Ms365 Tenant Manager

{
  "setup_checklist": {
    "total_phases": 5,
    "estimated_time": "3.5 hours",
    "phases": [
      {
        "phase": 1,
        "name": "Initial Tenant Configuration",
        "priority": "critical",
        "task_count": 3,
        "estimated_time": "30 minutes"
      },
      {
        "phase": 2,
        "name": "Custom Domain Configuration",
        "priority": "critical",
        "task_count": 4,
        "estimated_time": "45 minutes"
      },
      {
        "phase": 3,
        "name": "Security Baseline Configuration",
        "priority": "critical",
        "task_count": 5,
        "estimated_time": "60 minutes"
      },
      {
        "phase": 4,
        "name": "Service Configuration",
        "priority": "high",
        "task_count": 4,
        "estimated_time": "90 minutes"
      },
      {
        "phase": 5,
        "name": "Compliance Configuration",
        "priority": "high",
        "task_count": 1,
        "estimated_time": "45 minutes"
      }
    ]
  },
  "dns_records": {
    "mx_records": 1,
    "txt_records": 2,
    "cname_records": 6,
    "srv_records": 2,
    "total_records": 11
  },
  "powershell_scripts_generated": [
    "Initial_Tenant_Setup.ps1",
    "Configure_DNS_Records.txt",
    "Enable_Security_Baseline.ps1"
  ],
  "license_recommendations": {
    "E5": {
      "count": 5,
      "monthly_cost": 285.00,
      "users": "Executives and IT admins"
    },
    "E3": {
      "count": 15,
      "monthly_cost": 540.00,
      "users": "Finance, Legal, HR departments"
    },
    "Business_Standard": {
      "count": 50,
      "monthly_cost": 625.00,
      "users": "Standard office workers"
    },
    "Business_Basic": {
      "count": 5,
      "monthly_cost": 30.00,
      "users": "Part-time staff"
    },
    "total_monthly_cost": 1480.00,
    "total_annual_cost": 17760.00
  },
  "next_steps": [
    "Review and verify DNS records",
    "Test MFA enrollment process",
    "Create security groups for departments",
    "Begin user provisioning",
    "Schedule security review meeting"
  ]
}

{
  "task": "initial_tenant_setup",
  "tenant_config": {
    "company_name": "Acme Corporation",
    "domain_name": "acme.com",
    "user_count": 75,
    "industry": "technology",
    "compliance_requirements": ["GDPR"],
    "licenses": {
      "E5": 5,
      "E3": 15,
      "Business_Standard": 50,
      "Business_Basic": 5
    }
  },
  "admin_details": {
    "primary_admin_email": "admin@acme.com",
    "timezone": "Pacific Standard Time",
    "country": "US"
  }
}

"""
PowerShell script generator for Microsoft 365 administration tasks.
Creates ready-to-use scripts with error handling and best practices.
"""

from typing import Dict, List, Any, Optional


class PowerShellScriptGenerator:
    """Generate PowerShell scripts for common Microsoft 365 admin tasks."""

    def __init__(self, tenant_domain: str):
        """
        Initialize generator with tenant domain.

        Args:
            tenant_domain: Primary domain of the Microsoft 365 tenant
        """
        self.tenant_domain = tenant_domain

    def generate_conditional_access_policy_script(self, policy_config: Dict[str, Any]) -> str:
        """
        Generate script to create Conditional Access policy.

        Args:
            policy_config: Policy configuration parameters

        Returns:
            PowerShell script
        """
        policy_name = policy_config.get('name', 'MFA Policy')
        require_mfa = policy_config.get('require_mfa', True)
        include_users = policy_config.get('include_users', 'All')
        exclude_users = policy_config.get('exclude_users', [])

        script = f"""<#
.SYNOPSIS
    Create Conditional Access Policy: {policy_name}

.DESCRIPTION
    Creates a Conditional Access policy with specified settings.
    Policy will be created in report-only mode for testing.
#>

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"

# Define policy parameters
$policyName = "{policy_name}"

# Create Conditional Access Policy
$conditions = @{{
    Users = @{{
        IncludeUsers = @("{include_users}")
"""

        if exclude_users:
            exclude_list = '", "'.join(exclude_users)
            script += f"""        ExcludeUsers = @("{exclude_list}")
"""

        script += """    }
    Applications = @{
        IncludeApplications = @("All")
    }
    Locations = @{
        IncludeLocations = @("All")
    }
}

