365Inspect.ps1

<#
  .SYNOPSIS
  Performs Office 365 security assessment.

  .DESCRIPTION
  Automate the security assessment of Microsoft Office 365 environments.

  .PARAMETER UserPrincipalName
  The UPN of the user executing 365Inspect. This value is automatically passed to supported connection strings for PowerShell modules.

  .PARAMETER OutPath
  The path to a folder where the report generated by 365Inspect will be placed.

  .PARAMETER Auth
  Switch that should be one of the literal values "MFA", "CMDLINE", or "ALREADY_AUTHED".

  .PARAMETER reportType
  Optional parameter allowing a specific report output format. Currently supported formats are HTML, JSON, CSV, and XML. Default value is 'All' and generates all formats.

  .INPUTS
  None. You cannot pipe objects to 365Inspect.ps1.

  .OUTPUTS
  None. 365Inspect.ps1 does not generate any output.

  .EXAMPLE
  PS> .\365Inspect.ps1 -OutPath $reports\Company -UserPrincipalName user@company.onmicrosoft.com -Auth MFA
#>


param (
    [Parameter(Mandatory = $true,
        HelpMessage = 'Output path for report')]
    [string] $OutPath,
    [Parameter(Mandatory = $true,
        HelpMessage = 'UserPrincipalName required for Exchange Connection')]
    [string] $UserPrincipalName,
    [Parameter(Mandatory = $false,
        HelpMessage = "Report Output Format")]
    [ValidateSet("All", "HTML", "CSV", "XML", "JSON",
        IgnoreCase = $true)]
    [string] $reportType = "All",
    [Parameter(Mandatory = $false,
        HelpMessage = 'Skip Module Check')]
    [switch]$SkipModuleCheck,
    [Parameter(Mandatory = $false,
        HelpMessage = 'Skip Update Check')]
    [switch]$SkipUpdateCheck,
    [Parameter(Mandatory = $false,
        HelpMessage = 'Environment type')]
    [ValidateSet('Default', 'USGovGCCHigh', 'USGovDoD', 'Germany', 'China',
        IgnoreCase = $false)]
    [string] $Environment = "Default",
    [Parameter(Mandatory = $false,
        HelpMessage = 'Auth type')]
    [ValidateSet('ALREADY_AUTHED', 'MFA', 'DEVICE', 'APP',
        IgnoreCase = $false)]
    [string] $Auth = "MFA",
    [string[]] $SelectedInspectors = @(),
    [string[]] $ExcludedInspectors = @()
)

$global:orgInfo = $null
$out_path = $OutPath
$selected_inspectors = $SelectedInspectors
$excluded_inspectors = $ExcludedInspectors

& $PSScriptRoot\Write-ErrorLog.ps1

$MaximumFunctionCount = 32768

If ($auth -eq 'APP') {
    $domain = Read-Host -Prompt "Enter the mail domain or tenant domain"
    $appID = Read-Host -Prompt "Enter the Client/App ID"
    $thumbprint = Read-Host -Prompt "Enter the Certificate thumbprint"
}

switch ($Environment) {
    "USGovGCCHigh" { $global:graphURI = 'graph.microsoft.us' }
    "USGovDoD" { $global:graphURI = 'dod-graph.microsoft.us' }
    "GermanyCloud" { $global:graphURI = 'graph.microsoft.com' }
    "China" { $global:graphURI = 'microsoftgraph.chinacloudapi.cn' }
    default { $global:graphURI = 'graph.microsoft.com' }
}

If ($PSVersionTable.PSVersion.Major -eq 5) {
    Write-Host "PnP.PowerShell module is not compatible with Windows PowerShell v5.1. Your version: $($PSVersionTable.PSVersion.Major).$($PSVersionTable.PSVersion.Minor)`nExcluding SharePoint Inspectors..."
    $noSharePoint = $true
}
If ($PSVersionTable.PSVersion.Major -lt 7 -and $PSVersionTable.PSVersion.Minor -lt 2) {
    Write-Host "PnP.PowerShell module requires PowerShell version 7.2 or higher. Your version: $($PSVersionTable.PSVersion.Major).$($PSVersionTable.PSVersion.Minor)`nExcluding SharePoint Inspectors..."
    $noSharePoint = $true
}
If ($PSVersionTable.PSVersion.Major -ge 7 -and $PSVersionTable.PSVersion.Minor -ge 2) {
    $noSharePoint = $false
}

Function Connect-Services {
    # Log into every service prior to the analysis.
    If ($auth -EQ "MFA") {
        Try {
            switch ($Environment) {
                "USGovGCCHigh" { $Environment = 'USGov' }
                "USGovDoD" { $Environment = 'USGovDoD' }
                "GermanyCloud" { $Environment = 'Global' }
                "China" { $Environment = 'China' }
                default { $Environment = 'Global' }
            }

            Write-Output "Connecting to Microsoft Graph"
              
            # National Cloud deployments - Valid environments: 'Global', 'USGov', 'USGovDoD', 'China'
            Connect-MgGraph -Environment $Environment -ContextScope Process -Scopes "AuditLog.Read.All", "Reports.Read.All", "Policy.Read.All", "Directory.Read.All", "IdentityProvider.Read.All", "Organization.Read.All", "Securityevents.Read.All", "ThreatIndicators.Read.All", "SecurityActions.Read.All", "User.Read.All", "UserAuthenticationMethod.Read.All", "Mail.Read", "MailboxSettings.Read", "DeviceManagementManagedDevices.Read.All", "DeviceManagementApps.Read.All", "UserAuthenticationMethod.ReadWrite.All", "DeviceManagementServiceConfig.Read.All", "DeviceManagementConfiguration.Read.All", "SharePointTenantSettings.Read.All"

            $global:orgInfo = Get-MgOrganization
            $global:tenantDomain = (($global:orgInfo).VerifiedDomains | Where-Object { ($_.Name -like "*.onmicrosoft.com") -and ($_.Name -notlike "*mail.onmicrosoft.com") }).Name
            Write-Output "Connected via Graph to $((Get-MgOrganization).DisplayName)"
        }
        Catch {
            Write-Output "Connecting to Microsoft Graph Failed."
            Write-Error $_.Exception.Message
            Break
        }
        Try {
            switch ($Environment) {
                "USGovGCCHigh" { $Environment = 'https://ps.compliance.protection.office365.us/powershell-liveid/' ; $AADUri = 'https://login.microsoftonline.us/common' }
                "USGovDoD" { $Environment = 'https://l5.ps.compliance.protection.office365.us/powershell-liveid/' ; $AADUri = 'https://login.microsoftonline.us/common' }
                "GermanyCloud" { $Environment = 'https://ps.compliance.protection.outlook.com/powershell-liveid/' ; $AADUri = 'https://login.microsoftonline.com/common' }
                "China" { $Environment = 'https://ps.compliance.protection.partner.outlook.cn/powershell-liveid' ; $AADUri = 'https://login.chinacloudapi.cn/common' }
                default { $Environment = 'https://ps.compliance.protection.outlook.com/powershell-liveid/' ; $AADUri = 'https://login.microsoftonline.com/common' }
            }

