Initialize Critical Dependencies
        $CriticalError = $null
        if ($PSEdition -ne 'Desktop' -or !(Test-PsElevation)) {
            Write-Error 'This command uses a Scheduled Job to run under the system context of a Windows OS which requires Windows PowerShell 5.1 and an elevated session using Run as Administrator.' -ErrorVariable CriticalError
            return
        }
    }

    process {
        ## Return Immediately On Critical Error
        if ($CriticalError) { return }

        Invoke-CommandAsSystem {
            param ([string]$AdfsHostname)
            [System.Security.Principal.WindowsIdentity]::GetCurrent().Name

            [System.Collections.Generic.List[string]] $listHostname = @(
                'login.microsoftonline.com'
                'device.login.microsoftonline.com'
                'enterpriseregistration.windows.net'
                'autologon.microsoftazuread-sso.com'
            )
            if ($AdfsHostname) { $listHostname.Add($AdfsHostname) }

            $listHostname | Test-NetConnection -Port 443 | Format-Table ComputerName, RemotePort, RemoteAddress, TcpTestSucceeded
        } -ArgumentList $AdfsHostname -ErrorAction Stop
    }
}

#endregion

#region Test-MsIdCBATrustStoreConfiguration.ps1

<#
.SYNOPSIS
    Test & report for common mis-configuration issues with the Entra ID Certificate Trust Store

.INPUTS
    None
.NOTES
    This Powershell cmdlet require Windows command line utility Certutil. This cmdlet can only be run from Windows device.
    
    Since the CRL Distribution Point (CDP) needs to be accessible to Entra ID. It is best to run this script from outside
    a corporate network on an internet connected Windows device.
.EXAMPLE
    Test-MsIdCBATrustStoreConfiguration
.LINK
    https://aka.ms/aadcba

#>
function Test-MsIdCBATrustStoreConfiguration {

    begin {
            ## Due to Certutil Dependency will only run on Windows.
            Try
            {
            certutil /? | Out-Null
            }
            Catch
            {
            Write-Host Certutil not found. This cmdlet can only run on Windows -ForegroundColor Red
            Break
            }
            try {
            if (-not(get-module -Name Microsoft.Graph.Identity.DirectoryManagement)) {
                    import-module Microsoft.Graph.Identity.DirectoryManagement
                }
                if (-not(get-module -Name Microsoft.Graph.Identity.SignIns)) {
                    import-module Microsoft.Graph.Identity.SignIns
                }
            }
            catch {
                Write-Host Microsoft Graph SDK not found. Install the Microwsoft Graph SDK -ForegroundColor Red
                Break
            }
            try {
                $context = Get-MgContext
                if ($context -eq $null) {
                                         Connect-MgGraph -NoWelcome
                                        }
                }
            catch {
                Write-Host Unable to Sign-in to MSGraph -ForegroundColor Red
                Break
            }            
                
            
        }

    process {
# Get Org Info
$OrgInfo = Get-MgOrganization

# Get the list of trusted certificate authorities
$trustedCAs = (Get-MgOrganizationCertificateBasedAuthConfiguration -OrganizationId $OrgInfo.Id).CertificateAuthorities

# Loop through each trusted CA
$CompletedResult = @()
foreach ($ca in $trustedCAs) {
    $crlDLTime = $null
    $crldump = $Null
    $crlAKI = $Null
    $crlTU = $Null
    $crlNU = $null    

    Write-Host "Processing $($ca.Issuer)"
    ### High Level Check for correctly formatted CDP URL
    Write-Host " CertificateRevocationListUrl Format Validation Test"
    If($ca.CertificateRevocationListUrl)
    {
    $pattern = '^http:\/\/[\w\-_]+(\.[\w\-_]+)+([\w\-\.,@?^=%&:/~\+#]*[\w\-\@?^=%&/~\+#])\/[^\/]+\.[^\/]+$'
    $crlURLCheckPass = $false
    if ($ca.CertificateRevocationListUrl -match $pattern) {
        Write-Host " Passed" -ForegroundColor Green
        $crlURLCheckPass = $true
    } elseif ($ca.CertificateRevocationListUrl -match '^https:\/\/') {
        Write-Host " HTTPS is not allowed" -ForegroundColor Red
    } else {
        Write-Host " Invalid CDP URL" -ForegroundColor Red
    }
    If(!$crlURLCheckPass)
    {
     ## THis needs to be corrected before other checks
     Write-Host " This CA CDP needs to be corrected. Additional checks for this CA are not processed" -ForegroundColor Red
     Continue
    }
    }

    $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($ca.Certificate)

    $objresult = New-Object System.Object
    $objresult | Add-Member -type NoteProperty -name NotAfter -value $cert.NotAfter
    $objresult | Add-Member -type NoteProperty -name NotBefore -value $cert.NotBefore
    $objresult | Add-Member -type NoteProperty -name Subject -value $cert.Subject
    $objresult | Add-Member -type NoteProperty -name Issuer -value $cert.Issuer
    $objresult | Add-Member -type NoteProperty -name Thumbprint -value $cert.Thumbprint

    ForEach($Extension in $Cert.Extensions) {
        Switch($Extension.Oid.FriendlyName) {
            "Authority Key Identifier" {$objresult | Add-Member -type NoteProperty -name Authority-Key-Identifier -value ($Extension.Format($false)).trimstart("KeyID=")}
            "Subject Key Identifier"   {$objresult | Add-Member -type NoteProperty -name Subject-Key-Identifier -value $Extension.Format($false)}
        } ##Switch
    }## ForEach Extension

    $FullCert = $objresult
    $CompletedResult += $objresult

    # Check the Time validity of the certificate
    $now = Get-Date
    Write-Host " Certificate Time Validity Test"
    if ($now -lt $FullCert.NotBefore -or $now -gt $FullCert.NotAfter) {
        Write-Host " Certificate for $($cert.Subject) is not yet valid or expired" -ForegroundColor Red
        continue
    } Else {
        Write-Host " Passed" -ForegroundColor Green
    }

    # Download the CRL
    $TempDir = [System.IO.Path]::GetTempPath()
    
    If($ca.CertificateRevocationListUrl) {
       Try {
            $crlDLTime = Measure-Command {Invoke-WebRequest -Uri $ca.CertificateRevocationListUrl -OutFile ($TempDir + "crl.crl")}              
        } Catch {}    

        # Check if the CRL was downloaded successfully
        Write-Host " CRL Download & Latency Test"
        if ($null -eq $crlDLTime) {
            Write-Host " Failed to download CRL for $($cert.Subject)" -ForegroundColor Red
            continue
        } Else {     
            if($crlDLTime.TotalSeconds -gt 12) {
                Write-Host " Slow CRL Download (>12 Seconds) for $($cert.Subject)" -ForegroundColor Red
            } Else {
                Write-Host " CRL Download successful for $($cert.Subject)" -ForegroundColor Green
            }
        }
    } Else {
        Write-Host $cert.Subject is not configured with a CRL - Entra ID will not perform CRL check for this CA -ForegroundColor Yellow
        Continue
    }   

    ## Check CRL Size
    Write-Host " CRL Size Test"
    $File = Get-ChildItem ($TempDir + "crl.crl")
    $FileMB = [math]::Round($File.Length/1MB,0)
    if($FileMB -gt 44) {
        Write-Host " CRL is Large - $($FileMB) MB- Users may see intermittent Sign-in errors due to sizes above 45" MB -ForegroundColor Red
    } Else {
        If($FileMB -lt 1)
        {
         Write-Host " Passed - CRL is < 1MB" -ForegroundColor Green
        }
        Else
        {
         Write-Host " Passed - CRL is $($FileMB) MB" -ForegroundColor Green
        }
    }

# Validate CA Cert AKI--> SKI Mapping Logic
Write-Host " Certificate Trust Chain Test"
If($null -eq $FullCert.'Authority-Key-Identifier') {
    If($ca.IsRootAuthority) {
        Write-Host " CA is configured as a Root Authority --> No Parent Issuer expected in store"
    } Else {
        Write-Host " CA is not configured as a Root CA but certificate does not contain Authority Key Identifier(AKI) --> This is unexpected" -ForegroundColor Red
    }
} ## Close Without AKI
Else {
    Write-Host " Expected Issuer Subject Key Identifier (SKI) : $($FullCert.'Authority-Key-Identifier')"
    If(!$ca.IsRootAuthority) {
        If($FullCert.'Authority-Key-Identifier' -eq $FullCert.'Subject-Key-Identifier') {
            Write-Host " CA Authority Key Identifier (AKI) and Subject Key Identifier(SKI) are the same and Cert is not marked as isRootAuthority --> This is unexpected"
        } Else {
            If($trustedCAs.IssuerSKI -notcontains $FullCert.'Authority-Key-Identifier') {
                Write-Host " Certificate issuer $($FullCert.'Authority-Key-Identifier') is not present in the tenant certificate store" -ForegroundColor Red
            } Else {
                Write-Host " Passed" -ForegroundColor Green
            }
        }
    } Else {
        Write-Host " CA is configured as a Root Authority --> No Parent Issuer expected in store"
    }
    }## Close with AKI and the AKI --> SKI Validation Test

    # Dump the CRL file using certutil
    Write-Host " "Running Certutil commands and parsing output *** Can be Slow for Big CRL *** -ForegroundColor White
    $crldump = certutil -dump ($TempDir + "crl.crl")
    # Check for a Next Publish Date in CRLDump and grab before truncating the output for faster processing
        $i = 0
        $crlNP = $Null
    ForEach($Line in $crldump) {
        If ($Line -match "Next CRL Publish") {
            $crlNP = ($crldump[$i+1]).TrimStart(' ') | get-date
            break
        }
        $i++
    }

    ## Shorted CRLDump output for faster parsing
    $i = 0
    ForEach($Line in $crldump) {
        If ($Line -match "CRL Entries:") {
            $crldump = $crldump[0..$i]
            break
        }
        $i++
    }

    $crlAKI = $crldump -match 'KeyID='
    $crlAKI = $crlAKI -replace ' KeyID=',''
    $crlTU = $crldump -match ' ThisUpdate: '
    $crlTU = $crlTU -replace ' ThisUpdate: ','' | get-Date
    $crlNU = $crldump -match ' NextUpdate: '
    $crlNU = $crlNU -replace ' NextUpdate: ','' | get-Date

    # Verify CRL/CERT AKI Match
    If($crlAKI -ne $FullCert.'Subject-Key-Identifier') {
        # Downloaded CRL AKI does not match expected SKI of CA Certificate
        Write-Host " CRL Authority Key Identifier(AKI) Mismatch" -ForegroundColor Red
        Write-Host " CRL AKI : " $crlAKI -ForegroundColor Red
        Write-Host " Expected AKI : " $FullCert.'Subject-Key-Identifier' -ForegroundColor Red

        ## See if the CRL downloaded AKI matches other CA in Store
        If($trustedCAs.IssuerSKI -contains $crlAKI) {
            $MatchedCA = @()
            $MatchedCA = $trustedCAs | Where-Object {$crlAKI -eq $_.IssuerSki}
            If($MatchedCA) {
                Write-Host " Downloaded CRL AKI matches another CA certificate in the trusted store : $($MatchedCA.Issuer)" -ForegroundColor Red
            }
        }
    } Else {
        Write-Host " " Cert SKI matches CRL AKI -ForegroundColor Green
    }

    # Display CRL Lifetime Information
    Write-Host " Additional CRL Information"
    Write-Host " " CRL was Issued on $crlTU
    If($crlNP)
    {
     Write-Host " " CRL nextPublish is $crlNP
    }
    Else
    {
     Write-Host " " CRL does not contain nextPublish date
    }
    Write-Host " " CRL expires on $crlNU
    $TimeLeft = New-TimeSpan -Start $now -End $crlNU
    Write-Host " " CRL is valid for $TimeLeft.Days Days $TimeLeft.Hours Hours
    # TODO Verify the CRL signature
}##ForEach CA
    }
}
Test-MsIdCBATrustStoreConfiguration

#endregion

#region Resolve-MsIdTenant.ps1

<#
.SYNOPSIS
    Resolve TenantId or DomainName to an Azure AD Tenant
    
.DESCRIPTION
    Resolves TenantID or DomainName values to an Azure AD tenant to retrieve metadata about the tenant when resolved

.EXAMPLE
    Resolve-MsIdTenant -Tenant example.com

    Resolve tenant example.com

.EXAMPLE
    Resolve-MsIdTenant -TenantId c19543f3-d36c-435c-ad33-18f11b8c1a15

    Resolve tenant guid c19543f3-d36c-435c-ad33-18f11b8c1a15

.EXAMPLE
    Resolve-MsIdTenant -Tenant "example.com","c19543f3-d36c-435c-ad33-18f11b8c1a15"

    Resolve tenant domain, example.com, and tenant guid, c19543f3-d36c-435c-ad33-18f11b8c1a15.

.EXAMPLE
    $DomainList = get-content .\DomainList.txt
    Resolve-MsIdTenant -Tenant $DomainList

    Resolve tenants in DomainList.txt

.NOTES
    - Azure AD OIDC Metadata endpoint - https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-protocols-oidc#fetch-the-openid-connect-metadata-document
    - A Result of NotFound does not mean that the tenant does not exist at all, but it might be in a different cloud environment. Additional queries to other environments may result in it being found.
    - Requires CrossTenantInfo.ReadBasic.All scope to read MS Graph API info, i.e. Connect-MgGraph -Scopes CrossTenantInfo.ReadBasic.All
    - THIS CODE-SAMPLE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR
    FITNESS FOR A PARTICULAR PURPOSE.
    This sample is not supported under any Microsoft standard support program or service.
    The script is provided AS IS without warranty of any kind. Microsoft further disclaims all
    implied warranties including, without limitation, any implied warranties of merchantability
    or of fitness for a particular purpose. The entire risk arising out of the use or performance
    of the sample and documentation remains with you. In no event shall Microsoft, its authors,
    or anyone else involved in the creation, production, or delivery of the script be liable for
    any damages whatsoever (including, without limitation, damages for loss of business profits,
    business interruption, loss of business information, or other pecuniary loss) arising out of
    the use of or inability to use the sample or documentation, even if Microsoft has been advised
    of the possibility of such damages, rising out of the use of or inability to use the sample script,
    even if Microsoft has been advised of the possibility of such damages.