$grantControls = @{
"""

        if require_mfa:
            script += """    BuiltInControls = @("mfa")
    Operator = "OR"
"""

        script += """}

$policy = @{
    DisplayName = $policyName
    State = "enabledForReportingButNotEnforced"  # Start in report-only mode
    Conditions = $conditions
    GrantControls = $grantControls
}

try {
    $newPolicy = New-MgIdentityConditionalAccessPolicy -BodyParameter $policy
    Write-Host "✓ Conditional Access policy created: $($newPolicy.DisplayName)" -ForegroundColor Green
    Write-Host "  Policy ID: $($newPolicy.Id)" -ForegroundColor Cyan
    Write-Host "  State: Report-only (test before enforcing)" -ForegroundColor Yellow
    Write-Host ""
    Write-Host "Next steps:" -ForegroundColor Cyan
    Write-Host "1. Review policy in Azure AD > Security > Conditional Access"
    Write-Host "2. Monitor sign-in logs for impact assessment"
    Write-Host "3. When ready, change state to 'enabled' to enforce"
} catch {
    Write-Host "✗ Error creating policy: $_" -ForegroundColor Red
}

Disconnect-MgGraph
"""
        return script

    def generate_security_audit_script(self) -> str:
        """
        Generate comprehensive security audit script.

        Returns:
            PowerShell script for security assessment
        """
        script = """<#
.SYNOPSIS
    Microsoft 365 Security Audit Report

.DESCRIPTION
    Performs comprehensive security audit and generates detailed report.
    Checks: MFA status, admin accounts, inactive users, permissions, licenses

.OUTPUTS
    CSV reports with security findings
#>

# Connect to services
Connect-MgGraph -Scopes "Directory.Read.All", "User.Read.All", "AuditLog.Read.All"
Connect-ExchangeOnline

$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$reportPath = "SecurityAudit_$timestamp"
New-Item -ItemType Directory -Path $reportPath -Force | Out-Null

Write-Host "Starting Security Audit..." -ForegroundColor Cyan
Write-Host ""

# 1. Check MFA Status
Write-Host "[1/7] Checking MFA status for all users..." -ForegroundColor Yellow

$mfaReport = @()
$users = Get-MgUser -All -Property Id,DisplayName,UserPrincipalName,AccountEnabled

foreach ($user in $users) {
    $authMethods = Get-MgUserAuthenticationMethod -UserId $user.Id
    $hasMFA = $authMethods.Count -gt 1  # More than just password

    $mfaReport += [PSCustomObject]@{
        UserPrincipalName = $user.UserPrincipalName
        DisplayName = $user.DisplayName
        AccountEnabled = $user.AccountEnabled
        MFAEnabled = $hasMFA
        AuthMethodsCount = $authMethods.Count
    }
}

$mfaReport | Export-Csv -Path "$reportPath/MFA_Status.csv" -NoTypeInformation
$usersWithoutMFA = ($mfaReport | Where-Object { $_.MFAEnabled -eq $false -and $_.AccountEnabled -eq $true }).Count
Write-Host "  Users without MFA: $usersWithoutMFA" -ForegroundColor $(if($usersWithoutMFA -gt 0){'Red'}else{'Green'})

# 2. Check Admin Accounts
Write-Host "[2/7] Auditing admin role assignments..." -ForegroundColor Yellow

$adminRoles = Get-MgDirectoryRole -All
$adminReport = @()

foreach ($role in $adminRoles) {
    $members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id
    foreach ($member in $members) {
        $user = Get-MgUser -UserId $member.Id -ErrorAction SilentlyContinue
        if ($user) {
            $adminReport += [PSCustomObject]@{
                UserPrincipalName = $user.UserPrincipalName
                DisplayName = $user.DisplayName
                Role = $role.DisplayName
                AccountEnabled = $user.AccountEnabled
            }
        }
    }
}

$adminReport | Export-Csv -Path "$reportPath/Admin_Roles.csv" -NoTypeInformation
Write-Host "  Total admin assignments: $($adminReport.Count)" -ForegroundColor Cyan