            Write-Output "Connecting to Security and Compliance Center"
            Connect-IPPSSession -ConnectionUri $Environment -AzureADAuthorizationEndpointUri $AADUri -UserPrincipalName $UserPrincipalName
        }
        Catch {
            Write-Output "Connecting to Security and Compliance Center Failed."
            Write-Error $_.Exception.Message
            Break
        }
        Try {
            switch ($Environment) {
                "USGovGCCHigh" { $Environment = 'O365USGovGCCHigh' }
                "USGovDoD" { $Environment = 'O365USGovDoD' }
                "GermanyCloud" { $Environment = 'O365GermanyCloud' }
                "China" { $Environment = 'O365China' }
                default { $Environment = 'O365Default' }
            }

            Write-Output "Connecting to Exchange Online"
            Connect-ExchangeOnline -ExchangeEnvironmentName $Environment -UserPrincipalName $UserPrincipalName -ShowBanner:$false
        }
        Catch {
            Write-Output "Connecting to Exchange Online Failed."
            Write-Error $_.Exception.Message
            Break
        }
        Try {
            switch ($Environment) {
                "USGovGCCHigh" { $Environment = 'USGovernmentHigh' }
                "USGovDoD" { $Environment = 'USGovernmentDoD' }
                "GermanyCloud" { $Environment = 'Germany' }
                "China" { $Environment = 'China' }
                default { $Environment = 'Production' }
            }

            Write-Output "Connecting to SharePoint Service"
            $org_name = ($global:tenantDomain -split '.onmicrosoft.com')[0]

            $pnpApp = Read-Host -Prompt "Please enter the Application/Client ID of the application created to replace PnP.Powershell"

            # National Cloud deployment - Valid environments are: 'USGovernment', 'USGovernmentHigh', 'USGovernmentDoD', 'Germany', 'China'
            Connect-PnPOnline -AzureEnvironment $Environment -Url "https://$org_name-admin.sharepoint.com" -ClientId $pnpApp -Interactive
        }
        Catch {
            Write-Output "Connecting to SharePoint Service Failed."
            Write-Error $_.Exception.Message
            Break
        }
        Try {
            switch ($Environment) {
                "USGovGCCHigh" { $Connection = "Connect-MicrosoftTeams -TeamsEnvironmentName TeamsGCCH " }
                "USGovDoD" { $Connection = "Connect-MicrosoftTeams -TeamsEnvironmentName TeamsDoD" }
                "GermanyCloud" { $Connection = "Connect-MicrosoftTeams" }
                "China" { $Connection = "Connect-MicrosoftTeams -TeamsEnvironmentName TeamsChina" }
                default { $Connection = "Connect-MicrosoftTeams" }
            }

            # National Cloud deployment - Valid enironments are: '', 'TeamsGCCH', 'TeamsDOD', 'TeamsChina'
            #Connect-MicrosoftTeams -TeamsEnvironmentName $Environment
            Invoke-Expression $Connection

            Write-Output "Connecting to Microsoft Teams"
        }
        Catch {
            Write-Output "Connecting to Microsoft Teams Failed."
            Write-Error $_.Exception.Message
            Break
        }
    }
    ElseIf ($auth -EQ "DEVICE") {
        Try {
            switch ($Environment) {
                "USGovGCCHigh" { $Environment = 'USGov' }
                "USGovDoD" { $Environment = 'USGovDoD' }
                "GermanyCloud" { $Environment = 'Global' }
                "China" { $Environment = 'China' }
                default { $Environment = 'Global' }
            }

            Write-Output "Connecting to Microsoft Graph"
              
            # National Cloud deployments - Valid environments: 'Global', 'USGov', 'USGovDoD', 'China'
            Connect-MgGraph -Environment $Environment -DeviceCode -ContextScope Process -Scopes "AuditLog.Read.All", "Reports.Read.All", "Policy.Read.All", "Directory.Read.All", "IdentityProvider.Read.All", "Organization.Read.All", "Securityevents.Read.All", "ThreatIndicators.Read.All", "SecurityActions.Read.All", "User.Read.All", "UserAuthenticationMethod.Read.All", "Mail.Read", "MailboxSettings.Read", "DeviceManagementManagedDevices.Read.All", "DeviceManagementApps.Read.All", "UserAuthenticationMethod.ReadWrite.All", "DeviceManagementServiceConfig.Read.All", "DeviceManagementConfiguration.Read.All", "SharePointTenantSettings.Read.All", "CrossTenantInformation.ReadBasic.All" -NoWelcome

            $global:orgInfo = Get-MgOrganization
            $global:tenantDomain = (($global:orgInfo).VerifiedDomains | Where-Object { ($_.Name -like "*.onmicrosoft.com") -and ($_.Name -notlike "*mail.onmicrosoft.com") }).Name
            Write-Output "Connected via Graph to $((Get-MgOrganization).DisplayName)"
        }
        Catch {
            Write-Output "Connecting to Microsoft Graph Failed."
            Write-Error $_.Exception.Message
            Break
        }
        Try {
            switch ($Environment) {
                "USGovGCCHigh" { $Environment = 'https://ps.compliance.protection.office365.us/powershell-liveid/' ; $AADUri = 'https://login.microsoftonline.us/common' }
                "USGovDoD" { $Environment = 'https://l5.ps.compliance.protection.office365.us/powershell-liveid/' ; $AADUri = 'https://login.microsoftonline.us/common' }
                "GermanyCloud" { $Environment = 'https://ps.compliance.protection.outlook.com/powershell-liveid/' ; $AADUri = 'https://login.microsoftonline.com/common' }
                "China" { $Environment = 'https://ps.compliance.protection.partner.outlook.cn/powershell-liveid' ; $AADUri = 'https://login.chinacloudapi.cn/common' }
                default { $Environment = 'https://ps.compliance.protection.outlook.com/powershell-liveid/' ; $AADUri = 'https://login.microsoftonline.com/common' }
            }

            Write-Output "Connecting to Security and Compliance Center"
            Connect-IPPSSession -ConnectionUri $Environment -Device -AzureADAuthorizationEndpointUri $AADUri -UserPrincipalName $UserPrincipalName
        }
        Catch {
            Write-Output "Connecting to Security and Compliance Center Failed."
            Write-Error $_.Exception.Message
            Break
        }
        Try {
            switch ($Environment) {
                "USGovGCCHigh" { $Environment = 'O365USGovGCCHigh' }
                "USGovDoD" { $Environment = 'O365USGovDoD' }
                "GermanyCloud" { $Environment = 'O365GermanyCloud' }
                "China" { $Environment = 'O365China' }
                default { $Environment = 'O365Default' }
            }

            Write-Output "Connecting to Exchange Online"
            Connect-ExchangeOnline -ExchangeEnvironmentName $Environment -Device -UserPrincipalName $UserPrincipalName -ShowBanner:$false
        }
        Catch {
            Write-Output "Connecting to Exchange Online Failed."
            Write-Error $_.Exception.Message
            Break
        }
        Try {
            switch ($Environment) {
                "USGovGCCHigh" { $Environment = 'USGovernmentHigh' }
                "USGovDoD" { $Environment = 'USGovernmentDoD' }
                "GermanyCloud" { $Environment = 'Germany' }
                "China" { $Environment = 'China' }
                default { $Environment = 'Production' }
            }

