# Export-M365UserCertification.ps1
# Requires Microsoft Graph PowerShell SDK
#
# To run: .\User-Recertification.ps1 -OutputPath "C:\Users\Matt\OneDrive - Add Source Group\Documents\1- Projects\M365-User-Certification-Export.csv"

param(
    [string]$OutputPath = ".\M365-User-Certification-Export.csv"
)

# Install if needed:
# Install-Module Microsoft.Graph -Scope CurrentUser

Import-Module Microsoft.Graph.Users
Import-Module Microsoft.Graph.Identity.DirectoryManagement

$Scopes = @(
    "User.Read.All",
    "Directory.Read.All",
    "AuditLog.Read.All"
)

Connect-MgGraph -Scopes $Scopes

# Build SKU lookup so license GUIDs become readable names
$SkuLookup = @{}
Get-MgSubscribedSku -All | ForEach-Object {
    $SkuLookup[$_.SkuId.ToString()] = $_.SkuPartNumber
}

$Properties = @(
    "id",
    "displayName",
    "userPrincipalName",
    "userType",
    "accountEnabled",
    "assignedLicenses",
    "externalUserState",
    "signInActivity"
)

$Users = Get-MgUser -All -Property $Properties

$Export = foreach ($User in $Users) {
    $AssignedLicenses = if ($User.AssignedLicenses.Count -gt 0) {
        ($User.AssignedLicenses | ForEach-Object {
            $SkuId = $_.SkuId.ToString()
            if ($SkuLookup.ContainsKey($SkuId)) {
                $SkuLookup[$SkuId]
            }
            else {
                $SkuId
            }
        }) -join "; "
    }
    else {
        "None"
    }

    [PSCustomObject]@{
        Name                      = $User.DisplayName
        UserPrincipalName         = $User.UserPrincipalName
        UserType                  = $User.UserType
        AccountEnabled            = $User.AccountEnabled
        AssignedLicenses          = $AssignedLicenses
        GuestInvitationState      = $User.ExternalUserState
        LastInteractiveSignInDate = $User.SignInActivity.LastSignInDateTime
    }
}

$Export |
    Sort-Object Name |
    Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8

Write-Host "Export complete: $OutputPath"