# 3. Check Inactive Users
Write-Host "[3/7] Identifying inactive users (90+ days)..." -ForegroundColor Yellow

$inactiveDate = (Get-Date).AddDays(-90)
$inactiveUsers = @()

foreach ($user in $users) {
    $signIns = Get-MgAuditLogSignIn -Filter "userId eq '$($user.Id)'" -Top 1
    $lastSignIn = if ($signIns) { $signIns[0].CreatedDateTime } else { $null }

    if ($lastSignIn -and $lastSignIn -lt $inactiveDate -and $user.AccountEnabled) {
        $inactiveUsers += [PSCustomObject]@{
            UserPrincipalName = $user.UserPrincipalName
            DisplayName = $user.DisplayName
            LastSignIn = $lastSignIn
            DaysSinceSignIn = ((Get-Date) - $lastSignIn).Days
        }
    }
}

$inactiveUsers | Export-Csv -Path "$reportPath/Inactive_Users.csv" -NoTypeInformation
Write-Host "  Inactive users found: $($inactiveUsers.Count)" -ForegroundColor $(if($inactiveUsers.Count -gt 0){'Yellow'}else{'Green'})

# 4. Check Guest Users
Write-Host "[4/7] Reviewing guest user access..." -ForegroundColor Yellow

$guestUsers = Get-MgUser -Filter "userType eq 'Guest'" -All
$guestReport = $guestUsers | Select-Object UserPrincipalName, DisplayName, AccountEnabled, CreatedDateTime

$guestReport | Export-Csv -Path "$reportPath/Guest_Users.csv" -NoTypeInformation
Write-Host "  Guest users: $($guestUsers.Count)" -ForegroundColor Cyan

# 5. Check License Usage
Write-Host "[5/7] Analyzing license allocation..." -ForegroundColor Yellow

$licenses = Get-MgSubscribedSku
$licenseReport = @()

foreach ($license in $licenses) {
    $licenseReport += [PSCustomObject]@{
        ProductName = $license.SkuPartNumber
        TotalLicenses = $license.PrepaidUnits.Enabled
        AssignedLicenses = $license.ConsumedUnits
        AvailableLicenses = $license.PrepaidUnits.Enabled - $license.ConsumedUnits
        UtilizationPercent = [math]::Round(($license.ConsumedUnits / $license.PrepaidUnits.Enabled) * 100, 2)
    }
}

$licenseReport | Export-Csv -Path "$reportPath/License_Usage.csv" -NoTypeInformation
Write-Host "  License SKUs analyzed: $($licenses.Count)" -ForegroundColor Cyan

# 6. Check Mailbox Permissions
Write-Host "[6/7] Auditing mailbox delegations..." -ForegroundColor Yellow

$mailboxes = Get-Mailbox -ResultSize Unlimited
$delegationReport = @()

foreach ($mailbox in $mailboxes) {
    $permissions = Get-MailboxPermission -Identity $mailbox.Identity |
                   Where-Object { $_.User -ne "NT AUTHORITY\SELF" -and $_.IsInherited -eq $false }

    foreach ($perm in $permissions) {
        $delegationReport += [PSCustomObject]@{
            Mailbox = $mailbox.UserPrincipalName
            DelegatedTo = $perm.User
            AccessRights = $perm.AccessRights -join ", "
        }
    }
}

$delegationReport | Export-Csv -Path "$reportPath/Mailbox_Delegations.csv" -NoTypeInformation
Write-Host "  Delegated mailboxes: $($delegationReport.Count)" -ForegroundColor Cyan

# 7. Check Conditional Access Policies
Write-Host "[7/7] Reviewing Conditional Access policies..." -ForegroundColor Yellow

$caPolicies = Get-MgIdentityConditionalAccessPolicy
$caReport = $caPolicies | Select-Object DisplayName, State, CreatedDateTime,
                                         @{N='IncludeUsers';E={$_.Conditions.Users.IncludeUsers -join '; '}},
                                         @{N='RequiresMFA';E={$_.GrantControls.BuiltInControls -contains 'mfa'}}

$caReport | Export-Csv -Path "$reportPath/ConditionalAccess_Policies.csv" -NoTypeInformation
Write-Host "  Conditional Access policies: $($caPolicies.Count)" -ForegroundColor Cyan