#>
function Resolve-MsIdTenant {
    [CmdletBinding(DefaultParameterSetName = 'Parameter Set 1',
        SupportsShouldProcess = $false,
        PositionalBinding = $false,
        HelpUri = 'http://www.microsoft.com/',
        ConfirmImpact = 'Medium')]
    [Alias()]
    [OutputType([String])]
    Param (
        # The TenantId in GUID Format or TenantDomainName in DNS Name format to attempt to resolve to Azure AD tenant
        [Parameter(Mandatory = $true,
            Position = 0,
            ValueFromPipeline = $true,
            ValueFromPipelineByPropertyName = $true,
            ValueFromRemainingArguments = $false,
            ParameterSetName = 'Parameter Set 1')]
        [ValidateNotNull()]
        [ValidateNotNullOrEmpty()]
        [Alias("TenantId")]
        [Alias("DomainName")]
        [string[]]
        $TenantValue,
        # Environment to Resolve Azure AD Tenant In (Global, USGov, China, USGovDoD, Germany)
        [Parameter(Mandatory = $false,
            Position = 1,
            ValueFromPipeline = $true,
            ValueFromPipelineByPropertyName = $true,
            ValueFromRemainingArguments = $false,
            ParameterSetName = 'Parameter Set 1')]
        [ValidateSet("Global", "USGov", "China", "USGovDoD", "Germany")]
        [string]
        $Environment = "Global",
        # Include resolving the value to an Azure AD tenant by the OIDC Metadata endpoint
        [switch]
        $SkipOidcMetadataEndPoint



    )

    begin {

        ## Initialize Critical Dependencies
        $CriticalError = $null
        if (!(Test-MgModulePrerequisites -ErrorVariable CriticalError)) { return }
        try { Test-MgModulePrerequisites 'CrossTenantInformation.ReadBasic.All' -ErrorAction Stop | Out-Null }
        catch { Write-Warning $_.Exception.Message }

        $GraphEndPoint = (Get-MgEnvironment -Name $Environment).GraphEndpoint
        $AzureADEndpoint = (Get-MgEnvironment -Name $Environment).AzureADEndpoint

        Write-Verbose ("$(Get-Date -f T) - Using $Environment login endpoint of $AzureADEndpoint")
        Write-Verbose ("$(Get-Date -f T) - Using $Environment Graph endpoint of $GraphEndPoint")
    }

    process {
        ## Return Immediately On Critical Error
        if ($CriticalError) { return }

        $i = 0
        foreach ($value in $TenantValue) {

            $i++
            Write-Verbose ("$(Get-Date -f T) - Checking Value {0} of {1} - Value: {2}" -f $i, ($($TenantValue | Measure-Object).count), $value)

            $ResolveUri = $null
            $ResolvedTenant = [ordered]@{}
            $ResolvedTenant.Environment = $Environment
            $ResolvedTenant.ValueToResolve = $value

            if (Test-IsGuid -StringGuid $value) {
                Write-Verbose ("$(Get-Date -f T) - Attempting to resolve AzureAD Tenant by TenantID {0}" -f $value)
                $ResolveUri = ("{0}/beta/tenantRelationships/findTenantInformationByTenantId(tenantId='{1}')" -f $GraphEndPoint, $Value)
                $ResolvedTenant.ValueFormat = "TenantId"
            }
            else {

                if (Test-IsDnsDomainName -StringDomainName $value) {
                    Write-Verbose ("$(Get-Date -f T) - Attempting to resolve AzureAD Tenant by DomainName {0}" -f $value)
                    $ResolveUri = ("{0}/beta/tenantRelationships/findTenantInformationByDomainName(domainName='{1}')" -f $GraphEndPoint, $Value)
                    $ResolvedTenant.ValueFormat = "DomainName"

                }
            }

            if ($null -ne $ResolveUri) {
                try {

                    Write-Verbose ("$(Get-Date -f T) - Resolving Tenant Information using MS Graph API")
                    $Resolve = Invoke-MgGraphRequest -Method Get -Uri $ResolveUri -ErrorAction Stop | Select-Object tenantId, displayName, defaultDomainName, federationBrandName

                    $ResolvedTenant.Result = "Resolved"
                    $ResolvedTenant.ResultMessage = "Resolved Tenant"
                    $ResolvedTenant.TenantId = $Resolve.TenantId
                    $ResolvedTenant.DisplayName = $Resolve.DisplayName
                    $ResolvedTenant.DefaultDomainName = $Resolve.defaultDomainName
                    $ResolvedTenant.FederationBrandName = $Resolve.federationBrandName
                }
                catch {

                    if ($_.Exception.Message -eq 'Response status code does not indicate success: NotFound (Not Found).') {
                        $ResolvedTenant.Result = "NotFound"
                        $ResolvedTenant.ResultMessage = "NotFound (Not Found)"
                    }
                    else {

                        $ResolvedTenant.Result = "Error"
                        $ResolvedTenant.ResultMessage = $_.Exception.Message

                    }

                    $ResolvedTenant.TenantId = $null
                    $ResolvedTenant.DisplayName = $null
                    $ResolvedTenant.DefaultDomainName = $null
                    $ResolvedTenant.FederationBrandName = $null

                }
            }
            else {

                $ResolvedTenant.ValueFormat = "Unknown"
                Write-Warning ("$(Get-Date -f T) - {0} value to resolve was not in GUID or DNS Name format, and will be skipped!" -f $value)
                $ResolvedTenant.Status = "Skipped"
            }


            if ($true -ne $SkipOidcMetadataEndPoint) {
                $oidcMetadataUri = ("{0}/{1}/v2.0/.well-known/openid-configuration" -f $AzureADEndpoint, $value)

                try {

                    $oidcMetadata = Invoke-RestMethod -Method Get -Uri $oidcMetadataUri -ErrorAction Stop
                    $resolvedTenant.OidcMetadataResult = "Resolved"
                    $resolvedTenant.OidcMetadataTenantId = $oidcMetadata.issuer.split("/")[3]
                    $resolvedTenant.OidcMetadataTenantRegionScope = $oidcMetadata.tenant_region_scope

                }
                catch {

                    $resolvedTenant.OidcMetadataResult = "NotFound"
                    $resolvedTenant.OidcMetadataTenantId = $null
                    $resolvedTenant.OidcMetadataTenantRegionScope = $null

                }
            }
            else {
                $resolvedTenant.OidcMetadataResult = "Skipped"
                $resolvedTenant.OidcMetadataTenantId = $null
                $resolvedTenant.OidcMetadataTenantRegionScope = $null
            }
            Write-Output ([pscustomobject]$ResolvedTenant)
        }

    }

    end {
    }
}


function Test-IsGuid {
    [OutputType([bool])]
    param
    (
        [Parameter(Mandatory = $true)]
        [string]$StringGuid
    )

    $ObjectGuid = [System.Guid]::empty
    return [System.Guid]::TryParse($StringGuid, [System.Management.Automation.PSReference]$ObjectGuid) # Returns True if successfully parsed
}

function Test-IsDnsDomainName {
    [OutputType([bool])]
    param
    (
        [Parameter(Mandatory = $true)]
        [string]$StringDomainName
    )
    $isDnsDomainName = $false
    $DnsHostNameRegex = "\A([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}\Z"
    Write-Verbose ("$(Get-Date -f T) - Checking if DomainName {0} is a valid Dns formatted Uri" -f $StringDomainName)
    if ($StringDomainName -match $DnsHostNameRegex) {
        If ("Dns" -eq [System.Uri]::CheckHostName($StringDomainName)) {
            $isDnsDomainName = $true
        }
    }

    return $isDnsDomainName
}

#endregion

#region Set-MsIdWindowsTlsSettings.ps1

<#
.SYNOPSIS
    Set TLS settings on Windows OS to use more secure TLS protocols.

.EXAMPLE
    PS > Set-MsIdWindowsTlsSettings -DotNetFwUseSystemDefault -DotNetFwUseStrongCrypto -IEDisableLegacySecurityProtocols

    Sets recommended TLS settings for .NET Framework applications and Internet Explorer (Internet Options) which should default to TLS 1.2+ on Windows 8/2012 and later.

.EXAMPLE
    PS > Set-MsIdWindowsTlsSettings -DisableClientLegacyTlsVersions

    Disables TLS 1.1 and earlier for the entire operating system.

#>
function Set-MsIdWindowsTlsSettings {
    [CmdletBinding()]
    param (
        # System-wide .NET Framework setting to allow the operating system to choose the protocol.
        [Parameter(Mandatory = $false)]
        [switch] $DotNetFwUseSystemDefault,
        # System-wide .NET Framework setting to use more secure network protocols (TLS 1.2, TLS 1.1, and TLS 1.0) and blocks protocols that are not secure.
        [Parameter(Mandatory = $false)]
        [switch] $DotNetFwUseStrongCrypto,
        # Internet Explorer (Internet Options) setting to disable use of TLS 1.1 and earlier.
        [Parameter(Mandatory = $false)]
        [switch] $IEDisableLegacySecurityProtocols,
        # System-wide Windows Secure Channel setting to disable all use of TLS 1.1 and earlier.
        [Parameter(Mandatory = $false)]
        [switch] $DisableClientLegacyTlsVersions
    )

    begin {
        ## Initialize Critical Dependencies
        $CriticalError = $null
        if (!(Test-PsElevation)) {
            Write-Error 'This command sets machine-level registery settings which requires an elevated PowerShell session using Run as Administrator.' -ErrorVariable CriticalError
            return
        }
    }

    process {
        ## Return Immediately On Critical Error
        if ($CriticalError) { return }

        ## System-wide .NET Framework Settings
        # https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls#configuring-security-via-the-windows-registry
        if ($PSBoundParameters.ContainsKey('DotNetFwUseSystemDefault')) {
            if ($DotNetFwUseSystemDefault) {
                Write-Host @"
Setting Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\SystemDefaultTlsVersions = 1
Setting Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727\SystemDefaultTlsVersions = 1
Setting Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SystemDefaultTlsVersions = 1
Setting Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319\SystemDefaultTlsVersions = 1
"@
                ## .NET Framework 3.5
                New-Item 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727' -ErrorAction Ignore | Out-Null
                Set-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727' -Name 'SystemDefaultTlsVersions' -Type Dword -Value $DotNetFwUseSystemDefault.ToBool()

                New-Item 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727' -ErrorAction Ignore | Out-Null
                Set-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727' -Name 'SystemDefaultTlsVersions' -Type Dword -Value $DotNetFwUseSystemDefault.ToBool()

                ## .NET Framework 4 and above
                New-Item 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -ErrorAction Ignore | Out-Null
                Set-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Type Dword -Value $DotNetFwUseSystemDefault.ToBool()

                New-Item 'HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -ErrorAction Ignore | Out-Null
                Set-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Type Dword -Value $DotNetFwUseSystemDefault.ToBool()

            }
            else {
                Write-Host @"
Removing Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\SystemDefaultTlsVersions
Removing Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727\SystemDefaultTlsVersions
Removing Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SystemDefaultTlsVersions
Removing Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319\SystemDefaultTlsVersions
"@
                ## .NET Framework 3.5
                Remove-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727' -Name 'SystemDefaultTlsVersions' -ErrorAction Ignore
                Remove-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727' -Name 'SystemDefaultTlsVersions' -ErrorAction Ignore

                ## .NET Framework 4 and above
                Remove-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -ErrorAction Ignore
                Remove-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -ErrorAction Ignore
            }
        }

        if ($PSBoundParameters.ContainsKey('DotNetFwUseStrongCrypto')) {
            if ($DotNetFwUseStrongCrypto) {
                Write-Host @"
Setting Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\SchUseStrongCrypto = 1
Setting Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727\SchUseStrongCrypto = 1
Setting Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SchUseStrongCrypto = 1
Setting Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319\SchUseStrongCrypto = 1
"@
                ## .NET Framework 3.5
                New-Item 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727' -ErrorAction Ignore | Out-Null
                Set-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727' -Name 'SchUseStrongCrypto' -Type Dword -Value $DotNetFwUseStrongCrypto.ToBool()

                New-Item 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727' -ErrorAction Ignore | Out-Null
                Set-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727' -Name 'SchUseStrongCrypto' -Type Dword -Value $DotNetFwUseStrongCrypto.ToBool()

                ## .NET Framework 4 and above
                New-Item 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -ErrorAction Ignore | Out-Null
                Set-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Type Dword -Value $DotNetFwUseStrongCrypto.ToBool()

                New-Item 'HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -ErrorAction Ignore | Out-Null
                Set-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Type Dword -Value $DotNetFwUseStrongCrypto.ToBool()
            }
            else {
                Write-Host @"
Removing Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\SchUseStrongCrypto
Removing Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727\SchUseStrongCrypto
Removing Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SchUseStrongCrypto
Removing Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319\SchUseStrongCrypto
"@
                ## .NET Framework 3.5
                Remove-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727' -Name 'SchUseStrongCrypto' -ErrorAction Ignore
                Remove-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727' -Name 'SchUseStrongCrypto' -ErrorAction Ignore

                ## .NET Framework 4 and above
                Remove-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -ErrorAction Ignore
                Remove-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -ErrorAction Ignore
            }
        }

        ## Internet Explorer (Internet Options) Settings
        if ($PSBoundParameters.ContainsKey('IEDisableLegacySecurityProtocols')) {
            Write-Host @"
Setting Registery Value: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SecurityProtocols
Setting Registery Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SecurityProtocols
The latter is only relevant when loopback processing of group policy is enabled.
"@
            New-Item 'Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -ErrorAction Ignore | Out-Null
            if ($IEDisableLegacySecurityProtocols) {
                ## Current User Internet Options
                $SecurityProtocols = Get-ItemPropertyValue 'Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -Name 'SecureProtocols' -ErrorAction Ignore
                $SecurityProtocols = $SecurityProtocols -band -bnot 32 -band -bnot 128 -band -bnot 512  # Disable SSL 3.0, TLS 1.0, and TLS 1.1
                $SecurityProtocols = $SecurityProtocols -bor 2048 -bor 8192  # Enable TLS 1.2 and TLS 1.3
                Set-ItemProperty 'Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -Name 'SecureProtocols' -Type Dword -Value $SecurityProtocols