            Write-Output "Connecting to SharePoint Service"
            $org_name = ($global:tenantDomain -split '.onmicrosoft.com')[0]

            $pnpApp = Read-Host -Prompt "Please enter the Application/Client ID of the application created to replace PnP.Powershell"

            # National Cloud deployment - Valid environments are: 'USGovernment', 'USGovernmentHigh', 'USGovernmentDoD', 'Germany', 'China'
            Connect-PnPOnline -AzureEnvironment $Environment -DeviceLogin -Url "https://$org_name-admin.sharepoint.com" -ClientId $pnpApp
        }
        Catch {
            Write-Output "Connecting to SharePoint Service Failed."
            Write-Error $_.Exception.Message
            Break
        }
        Try {
            switch ($Environment) {
                "USGovGCCHigh" { $Connection = "Connect-MicrosoftTeams -TeamsEnvironmentName TeamsGCCH -DeviceCode" }
                "USGovDoD" { $Connection = "Connect-MicrosoftTeams -TeamsEnvironmentName TeamsDoD -DeviceCode" }
                "GermanyCloud" { $Connection = "Connect-MicrosoftTeams -DeviceCode" }
                "China" { $Connection = "Connect-MicrosoftTeams -TeamsEnvironmentName TeamsChina -DeviceCode" }
                default { $Connection = "Connect-MicrosoftTeams -DeviceCode" }
            }

            # National Cloud deployment - Valid enironments are: '', 'TeamsGCCH', 'TeamsDOD', 'TeamsChina'
            #Connect-MicrosoftTeams -TeamsEnvironmentName $Environment
            Invoke-Expression $Connection

            Write-Output "Connecting to Microsoft Teams"
        }
        Catch {
            Write-Output "Connecting to Microsoft Teams Failed."
            Write-Error $_.Exception.Message
            Break
        }
        If (! $NoPowerPlatform.IsPresent) {
            Try {
                switch ($Environment) {
                    "GCC" { $endpoint = 'usgov' }
                    "USGovGCCHigh" { $endpoint = 'usgovhigh' }
                    "USGovDoD" { $endpoint = 'dod' }
                    "GermanyCloud" { $endpoint = 'prod' }
                    "China" { $endpoint = 'china' }
                    default { $endpoint = 'prod' }
                }

                Add-PowerAppsAccount -Endpoint $endpoint -Username $UserPrincipalName
            }
            Catch {
                Write-Host "Error connecting to " -NoNewLine -ForegroundColor Red
                Write-Host "Microsoft Power Platform"
                $_.Exception
                Break
            }
        }
    }
    ElseIf ($auth -eq 'APP') {
        If ($domain -like "*@*") {
            $domain = ($domain -split '@')[1]
        }
        $tenantID = (((Invoke-WebRequest -Uri "https://login.microsoftonline.com/$domain/.well-known/openid-configuration" -UseBasicParsing).Content | ConvertFrom-Json).token_endpoint -split '/')[3]

        Try {
            switch ($Environment) {
                "USGovGCCHigh" { $Environment = 'USGov' }
                "USGovDoD" { $Environment = 'USGovDoD' }
                "GermanyCloud" { $Environment = 'Global' }
                "China" { $Environment = 'China' }
                default { $Environment = 'Global' }
            }

            Write-Output "Connecting to Microsoft Graph"
                       
            # National Cloud deployments - Valid environments: 'Global', 'USGov', 'USGovDoD', 'China'
            Connect-MgGraph -Environment $Environment -ClientId $appID -TenantId $tenantID -CertificateThumbPrint $thumbprint | Out-Null
            
            #Connect-MgGraph -ClientId $appID -TenantId $tenantID -CertificateThumbPrint $thumbprint | Out-Null
            $global:orgInfo = Get-MgOrganization
            $global:tenantDomain = (($global:orgInfo).VerifiedDomains | Where-Object { ($_.Name -like "*.onmicrosoft.com") -and ($_.Name -notlike "*mail.onmicrosoft.com") }).Name
        }
        Catch {
            Write-Host "Error connecting to " -NoNewLine -ForegroundColor Red
            Write-Host "Microsoft Graph"
            $_.Exception
            Break
        }
        Try {
            switch ($Environment) {
                "USGovGCCHigh" { $Environment = 'https://ps.compliance.protection.office365.us/powershell-liveid/' ; $AADUri = 'https://login.microsoftonline.us/common' }
                "USGovDoD" { $Environment = 'https://l5.ps.compliance.protection.office365.us/powershell-liveid/' ; $AADUri = 'https://login.microsoftonline.us/common' }
                "GermanyCloud" { $Environment = 'https://ps.compliance.protection.outlook.com/powershell-liveid/' ; $AADUri = 'https://login.microsoftonline.com/common' }
                "China" { $Environment = 'https://ps.compliance.protection.partner.outlook.cn/powershell-liveid' ; $AADUri = 'https://login.chinacloudapi.cn/common' }
                default { $Environment = 'https://ps.compliance.protection.outlook.com/powershell-liveid/' ; $AADUri = 'https://login.microsoftonline.com/common' }
            }

            Write-Output "Connecting to Security and Compliance Center"
            Connect-IPPSSession -ConnectionUri $Environment -AzureADAuthorizationEndpointUri $AADUri -AppId $appID -CertificateThumbprint $thumbprint -Organization $global:tenantDomain | Out-Null
        }
        Catch {
            Write-Host "Error connecting to " -NoNewLine -ForegroundColor Red
            Write-Host "Security Center"
            $_.Exception
        }
        Try {
            switch ($Environment) {
                "USGovGCCHigh" { $Environment = 'O365USGovGCCHigh' }
                "USGovDoD" { $Environment = 'O365USGovDoD' }
                "GermanyCloud" { $Environment = 'O365GermanyCloud' }
                "China" { $Environment = 'O365China' }
                default { $Environment = 'O365Default' }
            }

            Connect-ExchangeOnline -ExchangeEnvironmentName $Environment -CertificateThumbPrint $thumbprint -AppID $appID -Organization $global:tenantDomain -ShowBanner:$false | Out-Null
        }
        Catch {
            Write-Host "Error connecting to " -NoNewLine -ForegroundColor Red
            Write-Host "Exchange Online"
            Write-Host "$($_.Exception.Message)"
            Break
        }
        Try {
            switch ($Environment) {
                "USGovGCCHigh" { $Environment = 'USGovernmentHigh' }
                "USGovDoD" { $Environment = 'USGovernmentDoD' }
                "GermanyCloud" { $Environment = 'Germany' }
                "China" { $Environment = 'China' }
                default { $Environment = 'Production' }
            }

            Write-Output "Connecting to SharePoint Service"
            $org_name = ($global:tenantDomain -split '.onmicrosoft.com')[0]

