IAM0.6 Lab Setup and Cost Management

Install-Module Microsoft.Graph -Scope CurrentUser -Force

Connect-MgGraph -Scopes "User.ReadWrite.All", "Group.ReadWrite.All",
  "Application.ReadWrite.All", "Directory.ReadWrite.All",
  "RoleManagement.ReadWrite.Directory"

Get-MgContext | Select-Object Account, TenantId, Scopes

$domain = "yourtenant.onmicrosoft.com"
$passwordProfile = @{
  Password                      = "IAMcourse2026!"
  ForceChangePasswordNextSignIn = $false
}

# Personas with full governance attributes
$fullPersonas = @(
  @{ First="Rachel"; Last="Okafor"; Dept="Security"; Title="CISO";
     Hire="2024-11-15" },
  @{ First="Tom"; Last="Ashworth"; Dept="Security"; Title="SOC Analyst L1";
     Hire="2023-08-01" },
  @{ First="Priya"; Last="Sharma"; Dept="Security"; Title="SOC Analyst L1";
     Hire="2022-06-15" },
  @{ First="Marcus"; Last="Webb"; Dept="Security"; Title="Security Architect";
     Hire="2023-01-10" },
  @{ First="Elena"; Last="Petrova"; Dept="GRC"; Title="GRC Analyst";
     Hire="2024-03-01" },
  @{ First="Phil"; Last="Greaves"; Dept="IT"; Title="IT Director";
     Hire="2022-03-01" }
)

# Personas with missing attributes (deliberate governance gaps)
$gapPersonas = @(
  @{ First="James"; Last="Whitfield"; Dept="Engineering"; Title="Engineer";
     Hire=$null },
  @{ First="Sarah"; Last="Blackwood"; Dept=$null; Title="Marketing Lead";
     Hire=$null },
  @{ First="David"; Last="Chen"; Dept="Engineering"; Title="Senior Engineer";
     Hire="2021-09-01" },
  @{ First="Lisa"; Last="Okonkwo"; Dept="Finance"; Title="Finance Analyst";
     Hire=$null },
  @{ First="Mark"; Last="Taylor"; Dept=$null; Title=$null;
     Hire=$null },
  @{ First="Anna"; Last="Kowalski"; Dept="HR"; Title="HR Manager";
     Hire="2023-06-01" },
  @{ First="Ben"; Last="Hughes"; Dept="Engineering"; Title="Project Lead";
     Hire=$null },
  @{ First="Fatima"; Last="Al-Rashid"; Dept="Legal"; Title="Legal Counsel";
     Hire="2024-01-15" },
  @{ First="Chris"; Last="Morrison"; Dept="IT"; Title="Systems Admin";
     Hire=$null }
)

$allPersonas = $fullPersonas + $gapPersonas

foreach ($p in $allPersonas) {
  $upn = "$($p.First.ToLower()).$($p.Last.ToLower())@$domain"
  $params = @{
    DisplayName       = "$($p.First) $($p.Last)"
    UserPrincipalName = $upn
    MailNickname      = "$($p.First.ToLower()).$($p.Last.ToLower())"
    AccountEnabled    = $true
    PasswordProfile   = $passwordProfile
  }
  if ($p.Dept) { $params.Department = $p.Dept }
  if ($p.Title) { $params.JobTitle = $p.Title }
  if ($p.Hire) { $params.EmployeeHireDate = $p.Hire }

  $user = New-MgUser @params
  Write-Host "Created: $($user.DisplayName) ($upn)"
}

Write-Host "`nCreated $($allPersonas.Count) personas"

$personas = Get-MgUser -Filter "startsWith(userPrincipalName, 'rachel.') or
  startsWith(userPrincipalName, 'tom.') or startsWith(userPrincipalName, 'priya.') or
  startsWith(userPrincipalName, 'marcus.') or startsWith(userPrincipalName, 'elena.') or
  startsWith(userPrincipalName, 'phil.') or startsWith(userPrincipalName, 'james.') or
  startsWith(userPrincipalName, 'sarah.') or startsWith(userPrincipalName, 'david.') or
  startsWith(userPrincipalName, 'lisa.') or startsWith(userPrincipalName, 'mark.') or
  startsWith(userPrincipalName, 'anna.') or startsWith(userPrincipalName, 'ben.') or
  startsWith(userPrincipalName, 'fatima.') or startsWith(userPrincipalName, 'chris.')" `
  -Property displayName, department, jobTitle, employeeHireDate