                ## System-wide Internet Options (Only relevant when loopback processing of group policy is enabled)
                # https://docs.microsoft.com/en-us/troubleshoot/windows-server/group-policy/loopback-processing-of-group-policy
                try { $SecurityProtocols = Get-ItemPropertyValue 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings' -Name 'SecureProtocols' -ErrorAction Ignore } catch {}
                $SecurityProtocols = $SecurityProtocols -band -bnot 32 -band -bnot 128 -band -bnot 512  # Disable SSL 3.0, TLS 1.0, and TLS 1.1
                $SecurityProtocols = $SecurityProtocols -bor 2048 -bor 8192  # Enable TLS 1.2 and TLS 1.3
                Set-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings' -Name 'SecureProtocols' -Type Dword -Value $SecurityProtocols
            }
            else {
                ## Current User Internet Options
                $SecurityProtocols = Get-ItemPropertyValue 'Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -Name 'SecureProtocols' -ErrorAction Ignore
                $SecurityProtocols = $SecurityProtocols -bor 128 -bor 512  # Re-Enable TLS 1.0 and TLS 1.1
                Set-ItemProperty 'Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -Name 'SecureProtocols' -Type Dword -Value $SecurityProtocols

                ## System-wide Internet Options (Only relevant when loopback processing of group policy is enabled)
                # https://docs.microsoft.com/en-us/troubleshoot/windows-server/group-policy/loopback-processing-of-group-policy
                try { $SecurityProtocols = Get-ItemPropertyValue 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings' -Name 'SecureProtocols' -ErrorAction Ignore } catch {}
                $SecurityProtocols = $SecurityProtocols -bor 128 -bor 512  # Re-Enable TLS 1.0 and TLS 1.1
                Set-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings' -Name 'SecureProtocols' -Type Dword -Value $SecurityProtocols
            }
        }

        ## System-wide Windows Settings
        # https://docs.microsoft.com/en-US/troubleshoot/windows-server/windows-security/restrict-cryptographic-algorithms-protocols-schannel
        if ($PSBoundParameters.ContainsKey('DisableClientLegacyTlsVersions')) {
            [string[]] $LegacyTls = 'SSL 2.0', 'SSL 3.0', 'TLS 1.0', 'TLS 1.1'
            if ($DisableClientLegacyTlsVersions) {
                New-Item "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols" -ErrorAction Ignore | Out-Null
                foreach ($Protocol in $LegacyTls) {
                    Write-Host @"
Setting Registery Value: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$Protocol\Client\Enabled = 0
"@
                    New-Item "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$Protocol" -ErrorAction Ignore | Out-Null
                    New-Item "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$Protocol\Client" -ErrorAction Ignore | Out-Null
                    Set-ItemProperty "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$Protocol\Client" -Name 'Enabled' -Type Dword -Value (!$DisableClientLegacyTlsVersions.ToBool())
                }
            }
            else {
                foreach ($Protocol in $LegacyTls) {
                    Write-Host @"
Removing Registery Value: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$Protocol\Client\Enabled
"@
                    Remove-ItemProperty "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$Protocol\Client" -Name 'Enabled' -ErrorAction Ignore
                }
            }
        }
    }

    end {
        ## Return Immediately On Critical Error
        if ($CriticalError) { return }

        Write-Warning "These setting updates only effect new process so you will need to restart your apps for these settings to take effect."
    }
}

#endregion

#region Get-MsIdSigningKeyThumbprint.ps1

<#
.SYNOPSIS
    Get signing keys used by Azure AD.
    
.EXAMPLE
    PS > Get-MsIdSigningKeyThumbprint

    Get common Azure AD signing key thumbprints.

.EXAMPLE
    PS > Get-MsIdSigningKeyThumbprint -Tenant <tenandId>

    Get Azure AD signing key thumbprints for the given tenant.

.EXAMPLE
    PS > Get-MsIdSigningKeyThumbprint -Tenant <tenandId> -Latest

    Get the latest Azure AD signing key thumbprint for the given tenant.

.EXAMPLE
    PS > Get-MsIdSigningKeyThumbprint -DownloadPath C:\temp

    Export the certificates to a folder destination.

#>

function Get-MsIdSigningKeyThumbprint{
    Param(
        # Tenant ID
        $Tenant = "common",

        # Cloud environment
        $Environment="prod",

        # Return the latest certificate
        [switch]$Latest,

        # Location to save certificate
        [string]$DownloadPath
    )

    process {

        $authority = "https://login.microsoftonline.com/"
        if($Environment.ToLower() -eq "china"){ $authority = "https://login.chinacloudapi.cn/" }

        $keysUrl = "$authority$Tenant/discovery/keys";
        $keysJson = ConvertFrom-Json (Invoke-WebRequest $keysUrl).Content

        $certs = @()
        foreach ($key in $keysJson.keys) {
            $bytes = [System.Text.Encoding]::UTF8.GetBytes($key.x5c)
            $cert = new-object System.Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList @(,$bytes)

            $certs += new-object PSObject -Property @{ 'Kid'=$key.kid; 'Thumbprint'=$cert.Thumbprint; 'NotAfter'=$cert.NotAfter; 'NotBefore'=$cert.NotBefore; 'Cert'=$cert }
        }

        if ($Latest) {
            $certs = $certs | sort -Descending {$_.NotBefore} | Select -First 1
        }

        if ($DownloadPath) {
            foreach ($cert in $certs) {
                $path = Join-Path $DownloadPath ($cert.Thumbprint.ToLower() + ".cer")
                [System.IO.File]::WriteAllBytes($path, $cert.Cert.Export("Cert"));
                Write-Host "Certificate successfully exported to $path"
            }
        }else{
            Write-Output $certs.Thumbprint 
        }
    }
}
#endregion

#region Update-MsIdApplicationSigningKeyThumbprint.ps1

<#
.SYNOPSIS
    Update a Service Princpal's preferredTokenSigningKeyThumbprint to the specified certificate thumbprint

.DESCRIPTION
    Update a Service Princpal's preferredTokenSigningKeyThumbprint to the specified certificate thumbprint
    For more information on Microsoft Identity platorm signing key rollover see https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-signing-key-rollover

.EXAMPLE
    PS > Update-MsIdApplicationSigningKeyThumbprint -ApplicationId <ApplicationId> -KeyThumbprint <Thumbprint>

    Update Application's preferred signing key to the specified thumbprint

.EXAMPLE
    PS > Update-MsIdApplicationSigningKeyThumbprint -ApplicationId <ApplicationId> -Default

    Update Application's preferred signing key to default value null

.EXAMPLE
    PS > Get-MsIdSigningKeyThumbprint -Latest | Update-MsIdApplicationSigningKeyThumbprint -ApplicationId <ApplicationId>

    Get the latest signing key thumbprint and set it as the perferred signing key on the application

#>
function Update-MsIdApplicationSigningKeyThumbprint {
    [CmdletBinding()]
    param (
        # Tenant ID
        $Tenant = "common",

        # Application ID
        [parameter(mandatory = $true)]
        [string]$ApplicationId,

        # Thumbprint of certificate
        [parameter(ValueFromPipeline = $true)]
        [string]$KeyThumbprint,

        # Return preferredTokenSigningKeyThumbprint to default value
        [parameter(parametersetname = "Default")]
        [switch]$Default
    )

    begin {
        ## Initialize Critical Dependencies
        $CriticalError = $null
        if (!(Test-MgCommandPrerequisites 'Get-MgServicePrincipal', 'Update-MgServicePrincipal' -MinimumVersion 2.8.0 -ErrorVariable CriticalError)) { return }
    }

    process {
        if ($CriticalError) { return }

        if ($Default) {
            Write-Verbose "Default flag set. preferredTokenSigningKeyThumbprint will be set to null "
            $KeyThumbprint = $null
        }

        if ($null -ne $KeyThumbprint) {
            $KeyThumbprint = $KeyThumbprint.Replace(" ", "").ToLower()
        }

        $body = @{preferredTokenSigningKeyThumbprint = $KeyThumbprint } | ConvertTo-Json
        $body = $body.replace('""','null')

        Write-Verbose "Retrieving Service Principal"
        $sp = Get-MgServicePrincipal -Filter "appId eq '$ApplicationId'"

        if ($null -ne $sp) {
            Write-Verbose "Service Principal found: $($sp.DisplayName)"
            Write-Verbose "Updating Service Principal preferredTokenSigningKeyThumbprint"
            Invoke-MgGraphRequest -Method "PATCH" -Uri "https://graph.microsoft.com/v1.0/servicePrincipals/$($sp.id)" -Body $body
        }
        else {
            Write-Error "Service principal was not found - Please check the Client (Application) ID"
        }
    }
}

#endregion

#region Get-MsIdIsViralUser.ps1

<#
.SYNOPSIS
    Returns true if the user's mail domain is a viral (unmanaged) Azure AD tenant.

    To learn more about viral tenants see [Take over an unmanaged directory as administrator in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/enterprise-users/domains-admin-takeover)
    
.EXAMPLE
    PS > Get-MsIdIsViralUser -Mail john@yopmail.net

    Check if the mail address is from a viral tenant.

#>
function Get-MsIdIsViralUser {
    [CmdletBinding()]

    param (
        # The email address of the external user.
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, ValueFromRemainingArguments = $false)]
        [string] $Mail
    )

    $userRealm = Get-MsftUserRealm $Mail

    $isExternalAzureADViral = (Get-ObjectPropertyValue $userRealm 'IsViral') -eq "True"

    return $isExternalAzureADViral
}

#endregion

#region Get-MsIdHasMicrosoftAccount.ps1

<#
.SYNOPSIS
    Returns true if the user's mail is a Microsoft Account
    
.EXAMPLE
    PS > Get-MsIdHasMicrosoftAccount -Mail john@yopmail.net

    Check if the mail address has a Microsoft account

#>
function Get-MsIdHasMicrosoftAccount {
    [CmdletBinding()]

    param (
        # The email address of the external user.
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, ValueFromRemainingArguments = $false)]
        [string] $Mail
    )

    $userRealm = Get-MsftUserRealm $Mail -CheckForMicrosoftAccount
    
    $isMSA = (Get-ObjectPropertyValue $userRealm 'MicrosoftAccount') -eq "0"

    return $isMSA
}

#endregion

#region Get-MsIdGroupWritebackConfiguration.ps1

<#
.SYNOPSIS
    Gets the group writeback configuration for the group ID

.EXAMPLE
    PS > Get-MsIdGroupWritebackConfiguration -GroupId <GroupId>

    Get Group Writeback for Group ID

.EXAMPLE
    PS > Get-MsIdGroupWritebackConfiguration -Group <Group>

    Get Group Writeback for Group

.EXAMPLE
    PS > Get-mggroup -filter "groupTypes/any(c:c eq 'Unified')"|Get-MsIdGroupWritebackConfiguration -verbose

    Get the WritebackConfiguration for all M365 Groups in the tenant

.NOTES
    THIS CODE-SAMPLE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR
    FITNESS FOR A PARTICULAR PURPOSE.
    This sample is not supported under any Microsoft standard support program or service.
    The script is provided AS IS without warranty of any kind. Microsoft further disclaims all
    implied warranties including, without limitation, any implied warranties of merchantability
    or of fitness for a particular purpose. The entire risk arising out of the use or performance
    of the sample and documentation remains with you. In no event shall Microsoft, its authors,
    or anyone else involved in the creation, production, or delivery of the script be liable for
    any damages whatsoever (including, without limitation, damages for loss of business profits,
    business interruption, loss of business information, or other pecuniary loss) arising out of
    the use of or inability to use the sample or documentation, even if Microsoft has been advised
    of the possibility of such damages, rising out of the use of or inability to use the sample script,
    even if Microsoft has been advised of the possibility of such damages.
#>
function Get-MsIdGroupWritebackConfiguration {
    [CmdletBinding(DefaultParameterSetName = 'ObjectId')]
    param (
        # Group Object ID
        [Parameter(Mandatory = $true, ParameterSetName = 'ObjectId', Position = 0, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
        [ValidateScript( {
                try {
                    [System.Guid]::Parse($_) | Out-Null
                    $true
                }
                catch {
                    throw "$_ is not a valid ObjectID format. Valid value is a GUID format only."
                }
            })]
        [string[]] $GroupId,

        # Group Object
        [Parameter(Mandatory = $true, ParameterSetName = 'GraphGroup', Position = 1, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
        [Object[]] $Group
    )

    begin {
        ## Initialize Critical Dependencies
        $CriticalError = $null
        if (!(Test-MgCommandPrerequisites 'Get-MgGroup' -ApiVersion beta -MinimumVersion 2.8.0 -ErrorVariable CriticalError)) { return }
    }

    process {
        if ($CriticalError) { return }

        if ($null -ne $Group) {
            $GroupId = $group.id
        }

        foreach ($gid in $GroupId) {
            Write-Verbose ("Retrieving Group Writeback Settings for Group ID {0}" -f $gid)
            $checkedGroup = [ordered]@{}
            $mgGroup = $null
            $cloudGroupType = $null


            Write-Verbose ("Retrieving mgGroup for Group ID {0}" -f $gid)
            $mgGroup = Get-MgGroup -GroupId $gid
            Write-Debug ($mgGroup | Select-Object -Property Id, DisplayName, GroupTypes, SecurityEnabled, OnPremisesSyncEnabled -Expand WritebackConfiguration | Select-Object -Property Id, DisplayName, GroupTypes, SecurityEnabled, OnPremisesSyncEnabled, IsEnabled, OnPremisesGroupType | Out-String)

            $checkedGroup.id = $mgGroup.Id
            $checkedGroup.DisplayName = $mgGroup.DisplayName
            $checkedGroup.SourceOfAuthority = if ($mgGroup.OnPremisesSyncEnabled -eq $true) { "On-Premises" }else { "Cloud" }


            if ($mgGroup.GroupTypes -contains 'Unified') {
                $cloudGroupType = "M365"
            }
            else {

                if ($mgGroup.SecurityEnabled -eq $true) {
                    $cloudGroupType = "Security"

                    if ($null -notlike $mgGroup.ProxyAddresses) {
                        $cloudGroupType = "Mail-Enabled Security"
                    }
                }
                else {
                    $cloudGroupType = "Distribution"
                }
            }


            $checkedGroup.Type = $cloudGroupType

            if ($checkedGroup.SourceOfAuthority -eq 'On-Premises') {
                $checkedGroup.WriteBackEnabled = "N/A"
                $checkedGroup.WriteBackOnPremGroupType = "N/A"
                $checkedGroup.EffectiveWriteBack = "On-Premises is Source Of Authority for Group"
            }
            else {

                switch ($checkedGroup.Type) {
                    "Distribution" {
                        $checkedGroup.WriteBackEnabled = "N/A"
                        $checkedGroup.WriteBackOnPremGroupType = "N/A"
                        $checkedGroup.EffectiveWriteBack = "Cloud Distribution Groups are not supported for group writeback to on-premises. Use M365 groups instead."

