az deployment group create `
  --resource-group  <your-rg> `
  --template-file   deploy/automation-account.json `
  --parameters      deploy/automation-account.parameters.json

Install-Module Microsoft.Graph.Applications -Scope CurrentUser

.\deploy\Assign-ManagedIdentityPermissions.ps1 -ManagedIdentityObjectId <principalId>

#Requires -Version 7.2

param()

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

#region Helpers

function Get-ManagedIdentityToken {
    Connect-AzAccount -Identity -ErrorAction Stop | Out-Null
    $tokenObj = Get-AzAccessToken -ResourceUrl 'https://graph.microsoft.com' -ErrorAction Stop
    # .Token is a SecureString in Az 9+; convert to plain text
    if ($tokenObj.Token -is [System.Security.SecureString]) {
        return [System.Net.NetworkCredential]::new('', $tokenObj.Token).Password
    }
    return $tokenObj.Token
}

function New-GraphHeaders {
    param([string]$Token)
    return @{
        Authorization  = "Bearer $Token"
        'Content-Type' = 'application/json'
    }
}

function Get-GraphAll {
    param(
        [string]   $Uri,
        [hashtable]$Headers
    )
    $results = [System.Collections.Generic.List[object]]::new()
    do {
        $page = Invoke-RestMethod -Uri $Uri -Headers $Headers -Method Get
        foreach ($item in $page.value) { $results.Add($item) }
        $Uri  = $page.PSObject.Properties['@odata.nextLink']?.Value
    } while ($Uri)
    return $results
}

function Send-ErrorEmail {
    param(
        [hashtable]$Headers,
        [string]   $Sender,
        [string]   $Recipient,
        [string[]] $Errors
    )
    $body = @{
        message = @{
            subject = 'SyncEntraGroupMemberDevices - Errors Detected'
            body    = @{
                contentType = 'Text'
                content     = "The following errors occurred during the sync run:`n`n" + ($Errors -join "`n`n")
            }
            toRecipients = @(
                @{ emailAddress = @{ address = $Recipient } }
            )
        }
        saveToSentItems = $false
    } | ConvertTo-Json -Depth 10

    $encodedSender = [uri]::EscapeDataString($Sender)
    Invoke-RestMethod `
        -Uri     "https://graph.microsoft.com/v1.0/users/$encodedSender/sendMail" `
        -Headers $Headers `
        -Method  Post `
        -Body    $body | Out-Null
}

#endregion

#region Main

Write-Output "$(Get-Date -Format 'u')  Starting SyncEntraGroupMemberDevices"

$groupPairsJson = Get-AutomationVariable -Name 'SyncGroupPairs'
$notifSender    = Get-AutomationVariable -Name 'NotificationSender'
$notifRecipient = Get-AutomationVariable -Name 'NotificationRecipient'

$groupPairs = $groupPairsJson | ConvertFrom-Json
$errors     = [System.Collections.Generic.List[string]]::new()

$token   = Get-ManagedIdentityToken
$headers = New-GraphHeaders -Token $token

foreach ($pair in $groupPairs) {
    $srcId = $pair.SourceGroupId
    $tgtId = $pair.TargetGroupId

    Write-Output "--- Pair: $srcId -> $tgtId ---"

    try {
        # 1. Source group direct members (users only)
        $members = Get-GraphAll `
            -Uri     "https://graph.microsoft.com/v1.0/groups/$srcId/members?`$select=id,userPrincipalName" `
            -Headers $headers

        $userIds = @($members |
            Where-Object { $_.'@odata.type' -eq '#microsoft.graph.user' } |
            Select-Object -ExpandProperty id)

        Write-Output "  Source members (users): $($userIds.Count)"

        # 2. Intune managed devices for each user
        $desiredIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)

        foreach ($userId in $userIds) {
            $devices = Get-GraphAll `
                -Uri     "https://graph.microsoft.com/v1.0/users/$userId/managedDevices?`$select=azureADDeviceId" `
                -Headers $headers

            foreach ($d in $devices) {
                if ([string]::IsNullOrWhiteSpace($d.azureADDeviceId)) { continue }

                # azureADDeviceId is the deviceId property on the Entra device object,
                # not its directory object ID - resolve to get the id used in group membership.
                $entraDevice = Get-GraphAll `
                    -Uri     "https://graph.microsoft.com/v1.0/devices?`$filter=deviceId eq '$($d.azureADDeviceId)'&`$select=id" `
                    -Headers $headers

                foreach ($ed in $entraDevice) {
                    $desiredIds.Add($ed.id) | Out-Null
                }
            }
        }

        Write-Output "  Desired devices: $($desiredIds.Count)"

        # 3. Current target group members (devices only)
        $currentMembers = Get-GraphAll `
            -Uri     "https://graph.microsoft.com/v1.0/groups/$tgtId/members?`$select=id" `
            -Headers $headers

        $currentDeviceIds = [System.Collections.Generic.HashSet[string]]::new(
            [string[]]@($currentMembers |
                Where-Object { $_.'@odata.type' -eq '#microsoft.graph.device' } |
                Select-Object -ExpandProperty id),
            [System.StringComparer]::OrdinalIgnoreCase
        )

        Write-Output "  Current device members: $($currentDeviceIds.Count)"

        # 4. Delta
        $toAdd    = @($desiredIds      | Where-Object { -not $currentDeviceIds.Contains($_) })
        $toRemove = @($currentDeviceIds | Where-Object { -not $desiredIds.Contains($_) })

        Write-Output "  To add: $($toAdd.Count)  |  To remove: $($toRemove.Count)"

        # 5. Add
        foreach ($deviceId in $toAdd) {
            $refBody = @{
                '@odata.id' = "https://graph.microsoft.com/v1.0/directoryObjects/$deviceId"
            } | ConvertTo-Json

            Invoke-RestMethod `
                -Uri     "https://graph.microsoft.com/v1.0/groups/$tgtId/members/`$ref" `
                -Headers $headers `
                -Method  Post `
                -Body    $refBody | Out-Null

            Write-Output "  + $deviceId"
        }

        # 6. Remove
        foreach ($deviceId in $toRemove) {
            Invoke-RestMethod `
                -Uri     "https://graph.microsoft.com/v1.0/groups/$tgtId/members/$deviceId/`$ref" `
                -Headers $headers `
                -Method  Delete | Out-Null

            Write-Output "  - $deviceId"
        }

        Write-Output "  Pair completed"
    }
    catch {
        $uri = $_.Exception.Response?.RequestMessage?.RequestUri?.AbsoluteUri
        $detail = if ($uri) { " [URL: $uri]" } else { '' }
        $msg = "Pair $srcId -> $tgtId : $($_.Exception.Message)$detail"
        Write-Warning $msg
        $errors.Add($msg)
    }
}

# 7. Notify on errors
if ($errors.Count -gt 0) {
    Write-Output "Sending error notification to $notifRecipient"
    try {
        Send-ErrorEmail -Headers $headers -Sender $notifSender -Recipient $notifRecipient -Errors $errors
        Write-Output "Notification sent"
    }
    catch {
        Write-Warning "Failed to send notification: $($_.Exception.Message)"
    }
}

Write-Output "$(Get-Date -Format 'u')  Done. Pairs: $($groupPairs.Count)  Errors: $($errors.Count)"

#endregion