            # National Cloud deployment - Valid environments are: 'USGovernment', 'USGovernmentHigh', 'USGovernmentDoD', 'Germany', 'China'
            # Production | PPE | China | Germany | USGovernment | USGovernmentHigh | USGovernmentDoD
            Connect-PnPOnline -AzureEnvironment $Environment -Url "https://$org_name-admin.sharepoint.com" -ClientId $appID -Thumbprint $thumbprint -Tenant $global:tenantDomain | Out-Null
        }
        Catch {
            Write-Host "Error connecting to " -NoNewLine -ForegroundColor Red
            Write-Host "PnP/SharePoint"
            $_.Exception
            Break
        }
        Try {
            switch ($Environment) {
                "USGovGCCHigh" { $Connection = "Connect-MicrosoftTeams -TeamsEnvironmentName TeamsGCCH -ApplicationId $appID -TenantId $tenantID -CertificateThumbprint $thumbprint" }
                "USGovDoD" { $Connection = "Connect-MicrosoftTeams -TeamsEnvironmentName TeamsDoD -ApplicationId $appID -TenantId $tenantID -CertificateThumbprint $thumbprint" }
                "GermanyCloud" { $Connection = "Connect-MicrosoftTeams -ApplicationId $appID -TenantId $tenantID -CertificateThumbprint $thumbprint" }
                "China" { $Connection = "Connect-MicrosoftTeams -TeamsEnvironmentName TeamsChina -ApplicationId $appID -TenantId $tenantID -CertificateThumbprint $thumbprint" }
                default { $Connection = "Connect-MicrosoftTeams -ApplicationId $appID -TenantId $tenantID -CertificateThumbprint $thumbprint" }
            }

            Invoke-Expression $Connection
        }
        Catch {
            Write-Host "Error connecting to " -NoNewLine -ForegroundColor Red
            Write-Host "Microsoft Teams"
            $_.Exception
            Break
        }
    }
    Else {
        $global:orgInfo = Get-MgOrganization
        $global:tenantDomain = (($global:orgInfo).VerifiedDomains | Where-Object { ($_.Name -like "*.onmicrosoft.com") -and ($_.Name -notlike "*mail.onmicrosoft.com") }).Name
    }
}

#Function to change color of text on errors for specific messages
Function Colorize($ForeGroundColor) {
    $color = $Host.UI.RawUI.ForegroundColor
    $Host.UI.RawUI.ForegroundColor = $ForeGroundColor
  
    if ($args) {
        Write-Output $args
    }
  
    $Host.UI.RawUI.ForegroundColor = $color
}


Function Confirm-Close {
    Read-Host "Press Enter to Exit"
    Exit
}

Function Confirm-InstalledModules {
    #Check for required Modules and versions; Prompt for install if missing and import.
    $ExchangeOnlineManagement = @{ Name = "ExchangeOnlineManagement"; MinimumVersion = "2.0.5" }
    If ($PSVersionTable.PSVersion.Major -eq 5) {
        $SharePoint = @{ Name = "PnP.PowerShell"; MaximumVersion = "1.12.0" }
    }
    If ($PSVersionTable.PSVersion.Major -ge 6) {
        $SharePoint = @{ Name = "PnP.PowerShell"; MinimumVersion = "2.0.0" }
    }
    $Graph = @{ Name = "Microsoft.Graph"; MinimumVersion = "1.9.6" }
    $MSTeams = @{ Name = "MicrosoftTeams"; MinimumVersion = "4.4.1" }
    $psGet = @{ Name = "PowerShellGet"; RequiredVersion = "2.2.5" }

    Try {
        $psGetVersion = Get-InstalledModule -Name PowerShellGet -ErrorAction Stop

        If ($psGetVersion.Version -lt '2.2.5') {
            Write-Host "[-] " -ForegroundColor Red -NoNewline
            Write-Warning "PowerShellGet is not the correct version. Please install using the following command:"
            Write-Host "Update-Module " -ForegroundColor Yellow -NoNewline
            Write-Host "-Name " -ForegroundColor Gray -NoNewline
            Write-Host "PowerShellGet " -ForegroundColor White -NoNewline
            Write-Host '-Force' -ForegroundColor Gray
            $IsAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")
            if (-not $IsAdmin) {
                Write-Warning "PowerShellGet is not the correct version. Please install using the following command:"
                Write-Host "Update-Module " -ForegroundColor Yellow -NoNewline
                Write-Host "-Name " -ForegroundColor Gray -NoNewline
                Write-Host "PowerShellGet " -ForegroundColor White -NoNewline
                Write-Host '-Force' -ForegroundColor Gray
            }
            Else {
                Write-Host "Installing PowerShellGet`n" -ForegroundColor Magenta
                Install-Module -Name 'PowerShellGet' -AllowPrerelease -AllowClobber -Force -MinimumVersion '2.2.5'
            }
        }
    }
    Catch {
        $exc = $_
        if ($exc -like "*No match was found for the specified search criteria and module names 'powershellget'*") {
            Write-Host "[-] " -ForegroundColor Red -NoNewline
            Write-Warning "PowerShellGet was not installed via PowerShell Gallery. Please install using the following command:"
            Write-Host "Install-Module " -ForegroundColor Yellow -NoNewline
            Write-Host "-Name " -ForegroundColor Gray -NoNewline
            Write-Host "PowerShellGet " -ForegroundColor White -NoNewline
            Write-Host "-RequiredVersion " -ForegroundColor Gray -NoNewline
            Write-Host '2.2.5 ' -ForegroundColor White -NoNewline
            Write-Host '-Force' -ForegroundColor Gray
        }
    }

    $modules = @($psGet, $ExchangeOnlineManagement, $Graph, $SharePoint, $MSTeams)
    $count = 0

    Write-Output "Verifying environment. `n"

    foreach ($module in $modules) {
        $installedVersion = [Version](((Get-InstalledModule -Name $module.Name).Version -split "-")[0])

        If ($module.Name -eq 'PnP.PowerShell') {
            If (($PSVersionTable.PSVersion.Major -eq 5) -and ($installedVersion -le '1.12.0')) {
                Write-Host "Environment is $($PSVersionTable.PSVersion)" -ForegroundColor Yellow
                Write-Host "`t[+] " -NoNewLine -ForeGroundColor Green
                Write-Output "$($module.Name) is installed."
            }
            Elseif (($PSVersionTable.PSVersion.Major -ge 6) -and ($installedVersion -ge '1.12.0')) {
                If ($IsWindows) {
                    Write-Host "Environment is $($PSVersionTable.PSVersion)" -ForegroundColor Yellow
                    Write-Host "`t[+] " -NoNewLine -ForeGroundColor Green
                    Write-Output "$($module.Name) is installed."
                }
                Else {
                    Write-Host "We're sorry, due to various module dependency requirements, this tool will not work on a non-Windows operating system." -ForegroundColor Yellow
                    Exit
                }
            }
        }
        ElseIf (($module.Name -eq (Get-InstalledModule -Name $module.Name).Name) -and (([Version]$module.MinimumVersion -le $installedVersion))) {
            If ($PSVersionTable.PSVersion.Major -eq 5) {
                Write-Host "Environment is $($PSVersionTable.PSVersion)" -ForegroundColor Yellow
                Write-Host "`t[+] " -NoNewLine -ForeGroundColor Green
                Write-Output "$($module.Name) is installed."
                