                    }

                    "Mail-Enabled Security" {
                        $checkedGroup.WriteBackEnabled = "N/A"
                        $checkedGroup.WriteBackOnPremGroupType = "N/A"
                        $checkedGroup.EffectiveWriteBack = "Cloud mail-enabled security groups are not supported for group writeback to on-premises. Use M365 groups instead."

                    }
                    Default {

                        $writebackEnabled = $null

                        switch ($mgGroup.writebackConfiguration.isEnabled) {
                            $true { $writebackEnabled = "TRUE" }
                            $false { $writebackEnabled = "FALSE" }
                            $null { $writebackEnabled = "NOTSET" }
                        }


                        if ($null -ne ($mgGroup.writebackConfiguration.onPremisesGroupType)) {
                            $WriteBackOnPremGroupType = $mgGroup.writebackConfiguration.onPremisesGroupType
                        }
                        else {
                            if ($checkedGroup.Type -eq 'M365') {
                                $WriteBackOnPremGroupType = "universalDistributionGroup (M365 DEFAULT)"
                            }
                            else {
                                $WriteBackOnPremGroupType = "universalSecurityGroup (Security DEFAULT)"
                            }
                        }

                        $checkedGroup.WriteBackEnabled = $writebackEnabled
                        $checkedGroup.WriteBackOnPremGroupType = $WriteBackOnPremGroupType

                        if ($checkedGroup.Type -eq 'M365') {
                            if ($checkedGroup.WriteBackEnabled -ne $false) {
                                $checkedGroup.EffectiveWriteBack = ("Cloud M365 group will be written back onprem as {0} grouptype" -f $WriteBackOnPremGroupType)
                            }
                            else {
                                $checkedGroup.EffectiveWriteBack = "Cloud M365 group will NOT be written back on-premises"
                            }
                        }

                        if ($checkedGroup.Type -eq 'Security') {
                            if ($checkedGroup.WriteBackEnabled -eq $true) {
                                $checkedGroup.EffectiveWriteBack = ("Cloud security group will be written back onprem as {0} grouptype" -f $WriteBackOnPremGroupType)
                            }
                            else {
                                $checkedGroup.EffectiveWriteBack = "Cloud security will NOT be written back on-premises"
                            }
                        }
                    }
                }
            }
            Write-Output ([pscustomobject]$checkedGroup)

        }
    }

    end {
        if ($CriticalError) { return }
    }
}

#endregion

#region Update-MsIdGroupWritebackConfiguration.ps1

<#
.SYNOPSIS
    Update an Azure AD cloud group settings to writeback as an AD on-premises group

.EXAMPLE
    PS > Update-MsIdGroupWritebackConfiguration -GroupId <GroupId> -WriteBackEnabled $false

    Disable Group Writeback for Group ID

.EXAMPLE
    PS > Update-MsIdGroupWritebackConfiguration -GroupId <GroupId> -WriteBackEnabled $true -WriteBackOnPremGroupType universalDistributionGroup

    Enable Group Writeback for Group ID as universalDistributionGroup on-premises
.EXAMPLE
    PS > Update-MsIdGroupWritebackConfiguration -GroupId <GroupId> -WriteBackEnabled $false

    Disable Group Writeback for Group ID
.EXAMPLE
    PS > Get-mggroup -filter "groupTypes/any(c:c eq 'Unified')"|Update-MsIdGroupWritebackConfiguration -WriteBackEnabled $false -verbose

    For all M365 Groups in the tenant, set the WritebackEnabled to false to prevent them from being written back on-premises
.NOTES
    - Updating Role Assignable Groups or Privileged Access Groups require PrivilegedAccess.ReadWrite.AzureADGroup permission scope

    THIS CODE-SAMPLE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR
    FITNESS FOR A PARTICULAR PURPOSE.
    This sample is not supported under any Microsoft standard support program or service.
    The script is provided AS IS without warranty of any kind. Microsoft further disclaims all
    implied warranties including, without limitation, any implied warranties of merchantability
    or of fitness for a particular purpose. The entire risk arising out of the use or performance
    of the sample and documentation remains with you. In no event shall Microsoft, its authors,
    or anyone else involved in the creation, production, or delivery of the script be liable for
    any damages whatsoever (including, without limitation, damages for loss of business profits,
    business interruption, loss of business information, or other pecuniary loss) arising out of
    the use of or inability to use the sample or documentation, even if Microsoft has been advised
    of the possibility of such damages, rising out of the use of or inability to use the sample script,
    even if Microsoft has been advised of the possibility of such damages.

#>
function Update-MsIdGroupWritebackConfiguration {
    [CmdletBinding(DefaultParameterSetName = 'ObjectId')]
    param (
        # Group Object ID
        [Parameter(Mandatory = $true, ParameterSetName = 'ObjectId', Position = 0, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
        [ValidateScript( {
                try {
                    [System.Guid]::Parse($_) | Out-Null
                    $true
                }
                catch {
                    throw "$_ is not a valid ObjectID format. Valid value is a GUID format only."
                }
            })]
        [string[]] $GroupId,

        # Group Object
        [Parameter(Mandatory = $true, ParameterSetName = 'GraphGroup', Position = 1, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
        [Object[]] $Group,

        # WritebackEnabled true or false
        [Parameter(Mandatory = $true, Position = 2, ValueFromPipeline = $false, ValueFromPipelineByPropertyName = $false)]
        [bool] $WriteBackEnabled,

        # On-Premises Group Type cloud group is written back as
        [Parameter(Mandatory = $false, Position = 3, ValueFromPipeline = $false, ValueFromPipelineByPropertyName = $false)]
        [ValidateSet("universalDistributionGroup", "universalSecurityGroup", "universalMailEnabledSecurityGroup")]
        [string] $WriteBackOnPremGroupType
    )

    begin {
        ## Initialize Critical Dependencies
        $CriticalError = $null
        if (!(Test-MgCommandPrerequisites 'Get-MgGroup', 'Update-MgGroup' -ApiVersion beta -MinimumVersion 2.8.0 -ErrorVariable CriticalError)) { return }
    }

    process {
        if ($CriticalError) { return }

        if ($null -ne $Group) {
            $GroupId = $group.id
        }

        foreach ($gid in $GroupId) {
            $currentIsEnabled = $null
            $currentOnPremGroupType = $null
            $mgGroup = $null
            $groupSourceOfAuthority = $null
            $wbc = @{}
            $skipUpdate = $false

            Write-Verbose ("Retrieving mgGroup for Group ID {0}" -f $gid)
            $mgGroup = Get-MgGroup -GroupId $gid
            Write-Debug ($mgGroup | Select-Object -Property Id, DisplayName, GroupTypes, SecurityEnabled, OnPremisesSyncEnabled -Expand WritebackConfiguration | Select-Object -Property Id, DisplayName, GroupTypes, SecurityEnabled, OnPremisesSyncEnabled, IsEnabled, OnPremisesGroupType | Out-String)


            $currentOnPremGroupType = $mgGroup.WritebackConfiguration.OnPremisesGroupType

            $currentIsEnabled = $mgGroup.WritebackConfiguration.IsEnabled
            $cloudGroupType = $null

            if ($mggroup.GroupTypes -contains 'Unified') {
                $cloudGroupType = "M365"
            }
            else {

                if ($mgGroup.SecurityEnabled -eq $true) {
                    $cloudGroupType = "Security"

                    if ($null -notlike $mgGroup.ProxyAddresses) {
                        $cloudGroupType = "Mail-Enabled Security"
                    }
                }
                else {
                    $cloudGroupType = "Distribution"
                }
            }

            $groupSourceOfAuthority = if ($mgGroup.OnPremisesSyncEnabled -eq $true) { "On-Premises" }else { "Cloud" }


            if ($groupSourceOfAuthority -eq 'On-Premises') {
                $skipUpdate = $true
                Write-Verbose ("Group {0} is an on-premises SOA group and will not be updated." -f $gid)
            }
            else {

                switch ($cloudGroupType) {
                    "Distribution" {
                        $skipUpdate = $true
                        Write-Error ("Group {0} is a cloud distribution group and will NOT be updated. Cloud Distribution Groups are not supported for group writeback to on-premises. Use M365 groups instead." -f $gid)

                    }
                    "Mail-Enabled Security" {
                        $skipUpdate = $true
                        Write-Error ("Group {0} is a mail-enabled security group and will NOT be updated. Cloud mail-enabled security groups are not supported for group writeback to on-premises. Use M365 groups instead." -f $gid)

                    }
                    "Security" {


                        Write-Verbose ("Group {0} is a Security Group with current IsEnabled of {1} and onPremisesGroupType of {2}." -f $gid, $currentIsEnabled, $currentOnPremGroupType)

                        if ($currentIsEnabled -eq $WriteBackEnabled) {
                            $skipUpdate = $true
                            Write-Verbose "WriteBackEnabled $WriteBackEnabled already set for Security Group!"
                        }
                        else {

                            $wbc.isEnabled = $WriteBackEnabled

                            if ($null -eq $currentOnPremGroupType -or $currentOnPremGroupType -ne 'universalSecurityGroup') {
                                if ($null -ne $WriteBackOnPremGroupType -and $WriteBackOnPremGroupType -ne 'universalSecurityGroup') {
                                    $skipUpdate = $true
                                    Write-Error ("{0} is not a cloud security group and can only be written back as a univeralSecurityGroup type which is not currently set for this group!" -f $gid)

                                }
                                else {


                                    if ($null -eq $currentOnPremGroupType -ne $WriteBackOnPremGroupType) {
                                        $wbc.onPremisesGroupType = $WriteBackOnPremGroupType
                                    }
                                }
                            }

                        }
                    }

                    "M365" {

                        Write-Verbose ("Group {0} is an M365 Group with current IsEnabled of {1} and onPremisesGroupType of {2}." -f $gid, $currentIsEnabled, $currentOnPremGroupType)
                        if ($currentIsEnabled -eq $WriteBackEnabled) {
                            $skipUpdate = $true
                            Write-Verbose "WriteBackEnabled $WriteBackEnabled already set for M365 Group!"
                        }
                        else {

                            $wbc.isEnabled = $WriteBackEnabled

                            if ($currentOnPremGroupType -ne $WriteBackOnPremGroupType) {


                                $wbc.onPremisesGroupType = $WriteBackOnPremGroupType

                            }

                        }

                    }

                }

                if ($wbc.Count -eq 0) {
                    $skipUpdate = $true
                }

                if ($skipUpdate -ne $true) {
                    Write-Debug ($wbc | Out-String)
                    Write-Verbose ("Updating Group {0} with Group Writeback settings of Writebackenabled={1} and onPremisesGroupType={2}" -f $gid, $WriteBackEnabled, $WriteBackOnPremGroupType )

                    if ($null -like $wbc.onPremisesGroupType) {

                        # Workaround for null properties issue filed on GitHub - https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/833
                        $root = @{}
                        $root.writebackConfiguration = $wbc
                        $jbody = ($root | ConvertTo-Json -Depth 10 -Compress).Replace('""', 'null')

                        Update-MgGroup -GroupId $gid -BodyParameter $jbody
                    }
                    else {
                        Update-MgGroup -GroupId $gid -writeBackConfiguration $wbc -ErrorAction Stop
                    }

                    Write-Verbose ("Group Updated!")
                }
                else {

                    Write-Verbose ("No effective updates to group applied!")
                }

            }
        }
    }

    end {
        if ($CriticalError) { return }
    }
}

#endregion

#region Get-MsIdUnredeemedInvitedUser.ps1

<#
.SYNOPSIS
    Retrieve Users who have not had interactive sign ins since XX days ago

.EXAMPLE
    PS > Get-MsIdUnredeemedInvitedUser -InvitedBeforeDaysAgo 30

    Retrieve Users who have been invited but have not redeemed greater than XX days ago

.INPUTS
    System.Int
.NOTES
    - Updating Role Assignable Groups or Privileged Access Groups require PrivilegedAccess.ReadWrite.AzureADGroup permission scope
    THIS CODE-SAMPLE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR
    FITNESS FOR A PARTICULAR PURPOSE.
    This sample is not supported under any Microsoft standard support program or service.
    The script is provided AS IS without warranty of any kind. Microsoft further disclaims all
    implied warranties including, without limitation, any implied warranties of merchantability
    or of fitness for a particular purpose. The entire risk arising out of the use or performance
    of the sample and documentation remains with you. In no event shall Microsoft, its authors,
    or anyone else involved in the creation, production, or delivery of the script be liable for
    any damages whatsoever (including, without limitation, damages for loss of business profits,
    business interruption, loss of business information, or other pecuniary loss) arising out of
    the use of or inability to use the sample or documentation, even if Microsoft has been advised
    of the possibility of such damages, rising out of the use of or inability to use the sample script,
    even if Microsoft has been advised of the possibility of such damages.

