MSA1.13 Guided Walkthrough — The Identity Layer as a System

Connect-MgGraph -Scopes "User.Read.All","Group.Read.All","AuditLog.Read.All",
  "Directory.Read.All","AdministrativeUnit.Read.All","Application.Read.All",
  "Policy.Read.All"

$domain = (Get-MgOrganization).VerifiedDomains |
  Where-Object { $_.IsDefault } |
  Select-Object -ExpandProperty Name

# Get all member users
$members = Get-MgUser -All -Property DisplayName, Department, UserType |
  Where-Object { $_.UserType -eq 'Member' -and $_.DisplayName -notmatch 'Break Glass' }

Write-Host "Member users (excl. break-glass): $($members.Count)"
Write-Host ""

# For each member, check if they're in their department's SG group
$ungrouped = foreach ($user in $members) {
  $dept = $user.Department
  if (-not $dept) {
    [PSCustomObject]@{ Name=$user.DisplayName; Issue="No Department attribute"; Group="N/A" }
    continue
  }

  $expectedGroup = "SG-$dept-All"
  $userGroups = Get-MgUserMemberOf -UserId $user.Id -All |
    Where-Object { $_.AdditionalProperties['displayName'] -eq $expectedGroup }

  if (-not $userGroups) {
    [PSCustomObject]@{ Name=$user.DisplayName; Issue="Not in department group"; Group=$expectedGroup }
  }
}

if ($ungrouped) {
  Write-Host "⚠ IDENTITY-TO-GROUP GAPS:"
  $ungrouped | Format-Table -AutoSize
} else {
  Write-Host "✓ All members are in their department groups"
}

$priya = Get-MgUser -UserId "p.sharma@$domain"
$priyaGroups = Get-MgUserMemberOf -UserId $priya.Id -All |
  Where-Object { $_.AdditionalProperties['@odata.type'] -eq '#microsoft.graph.group' }

Write-Host "SOC Analyst 2 — $($priya.Department), $($priya.JobTitle)"
Write-Host "Total group memberships: $($priyaGroups.Count)"
Write-Host ""

# Classify each group as current or stale based on Department
foreach ($group in $priyaGroups) {
  $name = $group.AdditionalProperties['displayName']

  # Priya is in Security. Engineering/CAD/PLM/Safety groups are stale.
  $stale = $name -match 'Engineering|CAD|PLM|Safety'
  $verdict = if ($stale) { "⚠ STALE — previous role" } else { "✓ Current" }

  Write-Host "  $verdict : $name"
}

Write-Host ""
$staleCount = ($priyaGroups | Where-Object {
  $_.AdditionalProperties['displayName'] -match 'Engineering|CAD|PLM|Safety'
}).Count
Write-Host "Current: $($priyaGroups.Count - $staleCount) groups"
Write-Host "Stale:   $staleCount groups (from Engineering role + Safety project)"
Write-Host ""
Write-Host "This is the mover problem. Priya changed departments 3 months ago."
Write-Host "Nobody removed her old access. An access review (MSA12) would catch this."
Write-Host "A mover workflow (MSA1.7) would have prevented it."

$groups = Get-MgGroup -All -Property DisplayName

# Question 1: How many department groups exist?
$deptGroups = $groups | Where-Object { $_.DisplayName -match '^SG-.+-All$' }
Write-Host "Q1: Department groups (SG-*-All): $($deptGroups.Count)"
$deptGroups | ForEach-Object { Write-Host "     $($_.DisplayName)" }
Write-Host ""

# Question 2: How many CA exclusion groups exist?
$caExclude = $groups | Where-Object { $_.DisplayName -match '^SG-CA-Exclude' }
Write-Host "Q2: CA exclusion groups (SG-CA-Exclude-*): $($caExclude.Count)"
$caExclude | ForEach-Object { Write-Host "     $($_.DisplayName)" }
Write-Host ""

# Question 3: How many groups DON'T follow the naming convention?
$nonCompliant = $groups | Where-Object {
  $_.DisplayName -notmatch '^(SG-|M365-|DG-|DL-|SG-CA-)'
}
Write-Host "Q3: Non-compliant group names: $($nonCompliant.Count)"
$nonCompliant | ForEach-Object { Write-Host "     ❌ $($_.DisplayName)" }
Write-Host ""

Write-Host "The non-compliant groups are the intentional gaps from MSA1.12."
Write-Host "In the organization's production tenant, 127 groups (59%) would be non-compliant."
Write-Host "Each non-compliant group is invisible to programmatic governance."

# Get Manchester AU members
$manchesterAU = Get-MgDirectoryAdministrativeUnit -All |
  Where-Object { $_.DisplayName -eq "NE-Site-Manchester" }

if ($manchesterAU) {
  $auMembers = Get-MgDirectoryAdministrativeUnitMember -AdministrativeUnitId $manchesterAU.Id -All

  # Get Manchester group members
  $manchesterGroup = Get-MgGroup -Filter "displayName eq 'SG-Manchester-Staff'"
  $groupMembers = Get-MgGroupMember -GroupId $manchesterGroup.Id -All

  Write-Host "AU members (NE-Site-Manchester):    $($auMembers.Count)"
  Write-Host "Group members (SG-Manchester-Staff): $($groupMembers.Count)"
  Write-Host ""

