Install-Module Microsoft.Graph -Scope CurrentUser
Install-Module MSAL.PS -Scope CurrentUser
Install-Module Microsoft.PowerShell.ConsoleGuiTools -Scope CurrentUser
Install-Module ExchangeOnlineManagement -Scope CurrentUser

#Requires -Version 7.2
#Requires -Modules MSAL.PS, Microsoft.PowerShell.ConsoleGuiTools

param(
    [Parameter(
        Mandatory = $true, 
        HelpMessage = @"
Create an App registration with the following:
- For permissions, added Microsoft Partner Center > user_impersonation as a delegated permission
- Under Authentication, add Mobile and Device Applications and add https://localhost as a Custom Redirect URI

Use the Application ID for this parameter.
"@)]
    [string] $PartnerAppId,

    [Parameter(
        HelpMessage = @"
This is the list of scopes you'll need for your script or automation. Example:

Directory.Read.All,AccessReview.Read.All
"@)]
    [string] $Scope
)

$ErrorActionPreference = "stop"

$MsalParams = @{
    ClientId    = $PartnerAppId;
    Interactive = $true;
    Scope       = "https://api.partnercenter.microsoft.com/user_impersonation";
}

$PartnerAccessToken = Get-MsalToken @MsalParams

$PartnerCustomersParams = @{
    Uri     = "https://api.partnercenter.microsoft.com/v1/customers";
    Headers = @{
        "Authorization" = "Bearer $($PartnerAccessToken.AccessToken)"
    };
    Method  = "Get";
}

$SelectedCustomers = (Invoke-RestMethod @PartnerCustomersParams).items | `
    Select-Object -ExpandProperty companyProfile | `
    Select-Object -Property companyName, tenantId | `
    Out-ConsoleGridView -OutputMode Multiple -Title "Select your tenant"

<#
    This step is what will add the application to your customer's organization.
    The EnterpriseAppplicationId below is the app you're allowing to use your partner credentials.
    In this example, it's just the Microsoft Graph enterprise application.
    Notice how the scope isn't in our Partner App. You don't need to specify it in the partner app.
    If you change the scope, it should add the ones you didn't include, but I don't see a way to remove any.
    Your user account's permissions through GDAP are what determines what you really have permissions to so if your user
    didn't have Directory.Read.All permissions, this wouldn't work.

    Since there's no way to check or force this to update, it will throw an error-like message if you've already done this.
#>

# Forcing a scope selection from the list if one wasn't specified.
if (!$Scope) {
    $SelectedScopes = Find-MgGraphPermission | `
        Where-Object PermissionType -eq "Delegated" | `
        Select-Object Name, Description | `
        Out-ConsoleGridView -OutputMode Multiple -Title "Select your scopes"

    $Scope = $SelectedScopes.Name -Join ","

    if (!$Scope) {
        throw "Selecting a scope(s) is required to continue."
    }
}

$AppConsentHeaders = @{
    "Accept"        = "application/json";
    "Content-Type"  = "application/json";
    "Authorization" = "Bearer $($PartnerAccessToken.AccessToken)"
}

$AppConsentBody = ConvertTo-JSON -InputObject @{
    "applicationid"     = $PartnerAppId;
    "applicationGrants" = @(
        @{
            "EnterpriseApplicationId" = "00000003-0000-0000-c000-000000000000"; # Microsoft Graph.
            "Scope"                   = $Scope
        },
        @{
            "EnterpriseApplicationId" = "00000002-0000-0ff1-ce00-000000000000"; # Exchange Online.
            "Scope"                   = "Exchange.Manage"
        }
    )
}

$Index = 0

ForEach ($Customer in $SelectedCustomers) {
    $Index++
    $PercentComplete = [int][math]::Ceiling(100 / $SelectedCustomers.Count * $Index ) 

    Write-Progress `
        -Activity $Customer.companyName `
        -Status "$Index out of $($SelectedCustomers.Count)" `
        -PercentComplete $PercentComplete

    $CustomerTenantId = $Customer.tenantId

    # Removing existing consent if it exists. There isn't a way to query or updates, unfortunately.
    $PartnerCustomerRemoveAppConsentParams = @{
        Uri     = "https://api.partnercenter.microsoft.com/v1/customers/$CustomerTenantId/applicationconsents/$PartnerAppId";
        Headers = $AppConsentHeaders;
        Method  = "DELETE";
    }

    Invoke-RestMethod @PartnerCustomerRemoveAppConsentParams

    # Adding new consents.
    $PartnerCustomerPostAppConsentParams = @{
        Uri     = "https://api.partnercenter.microsoft.com/v1/customers/$CustomerTenantId/applicationconsents";
        Headers = $AppConsentHeaders;
        Body    = $AppConsentBody
        Method  = "POST";
    }

    Invoke-RestMethod @PartnerCustomerPostAppConsentParams | Out-Null
}

#Requires -Version 7.2
#Requires -Modules MSAL.PS, Microsoft.PowerShell.ConsoleGuiTools, ExchangeOnlineManagement

$ErrorActionPreference = "stop"

$PartnerAppId = "{PartnerAppId}"

$MsalParams = @{
    ClientId    = $PartnerAppId;
    Interactive = $true;
    Scope       = "https://api.partnercenter.microsoft.com/user_impersonation";
}

$PartnerAccessToken = Get-MsalToken @MsalParams

$PartnerCustomersParams = @{
    Uri     = "https://api.partnercenter.microsoft.com/v1/customers";
    Headers = @{
        "Authorization" = "Bearer $($PartnerAccessToken.AccessToken)"
    };
    Method  = "Get";
}

# Use this cool module to select a single customer from the list.

$Customer = (Invoke-RestMethod @PartnerCustomersParams).items | `
    Select-Object -ExpandProperty companyProfile | `
    Select-Object -Property companyName, tenantId | `
    Out-ConsoleGridView -OutputMode Single -Title "Select your tenant"

# Get tokens for Exchange Online and Microsoft Graph

$MsalCustomerGraphParams = @{
    ClientId = $PartnerAppId;
    TenantId = $Customer.tenantId;
    Scope    = "Directory.Read.All"; # Change this depending on what you're doing below
    Silent   = $true; # Uses the saved refresh token
}

$MsalCustomerEXOParams = @{
    ClientId = $PartnerAppId;
    TenantId = $Customer.tenantId;
    Scope    = "https://outlook.office365.com/.default";
    Silent   = $true; # Uses the saved refresh token
}

$CustomerGraphAccessToken = Get-MsalToken @MsalCustomerGraphParams
$CustomerEXOAccessToken = Get-MsalToken @MsalCustomerEXOParams

# Connect to Exchange Online and Microsoft Graph and run commands

Connect-ExchangeOnline -DelegatedOrganization $Customer.tenantId -AccessToken $CustomerEXOAccessToken.AccessToken
Connect-MgGraph -AccessToken $CustomerGraphAccessToken.AccessToken

Get-MgUser
Get-ExoMailbox