#>
function Get-MsIdUnredeemedInvitedUser {
    [CmdletBinding()]
    [OutputType([string])]
    param (
        # External User Invited XX Days Ago
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 1)]
        [int] $InvitedBeforeDaysAgo = 30
    )

    begin {
        ## Initialize Critical Dependencies
        $CriticalError = $null
        if (!(Test-MgCommandPrerequisites 'Get-MgUser' -MinimumVersion 2.8.0 -RequireListPermissions -ErrorVariable CriticalError)) { return }
    }

    process {
        if ($CriticalError) { return }

        $queryUsers = $null

        $queryDate = Get-Date (Get-Date).AddDays($(0 - $InvitedBeforeDaysAgo)) -UFormat %Y-%m-%dT00:00:00Z

        $UnredeemedFilter = "(externalUserState eq 'PendingAcceptance')"
        #$UnredeemedFilter = "(externalUserState eq 'PendingAcceptance') and createdDateTime -lt '$queryDate'"
        #To Add: Detection for invited users without externalUserState values

        $queryFilter = $UnredeemedFilter

        Write-Debug ("Retrieving Invited Users who are not redeemed with filter {0}" -f $queryFilter)
        $queryUsers = Get-MgUser -Filter $queryFilter -All:$true -OrderBy 'createdDateTime' -Property ExternalUserState, ExternalUserStateChangeDateTime, UserPrincipalName, Id, DisplayName, mail, userType, AccountEnabled, CreatedDateTime -ConsistencyLevel eventual -CountVariable UnredeemedUsersCount

        Write-Verbose ("{0} Unredeemed Invite Users Found!" -f $UnredeemedUsersCount)
        foreach ($userObject in $queryUsers) {
            Write-Verbose ("User {0}" -f $userObject.id)
            $checkedUser = [ordered] @{}
            $checkedUser.UserID = $userObject.Id
            $checkedUser.DisplayName = $userObject.DisplayName
            $checkedUser.Mail = $userObject.Mail

            $checkedUser.AccountEnabled = $userObject.AccountEnabled
            $checkedUser.ExternalUserState = $userObject.ExternalUserState
            If ($null -eq $userObject.ExternalUserStateChangeDateTime) {
                $checkedUser.ExternalUserStateChangeDateTime = "Unknown"
                $checkedUser.InvitedDaysAgo = "Unknown"

            }
            else {
                $checkedUser.ExternalUserStateChangeDateTime = $userObject.ExternalUserStateChangeDateTime
                $checkedUser.InvitedDaysAgo = (New-TimeSpan -Start $userObject.ExternalUserStateChangeDateTime -End (Get-Date)).Days

            }



            $checkedUser.UserPrincipalName = $userObject.UserPrincipalName
            $checkedUser.UserType = $userObject.UserType
            $checkedUser.Identities = $userObject.Identities
            If ($null -eq $userObject.CreatedDateTime) {
                $checkedUser.CreatedDateTime = "Unknown"
                $checkedUser.CreatedDaysAgo = "Unknown"
            }
            else {
                $checkedUser.CreatedDateTime = $userObject.CreatedDateTime
                $checkedUser.CreatedDaysAgo = (New-TimeSpan -Start $userObject.CreatedDateTime -End (Get-Date)).Days
            }

            if ($checkedUser.ExternalUserStateChangeDateTime -eq 'Unknown' -or $checkedUser.InvitedDaysAgo -ge $InvitedBeforeDaysAgo) {
                Write-Output ([pscustomobject]$checkedUser)
            }
        }

    }
}

#endregion

#region Import-MsIdAdfsSampleApp.ps1

<#
.SYNOPSIS
        Imports a list availabe sample AD FS relyng party trust applications available in this module, the list is created by the Get-MsIdAdfsSampleApps cmdlet. These applications do NOT use real endpoints and are meant to be used as test applications.
.EXAMPLE
    PS >Get-MsIdAdfsSampleApp | Import-MsIdAdfsSampleApp

    Import the full list of sample AD FS apps to the local AD FS server.

.EXAMPLE
    PS >Get-MsIdAdfsSampleApp | Import-MsIdAdfsSampleApp -NamePreffix 'MsId '

    Import the full list of sample AD FS apps to the local AD FS server, adding the MsId prefix to the app name.

.EXAMPLE
    PS >Get-MsIdAdfsSampleApp SampleAppName | Import-MsIdAdfsSampleApp

    Import only the SampleAppName sample AD FS app to the local AD FS server (replace SampleAppName by one of the available apps).
#>
function Import-MsIdAdfsSampleApp {
    [CmdletBinding()]
    param(
      # Application identifier
      [Parameter(Mandatory=$true,
        Position=0,
        ValueFromPipeline=$true,
        ValueFromPipelineByPropertyName=$true)]
      [object[]]$Application,
      # Name prefix for the AD FS relying party
      [Parameter(Mandatory=$false)]
      [string]$NamePreffix = "",
      # Apply sample app default parameters to existing apps
      [Parameter(Mandatory=$false)]
      [switch]$Force = $false
    )

    $samplePolicy = "MsId Block Off Corp and VPN"

    if (Import-AdfsModule) {
        Try {
            foreach($RelyingParty in $Application) {
                Write-Verbose "Processing app '$($RelyingParty.Name)' with the supplied prefix '$($NamePreffix)'"

                $rpName = $NamePreffix + $RelyingParty.Name
                $targetIdentifier = $RelyingParty.Identifier
            
                $adfsApp = Get-ADFSRelyingPartyTrust -Name $rpName
                if ($null -eq $adfsApp) {
                    Write-Verbose "Creating application '$($rpName)'"
                    $null = Add-ADFSRelyingPartyTrust -Identifier $targetIdentifier -Name $rpName
                }            
                else {
                    if (-not $Force) {
                        throw "The application '" + $rpName + "' already exists, use -Force to ovewrite it."
                    }
                    Write-Verbose "Updating application '$($rpName)'"
                }

                Set-ADFSRelyingPartyTrust -TargetName $rpName -AutoUpdateEnabled $RelyingParty.AutoUpdateEnabled
                Set-ADFSRelyingPartyTrust -TargetName $rpName -DelegationAuthorizationRules $RelyingParty.DelegationAuthorizationRules
                Set-ADFSRelyingPartyTrust -TargetName $rpName -IssuanceAuthorizationRules $RelyingParty.IssuanceAuthorizationRules
                Set-ADFSRelyingPartyTrust -TargetName $rpName -WSFedEndpoint $RelyingParty.WSFedEndpoint
                Set-ADFSRelyingPartyTrust -TargetName $rpName -IssuanceTransformRules $RelyingParty.IssuanceTransformRules
                Set-ADFSRelyingPartyTrust -TargetName $rpName -ClaimAccepted $RelyingParty.ClaimsAccepted
                Set-ADFSRelyingPartyTrust -TargetName $rpName -EncryptClaims $RelyingParty.EncryptClaims
                Set-ADFSRelyingPartyTrust -TargetName $rpName -EncryptionCertificate $RelyingParty.EncryptionCertificate
                Set-ADFSRelyingPartyTrust -TargetName $rpName -MetadataUrl $RelyingParty.MetadataUrl
                Set-ADFSRelyingPartyTrust -TargetName $rpName -MonitoringEnabled $RelyingParty.MonitoringEnabled
                Set-ADFSRelyingPartyTrust -TargetName $rpName -NotBeforeSkew $RelyingParty.NotBeforeSkew
                Set-ADFSRelyingPartyTrust -TargetName $rpName -ImpersonationAuthorizationRules $RelyingParty.ImpersonationAuthorizationRules
                Set-ADFSRelyingPartyTrust -TargetName $rpName -ProtocolProfile $RelyingParty.ProtocolProfile
                Set-ADFSRelyingPartyTrust -TargetName $rpName -RequestSigningCertificate $RelyingParty.RequestSigningCertificate
                Set-ADFSRelyingPartyTrust -TargetName $rpName -EncryptedNameIdRequired $RelyingParty.EncryptedNameIdRequired
                Set-ADFSRelyingPartyTrust -TargetName $rpName -SignedSamlRequestsRequired $RelyingParty.SignedSamlRequestsRequired  
            
                $newSamlEndPoints = @()
                foreach ($SamlEndpoint in $RelyingParty.SamlEndpoints)
                {
                    # Is ResponseLocation defined?
                    if ($SamlEndpoint.ResponseLocation)
                    {
                    # ResponseLocation is not null or empty
                    $newSamlEndPoint = New-ADFSSamlEndpoint -Binding $SamlEndpoint.Binding `
                        -Protocol $SamlEndpoint.Protocol `
                        -Uri $SamlEndpoint.Location -Index $SamlEndpoint.Index `
                        -IsDefault $SamlEndpoint.IsDefault
                    }
                    else
                    {
                    $newSamlEndPoint = New-ADFSSamlEndpoint -Binding $SamlEndpoint.Binding `
                        -Protocol $SamlEndpoint.Protocol `
                        -Uri $SamlEndpoint.Location -Index $SamlEndpoint.Index `
                        -IsDefault $SamlEndpoint.IsDefault `
                        -ResponseUri $SamlEndpoint.ResponseLocation
                    }
                    $newSamlEndPoints += $newSamlEndPoint
                }
                Set-ADFSRelyingPartyTrust -TargetName $rpName -SamlEndpoint $newSamlEndPoints
                Set-ADFSRelyingPartyTrust -TargetName $rpName -SamlResponseSignature $RelyingParty.SamlResponseSignature
                Set-ADFSRelyingPartyTrust -TargetName $rpName -SignatureAlgorithm $RelyingParty.SignatureAlgorithm
                Set-ADFSRelyingPartyTrust -TargetName $rpName -TokenLifetime $RelyingParty.TokenLifetime

                # check if using custom plocy and test if exists
                if ($RelyingParty.AccessControlPolicyName -eq $samplePolicy) {
                    if (Get-AdfsAccessControlPolicy -Name $samplePolicy) {
                        Set-AdfsRelyingPartyTrust -TargetName $rpName -AccessControlPolicyName $RelyingParty.AccessControlPolicyName
                    }
                    else {
                        Write-Warning "The Access Control Policy '$($samplePolicy)' is missing, run 'Import-MsIdAdfsSamplePolicies' to create."
                    }
                }
                else {
                    Set-AdfsRelyingPartyTrust -TargetName $rpName -AccessControlPolicyName $RelyingParty.AccessControlPolicyName
                }
            }
        }            
        Catch {
            Write-Error $_
        }
    }
    else {
        Write-Error "The Import-MsIdAdfsSampleApps cmdlet requires the ADFS module installed to work."
    }
}
#endregion

#region Import-MsIdAdfsSamplePolicy.ps1

<#
.SYNOPSIS
    Imports the 'MsId Block Off Corp and VPN' sample AD FS access control policy. This policy is meant to be used as test policy.
.DESCRIPTION
    Imports the 'MsId Block Off Corp and VPN' sample AD FS access control policy. Pass locations in the format of range (205.143.204.1-205.143.205.250) or CIDR (12.159.168.1/24).

    This policy is meant to be used as test policy!
.EXAMPLE
    PS >Import-MsIdAdfsSamplePolicy -Locations 205.143.204.1-205.143.205.250,12.159.168.1/24,12.35.175.1/26

    Create the policy to the local AD FS server.

.EXAMPLE
    PS >Import-MsIdAdfsSamplePolicy -Locations 205.143.204.1-205.143.205.250 -ApplyTo App1,App2
    
    Create the policy to the local AD FS server and apply it to to the list of applications.
    
#>
function Import-MsIdAdfsSamplePolicy {
    [CmdletBinding()]
    param(
      # Network locations
      [Parameter(Mandatory=$true)]
      [string[]]$Locations,
      # Relying party names to apply the policy
      [Parameter(Mandatory=$false)]
      [string[]]$ApplyTo
    )

    $name = "MsId Block Off Corp and VPN"

    if (Import-AdfsModule) {
        Try {

            # build <Value> for each location
            $values = ""
            foreach ($location in $Locations) {
                $values += "<Value>$($location)</Value>"
            }

            # load and update metadata file
            $metadataBase = Get-Content "$($PSScriptRoot)\internal\AdfsSamples\AdfsAccessControlPolicy.xml" -Raw
            $metadataStr = $metadataBase -replace '<Values>.*</Values>',"<Values>$values</Values>"
            $metadata = New-Object -TypeName Microsoft.IdentityServer.PolicyModel.Configuration.PolicyTemplate.PolicyMetadata -ArgumentList $metadataStr

            $policy = Get-AdfsAccessControlPolicy -Name $name
            if ($null -eq $policy) {
                Write-Verbose "Creating Access Control Policy $($name)"
                $null = New-AdfsAccessControlPolicy -Name $name -Identifier "DenyNonCorporateandNonVPN" -PolicyMetadata $metadata
            }
            else {
                throw "The policy '" + $name + "' already exists."
            }

            if ($null -ne $ApplyTo) {
                foreach ($app in $ApplyTo) {
                    Set-AdfsRelyingPartyTrust -TargetName $app -AccessControlPolicyName $name
                }
            }
        }            
        Catch {
            Write-Error $_
        }
    }
    else {
        Write-Error "The Import-MsIdAdfsSampleApps cmdlet requires the ADFS module installed to work."
    }
}
#endregion

#region Get-MsIdAdfsSampleApp.ps1

<#
.SYNOPSIS
    Returns the list of availabe sample AD FS relyng party trust applications available in this module. These applications do NOT use real endpoints and are meant to be used as test applications.
.EXAMPLE
    PS > Get-MsIdAdfsSampleApps

    Get the full list of sample AD FS apps.

.EXAMPLE
    PS > Get-MsIdAdfsSampleApps SampleAppName

    Get only SampleAppName sample AD FS app (replace SampleAppName by one of the available apps).

#>
function Get-MsIdAdfsSampleApp {
    [CmdletBinding()]
    [OutputType([object[]])]
    param (
        # Sample applications name
        [Parameter(Mandatory = $false)]
        [string] $Name
    )

    $result = [System.Collections.ArrayList]@()

    if (Import-AdfsModule) {
        $apps = Get-ChildItem -Path "$($PSScriptRoot)\internal\AdfsSamples\"

        if ($Name -ne '') {
            $apps = $apps | Where-Object { $_.Name -eq $Name + '.json' } 
        }
    
        ForEach ($app in $apps) {
            Try {
                Write-Verbose "Loading app: $($app.Name)"
                if ($app.Name -notlike '*.xml') {
                    $rp = Get-Content $app.FullName | ConvertFrom-json
                    $null = $result.Add($rp)
                }
            }
            catch {
                Write-Warning "Error while loading app '$($app.Name)': ($_)"
            }
        }

        return ,$result
    }
}
#endregion

#region Get-MsIdInactiveSignInUser.ps1

<#
.SYNOPSIS
    Retrieve Users who have not had interactive sign ins since XX days ago

.EXAMPLE
    PS > Get-MsIdInactiveSignInUser -LastSignInBeforeDaysAgo 30

    Retrieve Users who have not signed in since 30 days ago from today

.INPUTS
    System.Int
.NOTES
    - Updating Role Assignable Groups or Privileged Access Groups require PrivilegedAccess.ReadWrite.AzureADGroup permission scope
    THIS CODE-SAMPLE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR
    FITNESS FOR A PARTICULAR PURPOSE.
    This sample is not supported under any Microsoft standard support program or service.
    The script is provided AS IS without warranty of any kind. Microsoft further disclaims all
    implied warranties including, without limitation, any implied warranties of merchantability
    or of fitness for a particular purpose. The entire risk arising out of the use or performance
    of the sample and documentation remains with you. In no event shall Microsoft, its authors,
    or anyone else involved in the creation, production, or delivery of the script be liable for
    any damages whatsoever (including, without limitation, damages for loss of business profits,
    business interruption, loss of business information, or other pecuniary loss) arising out of
    the use of or inability to use the sample or documentation, even if Microsoft has been advised
    of the possibility of such damages, rising out of the use of or inability to use the sample script,
    even if Microsoft has been advised of the possibility of such damages.