                If ($module.Name -ne 'Microsoft.Graph') {
                    Write-Host "`tImporting $($module.Name)" -ForeGroundColor Green
                    Import-Module -Name $module.Name | Out-Null
                }
                Else {
                    Write-Host "`tImporting Microsoft.Graph" -ForeGroundColor Green
                    Import-Module -Name Microsoft.Graph.Identity.DirectoryManagement | Out-Null
                    Import-Module -Name Microsoft.Graph.Identity.SignIns | Out-Null
                    Import-Module -Name Microsoft.Graph.Users | Out-Null
                    Import-Module -Name Microsoft.Graph.Applications | Out-Null
                }
            }
            Elseif ($PSVersionTable.PSVersion.Major -ge 6) {
                If ($IsWindows) {
                    Write-Host "Environment is $($PSVersionTable.PSVersion)" -ForegroundColor Yellow
                    Write-Host "`t[+] " -NoNewLine -ForeGroundColor Green
                    Write-Output "$($module.Name) is installed."

                    If (($module.Name -ne 'Microsoft.Graph') -and ($module.Name -ne 'ExchangeOnlineManagement')) {
                        Try {
                            Write-Host "`tImporting $($module.Name)" -ForeGroundColor Green
                            Import-Module -Name $module.Name -UseWindowsPowerShell -WarningAction SilentlyContinue | Out-Null
                        }
                        Catch {
                            Write-Warning "Error message: $_"
                            $message = $_.ToString()
                            $exception = $_.Exception
                            $strace = $_.ScriptStackTrace
                            $failingline = $_.InvocationInfo.Line
                            $positionmsg = $_.InvocationInfo.PositionMessage
                            $pscommandpath = $_.InvocationInfo.PSCommandPath
                            $failinglinenumber = $_.InvocationInfo.ScriptLineNumber
                            $scriptname = $_.InvocationInfo.ScriptName
                            Write-Verbose "Write to log"
                            Write-ErrorLog -message $message -exception $exception -scriptname $scriptname -failinglinenumber $failinglinenumber -failingline $failingline -pscommandpath $pscommandpath -positionmsg $pscommandpath -stacktrace $strace
                            Write-Verbose "Errors written to log"
                        }
                    }
                    Else {
                        Try {
                            Write-Host "`tInporting ExchangeOnlineManagement"
                            Import-Module -Name ExchangeOnlineManagement | Out-Null
                            Write-Host "`tImporting Microsoft.Graph" -ForeGroundColor Green
                            Import-Module -Name Microsoft.Graph.Identity.DirectoryManagement | Out-Null
                            Import-Module -Name Microsoft.Graph.Identity.SignIns | Out-Null
                            Import-Module -Name Microsoft.Graph.Users | Out-Null
                            Import-Module -Name Microsoft.Graph.Applications | Out-Null
                        }
                        Catch {
                            Write-Warning "Error message: $_"
                            $message = $_.ToString()
                            $exception = $_.Exception
                            $strace = $_.ScriptStackTrace
                            $failingline = $_.InvocationInfo.Line
                            $positionmsg = $_.InvocationInfo.PositionMessage
                            $pscommandpath = $_.InvocationInfo.PSCommandPath
                            $failinglinenumber = $_.InvocationInfo.ScriptLineNumber
                            $scriptname = $_.InvocationInfo.ScriptName
                            Write-Verbose "Write to log"
                            Write-ErrorLog -message $message -exception $exception -scriptname $scriptname -failinglinenumber $failinglinenumber -failingline $failingline -pscommandpath $pscommandpath -positionmsg $pscommandpath -stacktrace $strace
                            Write-Verbose "Errors written to log"
                        }
                    }
                }
                Else {
                    Write-Host "We're sorry, due to various module dependency requirements, this tool will not work on a non-Windows operating system." -ForegroundColor Yellow
                    Exit
                }
            }
            $count ++
        }
        Else {
            $message = Write-Output "`n$($module.Name) is not installed."
            $message1 = Write-Output "The module may be installed by running `"Install-Module -Name $($module.Name) -Force -MinimumVersion $($module)`" in an elevated PowerShell window."
            Colorize Red ($message)
            Colorize Yellow ($message1)
            $install = Read-Host -Prompt "Would you like to attempt installation now? (Y|N)"
            If ($install -eq 'y') {
                Install-Module -Name $module.Name -Scope CurrentUser -Force -MinimumVersion $module
                $count ++
            }
        }
    }

    If ($count -lt 4) {
        Write-Output ""
        Write-Output ""
        $message = Write-Output "Dependency checks failed. Please install all missing modules before running this script."
        Colorize Red ($message)
        Confirm-Close
    }
    Else {
        Connect-Services
    }
}


If ($Auth -eq 'ALREADY_AUTHED') {
    Connect-Services
}
Else {
    #Start Script
    If (! $SkipModuleCheck.IsPresent) {
        Confirm-InstalledModules
    }
    Else {
        #Import-RequiredModules
        Connect-Services
    }
}

$global:requirements = $null
$global:ServicePrincipalName = $null
$global:ReaderRole = $false

Function Check-RequiredRoles {
    Colorize Yellow ("Checking for required roles")
    If ((Get-MgContext).AuthType -eq 'AppOnly') {
        Write-Host "Authenticated as Application`n`n" -ForegroundColor Yellow

        $client = (Get-MgContext).ClientId

        $svcPrincipal = (Invoke-GraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/servicePrincipals?filter=appId eq '$client'").value

        $global:ServicePrincipalName = $svcPrincipal.displayName

        $appRoles = (Invoke-GraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/servicePrincipals/$($svcPrincipal.id)/transitiveMemberOf").Value.displayName
    
        $rolesMet = $true
    
        If ('Global Administrator' -notin $appRoles) {
            $rolesMet = $false
            #Break
        }

        If (('Global Reader' -in $appRoles) -and ($rolesMet -eq $false)) {
            $global:ReaderRole = $true
        }
    
        If (! $rolesMet) {
            $global:requirements = '<span style="color:Crimson;"><strong>NOT MET</strong></span> - Some inspectors may fail!'
            Write-Host "[-] NOT MET" -ForegroundColor Red -NoNewline
            Write-Host " - Some inspectors may fail!"
        }
        Else {
            $global:requirements = '<span style="color:Green;"><strong>All requirements met!</strong></span>'
            Write-Host "[+] ALL REQUIREMENTS MET!" -ForegroundColor Green
        }
    }
    Else {
        Write-Host "Authenticated as a User`n`n" -ForegroundColor Yellow

        $myRoles = (Invoke-GraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/me/transitiveMemberOf/microsoft.graph.directoryRole?select=displayName").Value.displayName
    
        $requiredRoles = @('Global Administrator', 'SharePoint Administrator')
    
        $rolesMet = $true
    
        Foreach ($role in $requiredRoles) {
            If ($role -notin $myRoles) {
                $rolesMet = $false
                #Break
            }
        }
    