  # Find mismatches
  $auIds = $auMembers.Id
  $groupIds = $groupMembers.Id

  $inAUonly = $auIds | Where-Object { $_ -notin $groupIds }
  $inGroupOnly = $groupIds | Where-Object { $_ -notin $auIds }

  if ($inAUonly.Count -eq 0 -and $inGroupOnly.Count -eq 0) {
    Write-Host "✓ Perfect alignment — AU and group have identical membership"
    Write-Host "  Manchester Helpdesk Admin scope = Manchester CA policy scope"
  } else {
    Write-Host "⚠ MISALIGNMENT:"
    Write-Host "  In AU but NOT in group: $($inAUonly.Count) users"
    Write-Host "  In group but NOT in AU: $($inGroupOnly.Count) users"
    Write-Host ""
    Write-Host "  Users in the AU but not the group: admin-delegated but NOT"
    Write-Host "  covered by Manchester-specific CA policies."
    Write-Host "  Users in the group but not the AU: covered by CA but NOT"
    Write-Host "  manageable by the Manchester Helpdesk Administrator."
  }
} else {
  Write-Host "NE-Site-Manchester AU not found — create it in the lab first"
}

$groups = Get-MgGroup -All -Property DisplayName, Description

$results = foreach ($group in $groups) {
  $members = (Get-MgGroupMember -GroupId $group.Id -All -ErrorAction SilentlyContinue)
  $owners = (Get-MgGroupOwner -GroupId $group.Id -All -ErrorAction SilentlyContinue)

  $issues = @()
  if ($members.Count -eq 0) { $issues += "Empty" }
  if ($owners.Count -eq 0) { $issues += "No owner" }
  if (-not $group.Description) { $issues += "No description" }
  if ($group.DisplayName -notmatch '^(SG-|M365-|DG-|DL-)') { $issues += "Bad name" }

  [PSCustomObject]@{
    Name     = $group.DisplayName
    Members  = $members.Count
    Owners   = $owners.Count
    HasDesc  = [bool]$group.Description
    Issues   = if ($issues) { $issues -join ", " } else { "None — governance-ready" }
    Ready    = $issues.Count -eq 0
  }
}

$ready = ($results | Where-Object { $_.Ready }).Count
$notReady = ($results | Where-Object { -not $_.Ready }).Count

Write-Host "=== GROUP GOVERNANCE READINESS ==="
Write-Host "Governance-ready: $ready ($([math]::Round($ready/$results.Count*100))%)"
Write-Host "Not ready:        $notReady ($([math]::Round($notReady/$results.Count*100))%)"
Write-Host ""

Write-Host "Groups NOT governance-ready:"
$results | Where-Object { -not $_.Ready } |
  Select-Object Name, Members, Owners, Issues | Format-Table -AutoSize

Write-Host "==========================================="
Write-Host "  IDENTITY ARCHITECTURE HEALTH DASHBOARD"
Write-Host "==========================================="
Write-Host ""

# 1. Census (MSA1.2)
$allUsers = Get-MgUser -All -Property UserType, AccountEnabled, Department
$members = $allUsers | Where-Object { $_.UserType -eq 'Member' }
$guests = $allUsers | Where-Object { $_.UserType -eq 'Guest' }
Write-Host "[CENSUS]"
Write-Host "  Members:     $($members.Count)"
Write-Host "  Guests:      $($guests.Count)"
Write-Host "  Total users: $($allUsers.Count)"
Write-Host ""

# 2. Attribute quality (MSA1.6/1.7)
$withDept = ($members | Where-Object { $_.Department }).Count
$deptPct = if ($members.Count -gt 0) { [math]::Round($withDept/$members.Count*100,1) } else { 0 }
Write-Host "[ATTRIBUTE QUALITY]"
Write-Host "  Department coverage: $withDept / $($members.Count) ($deptPct%)"
Write-Host "  Target: 100% (required for dynamic groups and lifecycle workflows)"
Write-Host ""

# 3. Group health (MSA1.10)
$allGroups = Get-MgGroup -All -Property DisplayName
$compliantNames = ($allGroups | Where-Object {
  $_.DisplayName -match '^(SG-|M365-|DG-|DL-)'
}).Count
$namePct = [math]::Round($compliantNames/$allGroups.Count*100)
Write-Host "[GROUP HEALTH]"
Write-Host "  Total groups:        $($allGroups.Count)"
Write-Host "  Naming compliance:   $compliantNames / $($allGroups.Count) ($namePct%)"
Write-Host "  Target: 95%+ naming compliance"
Write-Host ""

# 4. AU coverage (MSA1.6)
$aus = Get-MgDirectoryAdministrativeUnit -All
Write-Host "[ADMINISTRATIVE UNITS]"
Write-Host "  Total AUs:    $($aus.Count)"
$aus | ForEach-Object {
  $memberCount = (Get-MgDirectoryAdministrativeUnitMember -AdministrativeUnitId $_.Id -All).Count
  $restricted = if ($_.IsMemberManagementRestricted) { " [RESTRICTED]" } else { "" }
  Write-Host "    $($_.DisplayName): $memberCount members$restricted"
}
Write-Host ""

# 5. Intentional gaps remaining (MSA1.12)
Write-Host "[GAPS TO FIX]"
$mfaExclude = Get-MgGroup -Filter "displayName eq 'SG-CA-Exclude-MFA'" -ErrorAction SilentlyContinue
if ($mfaExclude) {
  $mfaMembers = (Get-MgGroupMember -GroupId $mfaExclude.Id -All).Count
  Write-Host "  ⚠ MFA exclusion group exists with $mfaMembers members (fix in MSA2)"
} else {
  Write-Host "  ✓ MFA exclusion group removed"
}
$badGroups = $allGroups | Where-Object { $_.DisplayName -in @("old contractors group","Project Safety") }
Write-Host "  ⚠ Non-compliant groups remaining: $($badGroups.Count) (fix in MSA1.10)"
Write-Host ""

Write-Host "==========================================="
Write-Host "  Run this dashboard monthly to track"
Write-Host "  improvement as you progress through MSA2+"
Write-Host "==========================================="