$personas | Select-Object displayName, department, jobTitle,
  @{N='HireDate'; E={ if ($_.EmployeeHireDate) { "Set" } else { "MISSING" }}} |
  Format-Table -AutoSize

# Get user IDs
$rachel = (Get-MgUser -Filter "displayName eq 'Rachel Okafor'").Id
$tom = (Get-MgUser -Filter "displayName eq 'Tom Ashworth'").Id
$phil = (Get-MgUser -Filter "displayName eq 'Phil Greaves'").Id

# Security team reports to Rachel
@("Tom Ashworth", "Priya Sharma", "Marcus Webb") | ForEach-Object {
  $user = Get-MgUser -Filter "displayName eq '$_'"
  Set-MgUserManagerByRef -UserId $user.Id -BodyParameter @{
    "@odata.id" = "https://graph.microsoft.com/v1.0/users/$rachel"
  }
  Write-Host "Set manager: $_ → Rachel Okafor"
}

# Elena reports to Rachel
$elena = Get-MgUser -Filter "displayName eq 'Elena Petrova'"
Set-MgUserManagerByRef -UserId $elena.Id -BodyParameter @{
  "@odata.id" = "https://graph.microsoft.com/v1.0/users/$rachel"
}
Write-Host "Set manager: Elena Petrova → Rachel Okafor"

# IT team reports to Phil
@("Chris Morrison") | ForEach-Object {
  $user = Get-MgUser -Filter "displayName eq '$_'"
  Set-MgUserManagerByRef -UserId $user.Id -BodyParameter @{
    "@odata.id" = "https://graph.microsoft.com/v1.0/users/$phil"
  }
  Write-Host "Set manager: $_ → Phil Greaves"
}

# Deliberately leave some personas without managers
Write-Host "`nPersonas without managers (deliberate gap):"
Write-Host "  Mark Taylor, Sarah Blackwood, Ben Hughes"

$groups = @(
  @{ Name="SG-All-Staff"; Type="Security"; Desc="All NE staff"; Owner=$phil },
  @{ Name="SG-Engineering"; Type="Security"; Desc="Engineering department"; Owner=$null },
  @{ Name="SG-Finance-Readers"; Type="Security"; Desc=$null; Owner=$null },
  @{ Name="SG-SOC-Operations"; Type="Security"; Desc="SOC team operational access"; Owner=$rachel },
  @{ Name="SG-IT-Admins"; Type="Security"; Desc="IT administration"; Owner=$phil },
  @{ Name="SG-Engineering-Leads"; Type="Security"; Desc="Engineering team leads"; Owner=$null },
  @{ Name="SG-SharePoint-HR-Site"; Type="Security"; Desc=$null; Owner=$null },
  @{ Name="SG-Defender-Alerts"; Type="Security"; Desc="Defender alert recipients"; Owner=$rachel },
  @{ Name="SG-Compliance-Training"; Type="Security"; Desc=$null; Owner=$null },
  @{ Name="SG-Project-Alpha"; Type="Security"; Desc=$null; Owner=$null },
  @{ Name="Team-Office-Migration-2023"; Type="M365"; Desc=$null; Owner=$null },
  @{ Name="Team-SOC-L1"; Type="M365"; Desc="SOC Level 1 analyst team"; Owner=$tom },
  @{ Name="Team-Vendor-Onboarding-2024"; Type="M365"; Desc=$null; Owner=$null }
)

foreach ($g in $groups) {
  $params = @{
    DisplayName     = $g.Name
    MailEnabled     = ($g.Type -eq "M365")
    MailNickname    = $g.Name.ToLower() -replace '[^a-z0-9]', ''
    SecurityEnabled = $true
  }
  if ($g.Type -eq "M365") {
    $params.GroupTypes = @("Unified")
  }
  if ($g.Desc) { $params.Description = $g.Desc }