        If (! $rolesMet) {
            $global:requirements = '<span style="color:Crimson;"><strong>NOT MET</strong></span> - Some inspectors may fail!'
            Write-Host "[-] NOT MET" -ForegroundColor Red -NoNewline
            Write-Host " - Some inspectors may fail!"
        }
        Else {
            $global:requirements = '<span style="color:Green;"><strong>All requirements met!</strong></span>'
            Write-Host "[+] ALL REQUIREMENTS MET!" -ForegroundColor Green
        }
    }
}

# Check for all required roles assignments
Check-RequiredRoles

# Obtain tenant info
$org_name = ($global:tenantDomain -split '.onmicrosoft.com')[0]
$tenantDisplayName = ($global:orgInfo).DisplayName

# Get a list of every available detection module by parsing the PowerShell
# scripts present in the .\inspectors folder. 
#Exclude specified Inspectors
switch ($Environment) {
    "USGovGCCHigh" { $inspectorPath = 'O365GovGCC' }
    "USGovDoD" { $inspectorPath = 'O365GovDoD' }
    "GermanyCloud" { $inspectorPath = 'O365Germany' }
    "China" { $inspectorPath = 'O365China' }
    default { $inspectorPath = 'Inspectors' }
}

$incompatible_inspectors = @()

If ($noSharePoint -eq $true) {
    $incompatible_inspectors += @("Inspect-OutgoingSharingMonitored", "Inspect-SharepointExternalSharing", "Inspect-SharepointExternalUserResharing", "Inspect-SharepointLegacyAuthEnabled", "Inspect-SharepointLinkExpiry", "Inspect-SharepointModernAuthentication")
}

# Exclude Inspectors not compatible with environment
$excluded_inspectors += @($incompatible_inspectors)

If ($global:ReaderRole) {
    $excluded_inspectors += @("Inspect-eDiscoveryAdmins")
    Write-Host "Global Reader role assigned. Excluding Inspect-eDiscoveryAdmins. Principals assigned the eDiscovery Administrator role must be manually queried."
}

If ($excluded_inspectors -and $excluded_inspectors.Count) {
    $excluded_inspectors = foreach ($inspector in $excluded_inspectors) { "$inspector.ps1" }
    $inspectors = (Get-ChildItem .\$inspectorPath\*.ps1 -exclude $excluded_inspectors).Name | ForEach-Object { ($_ -split ".ps1")[0] }
}
else {
    $inspectors = (Get-ChildItem .\$inspectorPath\*.ps1).Name | ForEach-Object { ($_ -split ".ps1")[0] }
}

#Use Selected Inspectors
If ($selected_inspectors -AND $selected_inspectors.Count) {
    "The following inspectors were selected for use: "
    Foreach ($inspector in $selected_inspectors) {
        Write-Output $inspector
    }
}
elseif ($excluded_Inspectors -and $excluded_inspectors.Count) {
    $selected_inspectors = $inspectors
    Write-Output "Using inspectors:`n"
    Foreach ($inspector in $inspectors) {
        Write-Output $inspector
    }
}
Else {
    "Using all inspectors."
    $selected_inspectors = $inspectors
}

#Create Output Directory if required
Try {
    New-Item -ItemType Directory -Force -Path $out_path | Out-Null
    If ((Test-Path $out_path) -eq $true) {
        $path = Resolve-Path $out_path
        Write-Output "$($path.Path) created successfully."
    }
}
Catch {
    Write-Error "Directory not created. Please check permissions."
    Confirm-Close
}

# Maintain a list of all findings, beginning with an empty list.
$findings = @()

# For every inspector the user wanted to run...
ForEach ($selected_inspector in $selected_inspectors) {
    # ...if the user selected a valid inspector...
    If ($inspectors.Contains($selected_inspector)) {
        Write-Output "Invoking Inspector: $selected_inspector"
		
        # Get the static data (finding description, remediation etc.) associated with that inspector module.
        $finding = Get-Content .\$inspectorPath\$selected_inspector.json | Out-String | ConvertFrom-Json
		
        # Invoke the actual inspector module and store the resulting list of insecure objects.
        $finding.AffectedObjects = Invoke-Expression ".\$inspectorPath\$selected_inspector.ps1"
		
        # Add the finding to the list of all findings.
        $findings += $finding
    }
}

# Function that retrieves templating information from 
Function HTML-Report {
    # Function that retrieves templating information from 
    function Parse-Template {
        $template = (Get-Content ".\365InspectDefaultTemplate.html") -join "`n"
        $template -match '\<!--BEGIN_FINDING_LONG_REPEATER-->([\s\S]*)\<!--END_FINDING_LONG_REPEATER-->'
        $findings_long_template = $matches[1]
        
        $template -match '\<!--BEGIN_FINDING_SHORT_REPEATER-->([\s\S]*)\<!--END_FINDING_SHORT_REPEATER-->'
        $findings_short_template = $matches[1]
        
        $template -match '\<!--BEGIN_AFFECTED_OBJECTS_REPEATER-->([\s\S]*)\<!--END_AFFECTED_OBJECTS_REPEATER-->'
        $affected_objects_template = $matches[1]
        
        $template -match '\<!--BEGIN_REFERENCES_REPEATER-->([\s\S]*)\<!--END_REFERENCES_REPEATER-->'
        $references_template = $matches[1]
        
        $template -match '\<!--BEGIN_EXECSUM_TEMPLATE-->([\s\S]*)\<!--END_EXECSUM_TEMPLATE-->'
        $execsum_template = $matches[1]

        $template -match '\<!--BEGIN_CHART_TEMPLATE-->([\s\S]*)\<!--END_CHART_TEMPLATE-->'
        $chart_template = $matches[1]

        $template -match '\<!--BEGIN_APPENDIX-->([\s\S]*)\<!--END_APPENDIX-->'
        $appendix_template = $matches[1]
        
        return @{
            FindingShortTemplate    = $findings_short_template;
            FindingLongTemplate     = $findings_long_template;
            AffectedObjectsTemplate = $affected_objects_template;
            ReportTemplate          = $template;
            ReferencesTemplate      = $references_template;
            ExecsumTemplate         = $execsum_template;
            ChartTemplate           = $chart_template;
            AppendixTemplate        = $appendix_template
        }
    }
    
    $templates = Parse-Template
    
    # Maintain a running list of each finding, represented as HTML
    $short_findings_html = "" 
    $long_findings_html = ""
    $selected_inspectors_html = ""
    
    $findings_count = 0
    
    #$sortedFindings1 = $findings | Sort-Object {$_.FindingName}
    $sortedFindings = $findings | Sort-Object { Switch -Regex ($_.Impact) { 'Critical' { 1 }	'High' { 2 }	'Medium' { 3 }	'Low' { 4 }	'Informational' { 5 } }; $_.FindingName } 

    $criticalCount = 0
    $highCount = 0
    $mediumCount = 0
    $lowCount = 0
    $informationalCount = 0
    $exchangeCount = 0
    $sharepointCount = 0
    $teamsCount = 0
    $intuneCount = 0
    $aadCount = 0
    $securitycomplianceCount = 0
    $tenantCount = 0

    ForEach ($finding in $sortedFindings) {
        # If the result from the inspector was not $null,
        # it identified a real finding that we must process.
        If ($null -NE $finding.AffectedObjects) {
            # Increment total count of findings
            $findings_count += 1
            