#>
function Get-MsIdInactiveSignInUser {
    [CmdletBinding()]
    [OutputType([string])]
    param (
        # User Last Sign In Activity is before Days ago
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 1)]
        [Alias("BeforeDaysAgo")]
        [int] $LastSignInBeforeDaysAgo = 30,
        # Return results for All, Member, or Guest userTypes
        [ValidateSet("All", "Member", "Guest")]
        [string]
        $UserType = "All"
    )

    begin {
        ## Initialize Critical Dependencies
        $CriticalError = $null
        if (!(Test-MgCommandPrerequisites 'Get-MgUser' -MinimumVersion 2.8.0 -RequireListPermissions -ErrorVariable CriticalError)) { return }
    }

    process {
        if ($CriticalError) { return }

        $queryDate = Get-Date (Get-Date).AddDays($(0 - $LastSignInBeforeDaysAgo)) -UFormat %Y-%m-%dT00:00:00Z

        $inactiveFilter = ("(signInActivity/lastSignInDateTime le {0})" -f $queryDate)

        $queryFilter = $inactiveFilter

        # Using Date scope here, since conflict with service side odata filter on userType.
        Write-Debug ("Retrieving Users with Filter {0}" -f $queryFilter)
        $queryUsers = Get-MgUser -Filter $queryFilter -All:$true -Property signInActivity, UserPrincipalName, Id, DisplayName, mail, userType, createdDateTime

        switch ($UserType) {
            "Member" {
                $users = $queryUsers | Where-Object -FilterScript { $_.userType -eq 'Member' }
            }
            "Guest" {
                $users = $queryUsers | Where-Object -FilterScript { $_.userType -eq 'Guest' }

            }
            "All" {
                $users = $queryUsers
            }
        }

        foreach ($userObject in $users) {
            $checkedUser = [ordered] @{}
            $checkedUser.UserID = $userObject.Id
            $checkedUser.DisplayName = $userObject.DisplayName
            $checkedUser.UserPrincipalName = $userObject.UserPrincipalName
            $checkedUser.Mail = $userObject.Mail
            $checkedUser.UserType = $userObject.UserType

            If ($null -eq $userObject.signInActivity.LastSignInDateTime) {
                $checkedUser.LastSignInDateTime = "Unknown"
                $checkedUser.LastSigninDaysAgo = "Unknown"
                $checkedUser.lastNonInteractiveSignInDateTime = "Unknown"
            }
            else {
                $checkedUser.LastSignInDateTime = $userObject.signInActivity.LastSignInDateTime
                $checkedUser.LastSigninDaysAgo = (New-TimeSpan -Start $checkedUser.LastSignInDateTime -End (Get-Date)).Days
                $checkedUser.lastSignInRequestId = $userObject.signInActivity.lastSignInRequestId
                $checkedUser.lastNonInteractiveSignInDateTime = $userObject.signInActivity.lastNonInteractiveSignInDateTime

                $checkedUser.LastNonInteractiveSigninDaysAgo = (New-TimeSpan -Start $checkedUser.lastNonInteractiveSignInDateTime -End (Get-Date)).Days
                $checkedUser.lastNonInteractiveSignInRequestId = $userObject.signInActivity.lastNonInteractiveSignInRequestId
            }
            If ($null -eq $userObject.CreatedDateTime) {
                $checkedUser.CreatedDateTime = "Unknown"
                $checkedUser.CreatedDaysAgo = "Unknown"
            }
            else {
                $checkedUser.CreatedDateTime = $userObject.CreatedDateTime
                $checkedUser.CreatedDaysAgo = (New-TimeSpan -Start $userObject.CreatedDateTime -End (Get-Date)).Days
            }

            Write-Output ([pscustomobject]$checkedUser)
        }

    }

    end {
        if ($CriticalError) { return }
    }
}

#endregion

#region Set-MsIdServicePrincipalVisibleInMyApps.ps1


    function Set-MsIdServicePrincipalVisibleInMyApps {
    <#
    .SYNOPSIS
        Toggles whether application service principals are visible when launching myapplications.microsoft.com (MyApps)

    .DESCRIPTION
        For each provided service principal ID, this cmdlet will add (or remove) the 'HideApp' tag to (or from) its list of tags.

        MyApps reads this tag to determine whether to show the service principal in the UX.

        -Verbose will give insight into the cmdlet's activities.

        Requires Application.ReadWrite.All (to manage service principals), i.e. Connect-MgGraph -Scopes Application.ReadWrite.All

    .PARAMETER Visible
        Whether to show or hide the SP. Supply $true or $false.

    .PARAMETER InFile
        A file specifying the list of SP IDs to process. Provide one guid per line with no other characters.

    .PARAMETER OutFile
        (Optional) The list of changed SPs is written to a file at this location for easy recovery. A default file will be generated if a path is not provided.

    .PARAMETER WhatIf
        (Optional) When set, shows which SPs would be changed without changing them.

    .PARAMETER Top
        (Optional) The number of SPs to process from the list with each request. Default 100.

    .PARAMETER Skip
        (Optional) Determines where in the list to begin executing.

    .PARAMETER Continue
        (Optional) After a failure due to request throttling, set this to the number of inputs that were evaluated before throttling began on the previous request.

    .EXAMPLE
        Set-MsIdServicePrincipalVisibleInMyApps -Visible $false -InFile .\sps.txt -OutFile .\output.txt -Verbose

        Adds the 'HideApp' tag for each Service Principal listed by guid in the sps.txt file. This ensures that the app is no longer visible in the MyApps portal.

        Creates a list of changed SPs, written to output.txt, at the script execution directory.

        Provides verbose output to assist with monitoring.

    .EXAMPLE
        Set-MsIdServicePrincipalVisibleInMyApps -Visible $true -InFile .\sps.txt -OutFile .\output.txt -Verbose

        Removes the 'HideApp' tag for each Service Principal listed by guid in the sps.txt file. This ensures that the app is visible in the MyApps portal.

        Creates a list of changed SPs, written to output.txt, at the script execution directory.

        Provides verbose output to assist with monitoring.

    .EXAMPLE
        Set-MsIdServicePrincipalVisibleInMyApps -Visible $true -InFile .\sps.txt -WhatIf

        Removes the 'HideApp' tag for each Service Principal listed by guid in the sps.txt file. This ensures that the app is visible in the MyApps portal.

        Provides a 'whatif' analysis to show what would've been updated without the -WhatIf switch.

    .EXAMPLE
        Set-MsIdServicePrincipalVisibleInMyApps -Visible $true -InFile .\sps.txt -WhatIf -Top 200

        Removes the 'HideApp' tag for each Service Principal listed by guid in the sps.txt file. This ensures that the app is visible in the MyApps portal.

        Provides a 'whatif' analysis to show what would've been updated without the -WhatIf switch. Processes 200 service principals.

    .NOTES
        THIS CODE-SAMPLE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
        OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR
        FITNESS FOR A PARTICULAR PURPOSE.

        This sample is not supported under any Microsoft standard support program or service.
        The script is provided AS IS without warranty of any kind. Microsoft further disclaims all
        implied warranties including, without limitation, any implied warranties of merchantability
        or of fitness for a particular purpose. The entire risk arising out of the use or performance
        of the sample and documentation remains with you. In no event shall Microsoft, its authors,
        or anyone else involved in the creation, production, or delivery of the script be liable for
        any damages whatsoever (including, without limitation, damages for loss of business profits,
        business interruption, loss of business information, or other pecuniary loss) arising out of
        the use of or inability to use the sample or documentation, even if Microsoft has been advised
        of the possibility of such damages, rising out of the use of or inability to use the sample script,
        even if Microsoft has been advised of the possibility of such damages.


    #>
    [CmdletBinding()]
    Param(

        [Parameter(Mandatory=$true)]
        [bool]$Visible,

        [Parameter(Mandatory=$true)]
        [string]$InFile,

        [Parameter(Mandatory=$false)]
        [string]$OutFile,

        [Parameter(Mandatory=$false)]
        [switch]$WhatIf,

        [Parameter(Mandatory=$false)]
        [int]$Top=100,

        [Parameter(Mandatory=$false)]
        [int]$Skip=0,

        [Parameter(Mandatory=$false)]
        [int]$Continue=0
    )

    begin {
        ## Initialize Critical Dependencies
        $CriticalError = $null
        if (!(Test-MgCommandPrerequisites 'Get-MgServicePrincipal', 'Update-MgServicePrincipal' -MinimumVersion 2.8.0 -ErrorVariable CriticalError)) { return }

        function ConvertTo-ValidGuid {
            Param(
                [Parameter(ValueFromPipeline=$true, Mandatory=$true)]
                [string]$Value
            )

            try {
                $id = [System.Guid]::Parse($value)
                return $id
            } catch {
                Write-Warning "$(Get-Date -f T) - Failed to parse SP id: $($value)"
                return $null
            }
        }

        function ConvertTo-ServicePrincipal {
            Param(
                [Parameter(ValueFromPipeline=$true, Mandatory=$true)]
                [string]$Value
            )

            try {
                $sp = Get-MgServicePrincipal -ServicePrincipalId $Value
                if ($null -eq $sp) {
                    Write-Warning "$(Get-Date -f T) - SP not found for id: $($Value)"
                }
                else {
                    Write-Verbose "$(Get-Date -f T) - SP found for id: $($Value)"
                }
                return $sp

            } catch {
                # 429 means we are being throttled
                # so we want to back off from additional calls as well
                if ($_ -Contains '429') {
                    throw $_
                }
                Write-Warning "$(Get-Date -f T) - Error retrieving SP: $($Value)"
                return $null
            }
        }

        function Assert-IsHidden {
            Param(
                [Parameter(Mandatory=$true)]
                [Object]$Sp,

                [Parameter(Mandatory=$true)]
                [bool]$Value
            )

            return ($Sp.Tags -Contains $Tag_HideApp) -eq $Value
        }

        function Set-IsHidden {
            Param(
                [Parameter(Mandatory=$true)]
                [Object]$Sp,

                [Parameter(Mandatory=$true)]
                [bool]$Value
            )

            if ($Value) {
                $tags = $Sp.Tags + $Tag_HideApp
            } else {
                if (($Sp.Tags.count -eq 1) -and ($Sp.Tags -Contains $Tag_HideApp)) {
                    $tags = @()
                } else {
                    $tags = $Sp.Tags | Where-Object {$_ -ne $Tag_HideApp}
                }
            }

            try {
                Update-MgServicePrincipal -ServicePrincipalId $Sp.Id -Tags $tags
                return $true
            } catch {
                # 429 means we are being throttled
                # so we want to back off from additional calls as well
                if ($_ -Contains '429') {
                    throw $_
                }
                Write-Warning "$(Get-Date -f T) - Error setting SP tags: $($Sp.Id)"
                return $false
            }
        }

        function New-OutFile {
            Param(
                [Parameter(Mandatory=$true)]
                [string]$Path
            )

            if (Test-Path -Path $Path) {
                Clear-Content -Path $Path
            } else {
                New-Item -Path $Path -ItemType "file" > $null
            }
        }
    }

    process {

        ## Return immediately on critical error
        if ($CriticalError) { return }

        #Define outfile
        if ([string]::IsNullOrEmpty($OutFile))
        {
            $OutFile = "sp-backup-$((New-Guid).ToString()).txt"
        }

        #Hide app tag
        $Tag_HideApp = 'HideApp'

        #Count variables
        $i = -1
        $updated = @()
        $count_NotParsed = 0
        $count_NotFound = 0
        $count_NotChanged = 0
        $count_NotSaved = 0
        $throttled = $false

        #Get the list of SPs to be processed
        $sps = Get-Content $InFile
        $total = $sps.Count
        Write-Verbose -Message "$(Get-Date -f T) - $($total) inputs to process"

        for ($i = $Continue; $i -lt $Top -and $i+$Skip -lt $total; $i++) {
            Write-Verbose -Message "$(Get-Date -f T) - Processing $($i)"
            if ($total -eq 1) {
                $value = $sps
            } else {
                $value = $sps[$i+$Skip]
            }
            Write-Verbose -Message "$(Get-Date -f T) - Input: $($value)"

            $id = $value | ConvertTo-ValidGuid
            if ($null -eq $id) {
                $count_NotParsed++
                continue
            }

            try {
                $sp = $id | ConvertTo-ServicePrincipal
                if ($null -eq $sp) {
                    $count_NotFound++
                    continue
                }
            } catch {
                $throttled = $true
                break
            }

            if (Assert-IsHidden -Sp $sp -Value (!$Visible)) {
                $count_NotChanged++
                continue
            }

            if ($WhatIf) {
                $updated += $sp.Id
            } else {
                try {
                    if (Set-IsHidden -Sp $sp -Value (!$Visible)) {
                        $updated += $sp.Id
                    } else {
                        $count_NotSaved++
                        continue
                    }
                } catch {
                    $throttled = $true
                    break
                }
            }
        }

        Write-Verbose -Message "$(Get-Date -f T) - Generating output"

        if ($Continue -eq 0 -and $Skip -eq 0) {
            New-OutFile -Path $OutFile
        }

        $updated | ForEach-Object { $_ | Add-Content -Path $OutFile }

        Write-Verbose -Message "$(Get-Date -f T) - $($count_NotParsed) inputs not parseable as guids"
        Write-Verbose -Message "$(Get-Date -f T) - $($count_NotFound) guids do not map to SP Ids"
        Write-Verbose -Message "$(Get-Date -f T) - $($count_NotChanged) SPs were already in the desired state"
        if ($WhatIf) {
            Write-Verbose -Message "$(Get-Date -f T) - $($updated.Count) SPs would be changed. A list of guids has been written to $($OutFile)"
        } else {
            Write-Verbose -Message "$(Get-Date -f T) - $($count_NotSaved) SPs had an error trying to save the change"
            Write-Verbose -Message "$(Get-Date -f T) - $($updated.Count) SPs were changed. A list of guids has been written to $($OutFile)"
        }

        if ($throttled) {
            Write-Warning "Operation throttled after processing $($i) items"
            if (!$WhatIf) {
                Write-Warning "$(Get-Date -f T) - Please wait 5 minutes then execute the following script to continue:"
                Write-Warning "$(Get-Date -f T) - Set-MsIdServicePrincipalVisibleInMyApps -InFile $($InFile) -OutFile $($OutFile) -Visible `$$($Visible) -Top $($Top) -Skip $($Skip) -Continue $($i)"
            }
        } elseif ($sps.Count -gt $Skip+$Top) {
            if (!$WhatIf) {
                Write-Verbose -Message "$(Get-Date -f T) - Run the following script to process the next batch of $($Top):"
                Write-Verbose -Message "$(Get-Date -f T) - Set-MsIdServicePrincipalVisibleInMyApps -InFile $($InFile) -OutFile $($OutFile) -Visible `$$($Visible) -Top $($Top) -Skip $($Skip+$Top)"
            }
        }
        if (!$WhatIf) {
                Write-Verbose -Message "$(Get-Date -f T) - Run the following script to roll back this operation:"
                Write-Verbose -Message "$(Get-Date -f T) - Set-MsIdServicePrincipalVisibleInMyApps -InFile $($OutFile) -Visible `$$(!$Visible)"

        }
    }
}

#endregion

#region Split-MsIdEntitlementManagementConnectedOrganization.ps1

<#
.Synopsis
Split elements of a connectedOrganization
.Description
Split elements of one or more Azure AD entitlement management connected organizations, returned by Get-MgEntitlementManagementConnectedOrganization, to simplify reporting.
.Inputs
Microsoft.Graph.PowerShell.Models.MicrosoftGraphConnectedOrganization

.EXAMPLE
    PS > Get-MgEntitlementManagementConnectedOrganization -All | Split-MsIdEntitlementManagementConnectedOrganization -ByIdentitySource | ft ConnectedOrganizationId,tenantId,domainName

    Display one row for each identity source in all the connected organizations with the tenant id or domain name of the identity source.