  $newGroup = New-MgGroup @params
  Write-Host "Created group: $($g.Name) ($($g.Type)) — Owner: $(if ($g.Owner) { 'Set' } else { 'NONE' })"

  if ($g.Owner) {
    New-MgGroupOwner -GroupId $newGroup.Id -BodyParameter @{
      "@odata.id" = "https://graph.microsoft.com/v1.0/users/$($g.Owner)"
    }
  }
}

# Priya's accumulated memberships (the mover problem)
$priya = (Get-MgUser -Filter "displayName eq 'Priya Sharma'").Id
@("SG-All-Staff", "SG-Engineering", "SG-Finance-Readers", "SG-Project-Alpha",
  "Team-Office-Migration-2023", "Team-SOC-L1", "SG-SOC-Operations",
  "SG-SharePoint-HR-Site", "SG-Defender-Alerts", "SG-Engineering-Leads",
  "SG-Compliance-Training") | ForEach-Object {
  $gid = (Get-MgGroup -Filter "displayName eq '$_'").Id
  New-MgGroupMember -GroupId $gid -BodyParameter @{
    "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$priya"
  } -ErrorAction SilentlyContinue
}
Write-Host "Priya Sharma: 11 group memberships (mover problem)"

# Tom — SOC groups only
$tomId = (Get-MgUser -Filter "displayName eq 'Tom Ashworth'").Id
@("SG-All-Staff", "Team-SOC-L1", "SG-SOC-Operations", "SG-Defender-Alerts") | ForEach-Object {
  $gid = (Get-MgGroup -Filter "displayName eq '$_'").Id
  New-MgGroupMember -GroupId $gid -BodyParameter @{
    "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$tomId"
  } -ErrorAction SilentlyContinue
}

# Phil — over-privileged IT Director
$philId = (Get-MgUser -Filter "displayName eq 'Phil Greaves'").Id
@("SG-All-Staff", "SG-IT-Admins", "SG-Engineering", "SG-Finance-Readers",
  "SG-SOC-Operations", "SG-Project-Alpha", "Team-Office-Migration-2023") | ForEach-Object {
  $gid = (Get-MgGroup -Filter "displayName eq '$_'").Id
  New-MgGroupMember -GroupId $gid -BodyParameter @{
    "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$philId"
  } -ErrorAction SilentlyContinue
}
Write-Host "Phil Greaves: 7 group memberships (cross-department accumulation)"

$appSpecs = @(
  @{ Name="NE-CRM-Integration"; Perms=@("User.Read.All") },
  @{ Name="NE-Data-Migration-Tool"; Perms=@("User.ReadWrite.All",
     "Group.ReadWrite.All", "Mail.ReadWrite", "Directory.ReadWrite.All") },
  @{ Name="NE-Backup-Service"; Perms=@("Mail.Read", "Files.Read.All") },
  @{ Name="NE-Dev-Test-App"; Perms=@("User.Read") },
  @{ Name="NE-Legacy-Reporting"; Perms=@("Files.ReadWrite.All",
     "Sites.ReadWrite.All") },
  @{ Name="NE-Vendor-SSO"; Perms=@("User.Read.All", "GroupMember.Read.All") }
)

$graphAppId = "00000003-0000-0000-c000-000000000000"

foreach ($spec in $appSpecs) {
  # Create app registration
  $app = New-MgApplication -DisplayName $spec.Name

  # Add a client secret
  $secret = Add-MgApplicationPassword -ApplicationId $app.Id -PasswordCredential @{
    DisplayName = "Lab secret"
    EndDateTime = (Get-Date).AddMonths(6)
  }

  Write-Host "Created app: $($spec.Name) — Secret expires: $(
    (Get-Date).AddMonths(6).ToString('yyyy-MM-dd'))"
}

# Create one app with an already-expired secret (for credential health testing)
$expiredApp = New-MgApplication -DisplayName "NE-Abandoned-POC"
# Note: You cannot create an already-expired secret via Graph API.
# The expired credential scenario will be simulated in Module 9.
Write-Host "Created app: NE-Abandoned-POC (credential expiry simulated in M9)"