            # Keep an HTML variable representing the current finding as HTML
            $short_finding_html = $templates.FindingShortTemplate
            $long_finding_html = $templates.FindingLongTemplate
            
            # Insert finding name and number into template HTML
            $short_finding_html = $short_finding_html.Replace("{{FINDING_NAME}}", $finding.FindingName)
            $short_finding_html = $short_finding_html.Replace("{{FINDING_NUMBER}}", $findings_count.ToString())
            $long_finding_html = $long_finding_html.Replace("{{FINDING_NAME}}", $finding.FindingName)
            $long_finding_html = $long_finding_html.Replace("{{FINDING_NUMBER}}", $findings_count.ToString())
            
            # Finding Impact
            If ($finding.Impact -eq 'Critical') {
                $criticalCount += 1
                $htmlImpact = '<span style="color:Crimson;"><strong>Critical</strong></span>'
                $short_finding_html = $short_finding_html.Replace("{{IMPACT}}", $htmlImpact)
                $long_finding_html = $long_finding_html.Replace("{{IMPACT}}", $htmlImpact)
            }
            ElseIf ($finding.Impact -eq 'High') {
                $highCount += 1
                $htmlImpact = '<span style="color:DarkOrange;"><strong>High</strong></span>'
                $short_finding_html = $short_finding_html.Replace("{{IMPACT}}", $htmlImpact)
                $long_finding_html = $long_finding_html.Replace("{{IMPACT}}", $htmlImpact)
            }
            Else {
                $short_finding_html = $short_finding_html.Replace("{{IMPACT}}", $finding.Impact)
                $long_finding_html = $long_finding_html.Replace("{{IMPACT}}", $finding.Impact)
            }
            
            If ($finding.Impact -eq 'Medium') {
                $mediumCount += 1
            }
            If ($finding.Impact -eq 'Low') {
                $lowCount += 1
            }
            If ($finding.Impact -eq 'Informational') {
                $informationalCount += 1
            }

            Foreach ($service in $finding.Service) {
                if ($service -match 'Exchange') { $exchangeCount += 1 }
                elseif ($service -match 'SharePoint') { $sharepointCount += 1 }
                elseif ($service -match 'Teams') { $teamsCount += 1 }
                elseif ($service -match 'Intune') { $intuneCount += 1 }
                elseif ($service -match 'AzureAD') { $aadCount += 1 }
                elseif ($service -match 'SecurityandCompliance') { $securitycomplianceCount += 1 }
                elseif ($service -eq 'Tenant') { $tenantCount += 1 }
            }

            $short_finding_html = $short_finding_html.Replace("{{RISKRATING}}", $finding.RiskRating)
            $long_finding_html = $long_finding_html.Replace("{{RISKRATING}}", $finding.RiskRating)
            
            # Finding description
            $long_finding_html = $long_finding_html.Replace("{{DESCRIPTION}}", $finding.Description)
    
            # Finding default value
            $long_finding_html = $long_finding_html.Replace("{{DEFAULTVALUE}}", $finding.DefaultValue)
    
            # Finding expected value
            $long_finding_html = $long_finding_html.Replace("{{EXPECTEDVALUE}}", $finding.ExpectedValue)
            
            # Finding Remediation
            If ($finding.Remediation.length -GT 300) {
                $short_finding_text = "Complete remediation advice is provided in the body of the report. Clicking the link to the left will take you there."
            }
            Else {
                $short_finding_text = $finding.Remediation
            }
            
            $short_finding_html = $short_finding_html.Replace("{{REMEDIATION}}", $short_finding_text)
            $long_finding_html = $long_finding_html.Replace("{{REMEDIATION}}", $finding.Remediation)
            
            # Affected Objects
            If ($finding.AffectedObjects.Count -GT 25) {
                $condensed = "<a href='{name}'>{count} Affected Objects Identified<a/>."
                $condensed = $condensed.Replace("{count}", $finding.AffectedObjects.Count.ToString())
                $condensed = $condensed.Replace("{name}", "$($finding.FindingName).txt")
                $affected_object_html = $templates.AffectedObjectsTemplate.Replace("{{AFFECTED_OBJECT}}", $condensed)
                $fname = $finding.FindingName
                $finding.AffectedObjects | Out-File -FilePath "$out_path\$fname.txt"
            }
            Else {
                $affected_object_html = ''
                ForEach ($affected_object in $finding.AffectedObjects) {
                    $affected_object_html += $templates.AffectedObjectsTemplate.Replace("{{AFFECTED_OBJECT}}", $affected_object)
                }
            }
            
            $long_finding_html = $long_finding_html.Replace($templates.AffectedObjectsTemplate, $affected_object_html)
            
            # Finding PowerShell example
            $long_finding_html = $long_finding_html.Replace("{{POWERSHELL}}", $finding.PowerShell)

            # References
            $reference_html = ''
            ForEach ($reference in $finding.References) {
                $this_reference = $templates.ReferencesTemplate.Replace("{{REFERENCE_URL}}", $reference.Url)
                $this_reference = $this_reference.Replace("{{REFERENCE_TEXT}}", $reference.Text)
                $reference_html += $this_reference
            }
            
            $long_finding_html = $long_finding_html.Replace($templates.ReferencesTemplate, $reference_html)
            
            # Add the completed short and long findings to the running list of findings (in HTML)
            $short_findings_html += $short_finding_html
            $long_findings_html += $long_finding_html
        }
    }
    
    # Insert command line execution information. This is coupled kinda badly, as is the Affected Objects html.
    $flags = "<b>Prepared for organization:</b><b> $tenantDisplayName - $org_name</b><br/><br/>"
    $flags = $flags + "<b>Prepared by:</b><b> $UserPrincipalName </b><br/><br/>"  
    $flags = $flags + "<b>Stats</b>:<br/> <b>" + $findings_count + "</b> opportunities for improvement identified from <b>" + $inspectors.Count + "</b> points of inspection.<br/><br/>"
    #$flags = $flags + "<b>Inspector Modules Executed</b>:<br/>" + [String]::Join("<br/>", $selected_inspectors)
    
    # Add Risk Count for Charts
    $chart_template_html = $templates.ChartTemplate
    $chart_template_html = $chart_template_html.Replace("{{TOTAL_COUNT}}", $findings_count)
    $chart_template_html = $chart_template_html.Replace("{{CRITICAL_COUNT}}", $criticalCount<#.ToString()#>)
    $chart_template_html = $chart_template_html.Replace("{{HIGH_COUNT}}", $highCount<#.ToString()#>)
    $chart_template_html = $chart_template_html.Replace("{{MEDIUM_COUNT}}", $mediumCount<#.ToString()#>)
    $chart_template_html = $chart_template_html.Replace("{{LOW_COUNT}}", $lowCount<#.ToString()#>)
    $chart_template_html = $chart_template_html.Replace("{{INFORMATIONAL_COUNT}}", $informationalCount<#.ToString()#>)
    $chart_template_html = $chart_template_html.Replace("{{EXCHANGE}}", $exchangeCount.ToString())
    $chart_template_html = $chart_template_html.Replace("{{SHAREPOINT}}", $sharepointCount.ToString())
    $chart_template_html = $chart_template_html.Replace("{{TEAMS}}", $teamsCount.ToString())
    $chart_template_html = $chart_template_html.Replace("{{INTUNE}}", $intuneCount.ToString())
    $chart_template_html = $chart_template_html.Replace("{{AAD}}", $aadCount.ToString())
    $chart_template_html = $chart_template_html.Replace("{{SECCOMP}}", $securitycomplianceCount.ToString())
    $chart_template_html = $chart_template_html.Replace("{{TENANT}}", $tenantCount.ToString())