#>
function Split-MsIdEntitlementManagementConnectedOrganization {
    [CmdletBinding(DefaultParameterSetName = 'SplitByIdentitySource', PositionalBinding = $false, ConfirmImpact = 'Medium')]
    param(

        [Parameter(ValueFromPipeline = $true, ParameterSetName = 'SplitByIdentitySource')]
        [Microsoft.Graph.PowerShell.Models.MicrosoftGraphConnectedOrganization[]]
        # The connected organization.
        ${ConnectedOrganization},
        # Flag to indicate that the output should be split by identity source.
        [Parameter(Mandatory = $true, ParameterSetName = 'SplitByIdentitySource')]
        [switch]
        ${ByIdentitySource}

    )

    begin {

    }

    process {
        if ($ByIdentitySource) {

            if ($null -ne $ConnectedOrganization.IdentitySources) {
                foreach ($is in $ConnectedOrganization.IdentitySources) {
                    # identity sources, as an abstract class, does not have any properties

                    $aObj = [pscustomobject]@{
                        ConnectedOrganizationId = $ConnectedOrganization.Id
                    }

                    $addl = $is.AdditionalProperties
                    foreach ($k in $addl.Keys) {
                        $isk = $k
                        $aObj | Add-Member -MemberType NoteProperty -Name $isk -Value $addl[$k] -Force
                    }

                    Write-Output $aObj
                }
            }
        }
    }

    end {

    }
}

#endregion

#endregion

## Set Strict Mode for Module. https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/set-strictmode
Set-StrictMode -Version 3.0

## Display Warning on old PowerShell versions. https://docs.microsoft.com/en-us/powershell/scripting/install/PowerShell-Support-Lifecycle#powershell-end-of-support-dates
if ($PSVersionTable.PSVersion -lt [version]'7.0') {
    Write-Warning 'It is recommended to use this module with the latest version of PowerShell which can be downloaded here: https://aka.ms/install-powershell'
}

#Write-Warning 'It is recommended to update Microsoft Graph PowerShell SDK modules frequently because many commands in this module depend on them.'

class SamlMessage : xml {}

Export-ModuleMember -Function @('Add-MsIdServicePrincipal','Confirm-MsIdJwtTokenSignature','ConvertFrom-MsIdAadcAadConnectorSpaceDn','ConvertFrom-MsIdAadcSourceAnchor','ConvertFrom-MsIdUniqueTokenIdentifier','ConvertFrom-MsIdJwtToken','ConvertFrom-MsIdSamlMessage','Expand-MsIdJwtTokenPayload','Find-MsIdUnprotectedUsersWithAdminRoles','Get-MsIdProvisioningLogStatistics','Get-MsIdAdfsSamlToken','Get-MsIdAdfsWsFedToken','Get-MsIdAdfsWsTrustToken','Get-MsIdApplicationIdByAppId','Get-MsIdAuthorityUri','Get-MsIdAzureIpRange','Get-MsIdCrossTenantAccessActivity','Get-MsIdGroupWithExpiration','Get-MsIdMsftIdentityAssociation','Get-MsIdO365Endpoints','Get-MsIdOpenIdProviderConfiguration','Get-MsIdSamlFederationMetadata','Get-MsIdServicePrincipalIdByAppId','Get-MsIdUnmanagedExternalUser','Invoke-MsIdAzureAdSamlRequest','New-MsIdWsTrustRequest','New-MsIdClientSecret','New-MsIdSamlRequest','New-MsIdTemporaryUserPassword','Reset-MsIdExternalUser','Resolve-MsIdTenant','Revoke-MsIdServicePrincipalConsent','Set-MsIdWindowsTlsSettings','Resolve-MsIdAzureIpAddress','Show-MsIdJwtToken','Show-MsIdSamlToken','Test-MsIdAzureAdDeviceRegConnectivity','Test-MsIdCBATrustStoreConfiguration','Get-MsIdSigningKeyThumbprint','Update-MsIdApplicationSigningKeyThumbprint','Get-MsIdIsViralUser','Get-MsIdHasMicrosoftAccount','Get-MsIdGroupWritebackConfiguration','Update-MsIdGroupWritebackConfiguration','Get-MsIdUnredeemedInvitedUser','Get-MsIdAdfsSampleApp','Import-MsIdAdfsSampleApp','Import-MsIdAdfsSamplePolicy','Get-MsIdInactiveSignInUser','Set-MsIdServicePrincipalVisibleInMyApps','Split-MsIdEntitlementManagementConnectedOrganization') -Cmdlet @() -Variable @() -Alias @('Revoke-MsIdApplicationConsent','ConvertFrom-MsIdAzureAdImmutableId','Get-MsIdWsFedFederationMetadata','ConvertFrom-MsIdSamlRequest','ConvertFrom-MsIdSamlResponse')