$guests = @(
  @{ Email="alex.rivera@contoso.com"; Name="Alex Rivera (Contoso)" },
  @{ Email="vendor.pentest@external.com"; Name="Vendor-PenTest" },
  @{ Email="sarah.kim@partner.com"; Name="Sarah Kim (Partner)" },
  @{ Email="old.contractor@legacy.com"; Name="Old Contractor" },
  @{ Email="project.contact@vendor.com"; Name="Project Contact (Vendor)" }
)

foreach ($g in $guests) {
  $invitation = New-MgInvitation -InvitedUserEmailAddress $g.Email `
    -InvitedUserDisplayName $g.Name `
    -InviteRedirectUrl "https://myapps.microsoft.com" `
    -SendInvitationMessage:$false

  Write-Host "Invited guest: $($g.Name) ($($g.Email))"
}

Write-Host "`n5 guest accounts created (invitations not sent — lab accounts)"

$philId = (Get-MgUser -Filter "displayName eq 'Phil Greaves'").Id

$roles = @("Global Administrator", "Exchange Administrator",
  "SharePoint Administrator", "User Administrator")

foreach ($roleName in $roles) {
  $role = Get-MgDirectoryRole -Filter "displayName eq '$roleName'" -ErrorAction SilentlyContinue
  if (-not $role) {
    $template = Get-MgDirectoryRoleTemplate | Where-Object { $_.DisplayName -eq $roleName }
    $role = New-MgDirectoryRole -RoleTemplateId $template.Id
  }
  New-MgDirectoryRoleMember -DirectoryRoleId $role.Id -BodyParameter @{
    "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$philId"
  } -ErrorAction SilentlyContinue
  Write-Host "Assigned role: $roleName → Phil Greaves"
}

Write-Host "=== LAB ENVIRONMENT VERIFICATION ==="

$users = Get-MgUser -All -Property displayName, department, employeeHireDate
$nePersonas = $users | Where-Object {
  $_.DisplayName -match "Okafor|Ashworth|Sharma|Webb|Petrova|Greaves|Whitfield|Blackwood|Chen|Okonkwo|Taylor|Kowalski|Hughes|Al-Rashid|Morrison"
}
Write-Host "NE personas: $($nePersonas.Count) / 15 expected"

$groups = Get-MgGroup -All -Property displayName
$neGroups = $groups | Where-Object { $_.DisplayName -match "^(SG-|Team-)" }
Write-Host "NE groups: $($neGroups.Count) / 13 expected"

$apps = Get-MgApplication -All -Property displayName
$neApps = $apps | Where-Object { $_.DisplayName -like "NE-*" }
Write-Host "NE app registrations: $($neApps.Count) / 7 expected"

$guests = Get-MgUser -All | Where-Object { $_.UserType -eq "Guest" }
Write-Host "Guest accounts: $($guests.Count) / 5 expected"

# Check governance trial
try {
  $lcw = Get-MgIdentityGovernanceLifecycleWorkflow -ErrorAction Stop
  Write-Host "Governance trial: ACTIVE (lifecycle workflows accessible)"
} catch {
  Write-Host "Governance trial: NOT ACTIVE — activate before Module 2"
}

Write-Host "`n=== VERIFICATION COMPLETE ==="

# Quick tenant configuration check
Write-Host "=== TENANT CONFIGURATION BASELINE ==="

# Check security defaults
$org = Get-MgOrganization
Write-Host "Tenant: $($org.DisplayName)"

# Check user settings
$authPolicy = Get-MgPolicyAuthorizationPolicy
Write-Host "Users can register apps: $($authPolicy.DefaultUserRolePermissions.AllowedToCreateApps)"
Write-Host "Users can create tenants: $(if ($authPolicy.DefaultUserRolePermissions.AllowedToCreateTenants) { 'Yes' } else { 'Restricted' })"

# Check CA policies
$caPolicies = Get-MgIdentityConditionalAccessPolicy -All -ErrorAction SilentlyContinue
Write-Host "Conditional Access policies: $(if ($caPolicies) { $caPolicies.Count } else { '0 (Security Defaults likely active)' })"

Write-Host "`nBaseline configuration verified. Do not modify these settings — the course changes them with documented ADR rationale."