    # Add Appendix of Inspectors run
    $appendix_template_html = $templates.AppendixTemplate
    foreach ($selInspector in $selected_inspectors) {
        $selected_inspectors_html += "$selInspector,"
    }
    $appendix_template_html = $appendix_template_html.Replace("{{SELECTED_INSPECTORS}}", $selected_inspectors_html)


    $output = $templates.ReportTemplate.Replace($templates.FindingShortTemplate, $short_findings_html)
    $output = $output.Replace($templates.FindingLongTemplate, $long_findings_html)
    $output = $output.Replace($templates.ChartTemplate, $chart_template_html)
    $output = $output.Replace($templates.AppendixTemplate, $appendix_template_html)
    $output = $output.Replace($templates.ExecsumTemplate, $templates.ExecsumTemplate.Replace("{{CMDLINEFLAGS}}", $flags))
    
    $output | Out-File -FilePath $out_path\Report_$(Get-Date -Format "yyyy-MM-dd_hh-mm-ss").html
}

Function CSV-Report {
    $sortedFindings = $findings | Sort-Object { Switch -Regex ($_.Impact) { 'Critical' { 1 }	'High' { 2 }	'Medium' { 3 }	'Low' { 4 }	'Informational' { 5 } }; $_.FindingName }

    $results = @()

    $findings_count = 0

    foreach ($finding in $sortedFindings) {
        If ($null -NE $finding.AffectedObjects) {
            $findings_count += 1

            $refs = @()

            foreach ($ref in $finding.References) {
                $refs += "$($ref.Text) : $($ref.Url)"
            }

            $result = [PSCustomObject]@{
                ID                   = $findings_count.ToString()
                FindingName          = $finding.FindingName
                AffectedObjects      = $("$($finding.AffectedObjects)" | Out-String).Trim()
                Finding              = $(($finding.Description) -join " ")
                DefaultValue         = $(($finding.DefaultValue) -join " ")
                ExpectedValue        = $(($finding.ExpectedValue) -join " ")
                InherentRisk         = $finding.Impact
                'Residual Risk'      = " "
                Remediation          = $(($finding.Remediation) -join " ")
                References           = $(($refs) -join ';') 
                'Remediation Status' = " "
                'Required Resources' = " "
                'Start Date'         = " "
                'Completion Date'    = " "
                'Notes'              = " "
            }
            
            $results += $result
        }
    }

    $results | Export-Csv "$out_path\Report_$(Get-Date -Format "yyyy-MM-dd_hh-mm-ss").csv" -Delimiter '^' -NoTypeInformation -Append -Force

}

Function XML-Report {
    $sortedFindings = $findings | Sort-Object { Switch -Regex ($_.Impact) { 'Critical' { 1 }	'High' { 2 }	'Medium' { 3 }	'Low' { 4 }	'Informational' { 5 } }; $_.FindingName }

    $results = @()

    $findings_count = 0

    foreach ($finding in $sortedFindings) {
        If ($null -NE $finding.AffectedObjects) {
            $findings_count += 1

            $refs = @()

            foreach ($ref in $finding.References) {
                $refs += "$($ref.Text) : $($ref.Url)"
            }

            $result = [PSCustomObject]@{
                ID              = $findings_count.ToString()
                FindingName     = $finding.FindingName
                AffectedObjects = $("$($finding.AffectedObjects)" | Out-String).Trim()
                Finding         = $finding.Description
                DefaultValue    = $finding.DefaultValue
                ExpectedValue   = $finding.ExpectedValue
                InherentRisk    = $finding.Impact
                'Residual Risk' = " "
                Remediation     = $finding.Remediation
                References      = $($refs | Out-String) 
            }
            
            $results += $result
        }
    }

    $results | Export-Clixml -Depth 3 -Path "$out_path\Report_$(Get-Date -Format "yyyy-MM-dd_hh-mm-ss").xml"
}

Function JSON-Report {
    $sortedFindings = $findings | Sort-Object { Switch -Regex ($_.Impact) { 'Critical' { 1 }	'High' { 2 }	'Medium' { 3 }	'Low' { 4 }	'Informational' { 5 } }; $_.FindingName }

    $results = @()

    $findings_count = 0

    foreach ($finding in $sortedFindings) {
        If ($null -NE $finding.AffectedObjects) {
            $findings_count += 1

            $refs = @()

            foreach ($ref in $finding.References) {
                $refs += "$($ref.Text) : $($ref.Url)"
            }

            $result = [PSCustomObject]@{
                ID              = $findings_count.ToString()
                FindingName     = $finding.FindingName
                AffectedObjects = $("$($finding.AffectedObjects)" | Out-String).Trim()
                Finding         = $finding.Description
                DefaultValue    = $finding.DefaultValue
                ExpectedValue   = $finding.ExpectedValue
                InherentRisk    = $finding.Impact
                'Residual Risk' = " "
                Remediation     = $finding.Remediation
                References      = $($refs | Out-String) 
            }
            
            $results += $result
        }
    }

    $results | ConvertTo-Json | Out-File -FilePath $out_path\Report_$(Get-Date -Format "yyyy-MM-dd_hh-mm-ss").json
}

Function All-Report {
    CSV-Report
    XML-Report
    JSON-Report
    HTML-Report
}

switch ($reportType) {
    "HTML" { HTML-Report }
    "CSV" { CSV-Report }
    "XML" { XML-Report }
    "JSON" { JSON-Report }
    default { All-Report }
}

$compress = @{
    Path             = $out_path
    CompressionLevel = "Fastest"
    DestinationPath  = "$out_path\$($org_name)_Report.zip"
}
Compress-Archive @compress

function Disconnect {
    Write-Output "Disconnect from Exchange Online"
    Disconnect-ExchangeOnline -Confirm:$false
    Remove-Module ExchangeOnlineManagement
    Get-Module | Where-Object { $_.name -like "tmpEXO_*" } | Remove-Module
    Write-Output "Disconnect from SharePoint Service"
    Disconnect-PnPOnline
    Remove-Module PnP.PowerShell
    Write-Output "Disconnect from Microsoft Teams"
    Disconnect-MicrosoftTeams
    Write-Output "Disconnect from Microsoft Graph"
    Disconnect-MgGraph
    Get-Module | Where-Object { $_.name -like "Microsoft.Graph*" } | Remove-Module -Force
}

$removeSession = Read-Host -Prompt "Do you wish to disconnect your session? (Y|N)"

If ($removeSession -ne 'n') {
    Disconnect
}


return