# SIG # Begin signature block
# MIInvwYJKoZIhvcNAQcCoIInsDCCJ6wCAQExDzANBglghkgBZQMEAgEFADB5Bgor
# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG
# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD9Wyuhj8zwZ9vp
# fzU31I8z98TMQMS32jSY9C2IZkw/kaCCDXYwggX0MIID3KADAgECAhMzAAADTrU8
# esGEb+srAAAAAANOMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD
# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p
# bmcgUENBIDIwMTEwHhcNMjMwMzE2MTg0MzI5WhcNMjQwMzE0MTg0MzI5WjB0MQsw
# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u
# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
# AQDdCKiNI6IBFWuvJUmf6WdOJqZmIwYs5G7AJD5UbcL6tsC+EBPDbr36pFGo1bsU
# p53nRyFYnncoMg8FK0d8jLlw0lgexDDr7gicf2zOBFWqfv/nSLwzJFNP5W03DF/1
# 1oZ12rSFqGlm+O46cRjTDFBpMRCZZGddZlRBjivby0eI1VgTD1TvAdfBYQe82fhm
# WQkYR/lWmAK+vW/1+bO7jHaxXTNCxLIBW07F8PBjUcwFxxyfbe2mHB4h1L4U0Ofa
# +HX/aREQ7SqYZz59sXM2ySOfvYyIjnqSO80NGBaz5DvzIG88J0+BNhOu2jl6Dfcq
# jYQs1H/PMSQIK6E7lXDXSpXzAgMBAAGjggFzMIIBbzAfBgNVHSUEGDAWBgorBgEE
# AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUnMc7Zn/ukKBsBiWkwdNfsN5pdwAw
# RQYDVR0RBD4wPKQ6MDgxHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEW
# MBQGA1UEBRMNMjMwMDEyKzUwMDUxNjAfBgNVHSMEGDAWgBRIbmTlUAXTgqoXNzci
# tW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8vd3d3Lm1pY3Jvc29mdC5j
# b20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3JsMGEG
# CCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQu
# Y29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3J0
# MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBAD21v9pHoLdBSNlFAjmk
# mx4XxOZAPsVxxXbDyQv1+kGDe9XpgBnT1lXnx7JDpFMKBwAyIwdInmvhK9pGBa31
# TyeL3p7R2s0L8SABPPRJHAEk4NHpBXxHjm4TKjezAbSqqbgsy10Y7KApy+9UrKa2
# kGmsuASsk95PVm5vem7OmTs42vm0BJUU+JPQLg8Y/sdj3TtSfLYYZAaJwTAIgi7d
# hzn5hatLo7Dhz+4T+MrFd+6LUa2U3zr97QwzDthx+RP9/RZnur4inzSQsG5DCVIM
# pA1l2NWEA3KAca0tI2l6hQNYsaKL1kefdfHCrPxEry8onJjyGGv9YKoLv6AOO7Oh
# JEmbQlz/xksYG2N/JSOJ+QqYpGTEuYFYVWain7He6jgb41JbpOGKDdE/b+V2q/gX
# UgFe2gdwTpCDsvh8SMRoq1/BNXcr7iTAU38Vgr83iVtPYmFhZOVM0ULp/kKTVoir
# IpP2KCxT4OekOctt8grYnhJ16QMjmMv5o53hjNFXOxigkQWYzUO+6w50g0FAeFa8
# 5ugCCB6lXEk21FFB1FdIHpjSQf+LP/W2OV/HfhC3uTPgKbRtXo83TZYEudooyZ/A
# Vu08sibZ3MkGOJORLERNwKm2G7oqdOv4Qj8Z0JrGgMzj46NFKAxkLSpE5oHQYP1H
# tPx1lPfD7iNSbJsP6LiUHXH1MIIHejCCBWKgAwIBAgIKYQ6Q0gAAAAAAAzANBgkq
# hkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x
# EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv
# bjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5
# IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEwOTA5WjB+MQswCQYDVQQG
# EwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwG
# A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYDVQQDEx9NaWNyb3NvZnQg
# Q29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
# CgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+laUKq4BjgaBEm6f8MMHt03
# a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc6Whe0t+bU7IKLMOv2akr
# rnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4Ddato88tt8zpcoRb0Rrrg
# OGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+lD3v++MrWhAfTVYoonpy
# 4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nkkDstrjNYxbc+/jLTswM9
# sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6A4aN91/w0FK/jJSHvMAh
# dCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmdX4jiJV3TIUs+UsS1Vz8k
# A/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL5zmhD+kjSbwYuER8ReTB
# w3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zdsGbiwZeBe+3W7UvnSSmn
# Eyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3T8HhhUSJxAlMxdSlQy90
# lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS4NaIjAsCAwEAAaOCAe0w
# ggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRIbmTlUAXTgqoXNzcitW2o
# ynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYD
# VR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBDuRQFTuHqp8cx0SOJNDBa
# BgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2Ny
# bC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3JsMF4GCCsG
# AQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3dy5taWNyb3NvZnQuY29t
# L3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3J0MIGfBgNV
# HSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEFBQcCARYzaHR0cDovL3d3
# dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1hcnljcHMuaHRtMEAGCCsG
# AQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkAYwB5AF8AcwB0AGEAdABl
# AG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn8oalmOBUeRou09h0ZyKb
# C5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7v0epo/Np22O/IjWll11l
# hJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0bpdS1HXeUOeLpZMlEPXh6
# I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/KmtYSWMfCWluWpiW5IP0
# wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvyCInWH8MyGOLwxS3OW560
# STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBpmLJZiWhub6e3dMNABQam
# ASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJihsMdYzaXht/a8/jyFqGa
# J+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYbBL7fQccOKO7eZS/sl/ah
# XJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbSoqKfenoi+kiVH6v7RyOA
# 9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sLgOppO6/8MO0ETI7f33Vt
# Y5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtXcVZOSEXAQsmbdlsKgEhr
# /Xmfwb1tbWrJUnMTDXpQzTGCGZ8wghmbAgEBMIGVMH4xCzAJBgNVBAYTAlVTMRMw
# EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN
# aWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNp
# Z25pbmcgUENBIDIwMTECEzMAAANOtTx6wYRv6ysAAAAAA04wDQYJYIZIAWUDBAIB
# BQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEO
# MAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIF9p807b+Ml7gA3qfWuRhaGa
# dbDzJHyfEg2ejqIecnoOMEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8A
# cwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEB
# BQAEggEAYYC0EHUQM0tcVkjpdrWzPzWjrEpS4XSNrlSsUryr8+Fe8DXjqH/iFSsH
# sWltTs12JDjlado4WLmxDZVZJuoUE8Il8me6Yh2SUg8XPI/JciZ/h8MPTA/mJSbl
# JUh18i3Ji3grIDU2Por0xuxg2KbPqzYl2xMqmZu7fyVxVChKZVZW8KdX4STEuSrK
# Vakc3orIRLRZce/IHA3+VnOeGr9+F4jPvAChwg0WWIwOqj7qeX9Oxg2xpuQvIayr
# BcmPzkLOoAOQJBuTez3TiE2KEzCflopCy0Ad69hJMFoFeYVY5iwuZEjJlSnBp0A/
# QaUr/rmc+HqijZ47bZP+zsCjtIFek6GCFykwghclBgorBgEEAYI3AwMBMYIXFTCC
# FxEGCSqGSIb3DQEHAqCCFwIwghb+AgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFZBgsq
# hkiG9w0BCRABBKCCAUgEggFEMIIBQAIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFl
# AwQCAQUABCAiNoYOP2vju1gJGn0TEt5+SzRya711iCuRbic9ZCcPcwIGZVbhW0B9
# GBMyMDIzMTExOTAzNDQzNC4yNDZaMASAAgH0oIHYpIHVMIHSMQswCQYDVQQGEwJV
# UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE
# ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJl
# bGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxJjAkBgNVBAsTHVRoYWxlcyBUU1MgRVNO
# OjhENDEtNEJGNy1CM0I3MSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBT
# ZXJ2aWNloIIReDCCBycwggUPoAMCAQICEzMAAAHj372bmhxogyIAAQAAAeMwDQYJ
# KoZIhvcNAQELBQAwfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x
# EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv
# bjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwHhcNMjMx
# MDEyMTkwNzI5WhcNMjUwMTEwMTkwNzI5WjCB0jELMAkGA1UEBhMCVVMxEzARBgNV
# BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv
# c29mdCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMkTWljcm9zb2Z0IElyZWxhbmQgT3Bl
# cmF0aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1UaGFsZXMgVFNTIEVTTjo4RDQxLTRC
# RjctQjNCNzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZTCC
# AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAL6kDWgeRp+fxSBUD6N/yuEJ
# pXggzBeNG5KB8M9AbIWeEokJgOghlMg8JmqkNsB4Wl1NEXR7cL6vlPCsWGLMhyqm
# scQu36/8h2bx6TU4M8dVZEd6V4U+l9gpte+VF91kOI35fOqJ6eQDMwSBQ5c9ElPF
# UijTA7zV7Y5PRYrS4FL9p494TidCpBEH5N6AO5u8wNA/jKO94Zkfjgu7sLF8SUdr
# c1GRNEk2F91L3pxR+32FsuQTZi8hqtrFpEORxbySgiQBP3cH7fPleN1NynhMRf6T
# 7XC1L0PRyKy9MZ6TBWru2HeWivkxIue1nLQb/O/n0j2QVd42Zf0ArXB/Vq54gQ8J
# IvUH0cbvyWM8PomhFi6q2F7he43jhrxyvn1Xi1pwHOVsbH26YxDKTWxl20hfQLdz
# z4RVTo8cFRMdQCxlKkSnocPWqfV/4H5APSPXk0r8Cc/cMmva3g4EvupF4ErbSO0U
# NnCRv7UDxlSGiwiGkmny53mqtAZ7NLePhFtwfxp6ATIojl8JXjr3+bnQWUCDCd5O
# ap54fGeGYU8KxOohmz604BgT14e3sRWABpW+oXYSCyFQ3SZQ3/LNTVby9ENsuEh2
# UIQKWU7lv7chrBrHCDw0jM+WwOjYUS7YxMAhaSyOahpbudALvRUXpQhELFoO6tOx
# /66hzqgjSTOEY3pu46BFAgMBAAGjggFJMIIBRTAdBgNVHQ4EFgQUsa4NZr41Fbeh
# Z8Y+ep2m2YiYqQMwHwYDVR0jBBgwFoAUn6cVXQBeYl2D9OXSZacbUzUZ6XIwXwYD
# VR0fBFgwVjBUoFKgUIZOaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9j
# cmwvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3JsMGwG
# CCsGAQUFBwEBBGAwXjBcBggrBgEFBQcwAoZQaHR0cDovL3d3dy5taWNyb3NvZnQu
# Y29tL3BraW9wcy9jZXJ0cy9NaWNyb3NvZnQlMjBUaW1lLVN0YW1wJTIwUENBJTIw
# MjAxMCgxKS5jcnQwDAYDVR0TAQH/BAIwADAWBgNVHSUBAf8EDDAKBggrBgEFBQcD
# CDAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADggIBALe+my6p1NPMEW1t
# 70a8Y2hGxj6siDSulGAs4UxmkfzxMAic4j0+GTPbHxk193mQ0FRPa9dtbRbaezV0
# GLkEsUWTGF2tP6WsDdl5/lD4wUQ76ArFOencCpK5svE0sO0FyhrJHZxMLCOclvd6
# vAIPOkZAYihBH/RXcxzbiliOCr//3w7REnsLuOp/7vlXJAsGzmJesBP/0ERqxjKu
# dPWuBGz/qdRlJtOl5nv9NZkyLig4D5hy9p2Ec1zaotiLiHnJ9mlsJEcUDhYj8PnY
# nJjjsCxv+yJzao2aUHiIQzMbFq+M08c8uBEf+s37YbZQ7XAFxwe2EVJAUwpWjmtJ
# 3b3zSWTMmFWunFr2aLk6vVeS0u1MyEfEv+0bDk+N3jmsCwbLkM9FaDi7q2HtUn3z
# 6k7AnETc28dAvLf/ioqUrVYTwBrbRH4XVFEvaIQ+i7esDQicWW1dCDA/J3xOoCEC
# V68611jriajfdVg8o0Wp+FCg5CAUtslgOFuiYULgcxnqzkmP2i58ZEa0rm4LZymH
# BzsIMU0yMmuVmAkYxbdEDi5XqlZIupPpqmD6/fLjD4ub0SEEttOpg0np0ra/MNCf
# v/tVhJtz5wgiEIKX+s4akawLfY+16xDB64Nm0HoGs/Gy823ulIm4GyrUcpNZxnXv
# E6OZMjI/V1AgSAg8U/heMWuZTWVUMIIHcTCCBVmgAwIBAgITMwAAABXF52ueAptJ
# mQAAAAAAFTANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgT
# Cldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29m
# dCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNh
# dGUgQXV0aG9yaXR5IDIwMTAwHhcNMjEwOTMwMTgyMjI1WhcNMzAwOTMwMTgzMjI1
# WjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH
# UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQD
# Ex1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDCCAiIwDQYJKoZIhvcNAQEB
# BQADggIPADCCAgoCggIBAOThpkzntHIhC3miy9ckeb0O1YLT/e6cBwfSqWxOdcjK
# NVf2AX9sSuDivbk+F2Az/1xPx2b3lVNxWuJ+Slr+uDZnhUYjDLWNE893MsAQGOhg
# fWpSg0S3po5GawcU88V29YZQ3MFEyHFcUTE3oAo4bo3t1w/YJlN8OWECesSq/XJp
# rx2rrPY2vjUmZNqYO7oaezOtgFt+jBAcnVL+tuhiJdxqD89d9P6OU8/W7IVWTe/d
# vI2k45GPsjksUZzpcGkNyjYtcI4xyDUoveO0hyTD4MmPfrVUj9z6BVWYbWg7mka9
# 7aSueik3rMvrg0XnRm7KMtXAhjBcTyziYrLNueKNiOSWrAFKu75xqRdbZ2De+JKR
# Hh09/SDPc31BmkZ1zcRfNN0Sidb9pSB9fvzZnkXftnIv231fgLrbqn427DZM9itu
# qBJR6L8FA6PRc6ZNN3SUHDSCD/AQ8rdHGO2n6Jl8P0zbr17C89XYcz1DTsEzOUyO
# ArxCaC4Q6oRRRuLRvWoYWmEBc8pnol7XKHYC4jMYctenIPDC+hIK12NvDMk2ZItb
# oKaDIV1fMHSRlJTYuVD5C4lh8zYGNRiER9vcG9H9stQcxWv2XFJRXRLbJbqvUAV6
# bMURHXLvjflSxIUXk8A8FdsaN8cIFRg/eKtFtvUeh17aj54WcmnGrnu3tz5q4i6t
# AgMBAAGjggHdMIIB2TASBgkrBgEEAYI3FQEEBQIDAQABMCMGCSsGAQQBgjcVAgQW
# BBQqp1L+ZMSavoKRPEY1Kc8Q/y8E7jAdBgNVHQ4EFgQUn6cVXQBeYl2D9OXSZacb
# UzUZ6XIwXAYDVR0gBFUwUzBRBgwrBgEEAYI3TIN9AQEwQTA/BggrBgEFBQcCARYz
# aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnku
# aHRtMBMGA1UdJQQMMAoGCCsGAQUFBwMIMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIA
# QwBBMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNX2
# VsuP6KJcYmjRPZSQW9fOmhjEMFYGA1UdHwRPME0wS6BJoEeGRWh0dHA6Ly9jcmwu
# bWljcm9zb2Z0LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01pY1Jvb0NlckF1dF8yMDEw
# LTA2LTIzLmNybDBaBggrBgEFBQcBAQROMEwwSgYIKwYBBQUHMAKGPmh0dHA6Ly93
# d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYt
# MjMuY3J0MA0GCSqGSIb3DQEBCwUAA4ICAQCdVX38Kq3hLB9nATEkW+Geckv8qW/q
# XBS2Pk5HZHixBpOXPTEztTnXwnE2P9pkbHzQdTltuw8x5MKP+2zRoZQYIu7pZmc6
# U03dmLq2HnjYNi6cqYJWAAOwBb6J6Gngugnue99qb74py27YP0h1AdkY3m2CDPVt
# I1TkeFN1JFe53Z/zjj3G82jfZfakVqr3lbYoVSfQJL1AoL8ZthISEV09J+BAljis
# 9/kpicO8F7BUhUKz/AyeixmJ5/ALaoHCgRlCGVJ1ijbCHcNhcy4sa3tuPywJeBTp
# kbKpW99Jo3QMvOyRgNI95ko+ZjtPu4b6MhrZlvSP9pEB9s7GdP32THJvEKt1MMU0
# sHrYUP4KWN1APMdUbZ1jdEgssU5HLcEUBHG/ZPkkvnNtyo4JvbMBV0lUZNlz138e
# W0QBjloZkWsNn6Qo3GcZKCS6OEuabvshVGtqRRFHqfG3rsjoiV5PndLQTHa1V1QJ
# sWkBRH58oWFsc/4Ku+xBZj1p/cvBQUl+fpO+y/g75LcVv7TOPqUxUYS8vwLBgqJ7
# Fx0ViY1w/ue10CgaiQuPNtq6TPmb/wrpNPgkNWcr4A245oyZ1uEi6vAnQj0llOZ0
# dFtq0Z4+7X6gMTN9vMvpe784cETRkPHIqzqKOghif9lwY1NNje6CbaUFEMFxBmoQ
# tB1VM1izoXBm8qGCAtQwggI9AgEBMIIBAKGB2KSB1TCB0jELMAkGA1UEBhMCVVMx
# EzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoT
# FU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMkTWljcm9zb2Z0IElyZWxh
# bmQgT3BlcmF0aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1UaGFsZXMgVFNTIEVTTjo4
# RDQxLTRCRjctQjNCNzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2Vy
# dmljZaIjCgEBMAcGBSsOAwIaAxUAPYiXu8ORQ4hvKcuE7GK0COgxWnqggYMwgYCk
# fjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH
# UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQD
# Ex1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQUFAAIF
# AOkEArIwIhgPMjAyMzExMTkxMTQyNDJaGA8yMDIzMTEyMDExNDI0MlowdDA6Bgor
# BgEEAYRZCgQBMSwwKjAKAgUA6QQCsgIBADAHAgEAAgIBDjAHAgEAAgIRvjAKAgUA
# 6QVUMgIBADA2BgorBgEEAYRZCgQCMSgwJjAMBgorBgEEAYRZCgMCoAowCAIBAAID
# B6EgoQowCAIBAAIDAYagMA0GCSqGSIb3DQEBBQUAA4GBAI77aJQU4Z+4Y/DprTE+
# wfQBYIebi5Pe3DNQZaPneElgb2uOkPUqMbWjG2k1jLQ0QPPlMOR6wWtbGiFPJ0sx
# beeciGknkJudaSi138nVkLJTVRr4x9uBEuHTPZpqKwHXYpCoi4jTBne/HcEDJIOk
# 42LckAlhHFCzEbcbzrLAiEYFMYIEDTCCBAkCAQEwgZMwfDELMAkGA1UEBhMCVVMx
# EzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoT
# FU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUt
# U3RhbXAgUENBIDIwMTACEzMAAAHj372bmhxogyIAAQAAAeMwDQYJYIZIAWUDBAIB
# BQCgggFKMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAvBgkqhkiG9w0BCQQx
# IgQg7/minwHljnoJbAaMsvTjEgcuvCahm/vr8CBrxB6HQX8wgfoGCyqGSIb3DQEJ
# EAIvMYHqMIHnMIHkMIG9BCAz1COr5bD+ZPdEgQjWvcIWuDJcQbdgq8Ndj0xyMuYm
# KjCBmDCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAw
# DgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x
# JjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAAB49+9
# m5ocaIMiAAEAAAHjMCIEICPqk74rNZpCJv/CCri9nxrAjlvWosCZFtDRTQ64zy3p
# MA0GCSqGSIb3DQEBCwUABIICAC9omEqxGZ/Mf25cIfV0ueKcjfD9yq7BVoCA0t0O
# spzgDV+UiaOdv03qKNLAfjPnUHhFZaif8Tha52tl0vaU65fYW4vwqN4CdNOuKgix
# VA7KdqYB5nw3mPdAmJbal151ekTV10Bz7GaqJIJJmXLLf7wXJh0Fvs7xCPyFwRYe
# quP0Iz3N9cwNYq9YNRYJpTGTKEkBkR1AZ5CJ4/I5CqJT/9K8p84tEc46AGWND9Kr
# WAb3VoLr2UB7QrX26LDR6eRMsUmhsjxhQVqI1jTDv9bnKR++mj41AjsQlouKB7uP
# HAC/liJJTCimmSI1PtjacwDVdNhfR++kxYqeAvTYq3+z98c4hPQI7U7gWLZg+8Pu
# I1fyjNGK2vnGk7fL8YU9FrvEFHGYkFLrh1vKa14kKCKaPcMh1Y+VySbe3AvXRmO3
# qW77yHHVmMjgLiq32C/+kbFXL2D2WH5OkMG+lScaOC3ojiEn6AornKBhjsEOnuOv
# dpuO5PNZOofnQZJnc8Nx/OkXC4Jrlimz1YKYp5PMck9iD7buHajCm/xLd6RfSmmN
# dLCzdNkcWpMrPhQWJfrJIMFQh5A9OVmbc50QbBNbtc+2kWgI5rM6rqIsa6RCqYk/
# WBM7tEWOm+NP+VKuNk5XO89voVKuUSdOhIaUVLXdkYKdGiFYoNXYZCOy+zetorZs
# vN5d
# SIG # End signature block