# Generate Summary Report
Write-Host ""
Write-Host "=== Security Audit Summary ===" -ForegroundColor Green
Write-Host ""
Write-Host "Users:" -ForegroundColor Cyan
Write-Host "  Total Users: $($users.Count)"
Write-Host "  Users without MFA: $usersWithoutMFA $(if($usersWithoutMFA -gt 0){'⚠️'}else{'✓'})"
Write-Host "  Inactive Users (90+ days): $($inactiveUsers.Count) $(if($inactiveUsers.Count -gt 0){'⚠️'}else{'✓'})"
Write-Host "  Guest Users: $($guestUsers.Count)"
Write-Host ""
Write-Host "Administration:" -ForegroundColor Cyan
Write-Host "  Admin Role Assignments: $($adminReport.Count)"
Write-Host "  Conditional Access Policies: $($caPolicies.Count)"
Write-Host ""
Write-Host "Licenses:" -ForegroundColor Cyan
foreach ($lic in $licenseReport) {
    Write-Host "  $($lic.ProductName): $($lic.AssignedLicenses)/$($lic.TotalLicenses) ($($lic.UtilizationPercent)%)"
}
Write-Host ""
Write-Host "Reports saved to: $reportPath" -ForegroundColor Green
Write-Host ""
Write-Host "Recommended Actions:" -ForegroundColor Yellow
if ($usersWithoutMFA -gt 0) {
    Write-Host "  1. Enable MFA for users without MFA"
}
if ($inactiveUsers.Count -gt 0) {
    Write-Host "  2. Review and disable inactive user accounts"
}
if ($guestUsers.Count -gt 10) {
    Write-Host "  3. Review guest user access and remove unnecessary guests"
}

# Disconnect
Disconnect-MgGraph
Disconnect-ExchangeOnline -Confirm:$false
"""
        return script

    def generate_bulk_license_assignment_script(self, users_csv_path: str, license_sku: str) -> str:
        """
        Generate script for bulk license assignment from CSV.

        Args:
            users_csv_path: Path to CSV with user emails
            license_sku: License SKU to assign

        Returns:
            PowerShell script
        """
        script = f"""<#
.SYNOPSIS
    Bulk License Assignment from CSV

.DESCRIPTION
    Assigns {license_sku} license to users listed in CSV file.
    CSV must have 'UserPrincipalName' column.

.PARAMETER CsvPath
    Path to CSV file with user list
#>

param(
    [Parameter(Mandatory=$true)]
    [string]$CsvPath = "{users_csv_path}"
)

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.ReadWrite.All"

# Get license SKU ID
$targetSku = "{license_sku}"
$licenseSkuId = (Get-MgSubscribedSku -All | Where-Object {{$_.SkuPartNumber -eq $targetSku}}).SkuId

if (-not $licenseSkuId) {{
    Write-Host "✗ License SKU not found: $targetSku" -ForegroundColor Red
    exit
}}

Write-Host "License SKU found: $targetSku" -ForegroundColor Green
Write-Host "SKU ID: $licenseSkuId" -ForegroundColor Cyan
Write-Host ""

# Import users from CSV
$users = Import-Csv -Path $CsvPath

if (-not $users) {{
    Write-Host "✗ No users found in CSV file" -ForegroundColor Red
    exit
}}

Write-Host "Found $($users.Count) users in CSV" -ForegroundColor Cyan
Write-Host ""

# Process each user
$successCount = 0
$errorCount = 0
$results = @()

foreach ($user in $users) {{
    $userEmail = $user.UserPrincipalName

    try {{
        # Get user
        $mgUser = Get-MgUser -UserId $userEmail -ErrorAction Stop

        # Check if user already has license
        $currentLicenses = Get-MgUserLicenseDetail -UserId $mgUser.Id
        if ($currentLicenses.SkuId -contains $licenseSkuId) {{
            Write-Host "  ⊘ $userEmail - Already has license" -ForegroundColor Yellow
            $results += [PSCustomObject]@{{
                UserPrincipalName = $userEmail
                Status = "Skipped"
                Message = "Already licensed"
            }}
            continue
        }}

        # Assign license
        $licenseParams = @{{
            AddLicenses = @(
                @{{
                    SkuId = $licenseSkuId
                }}
            )
        }}

        Set-MgUserLicense -UserId $mgUser.Id -BodyParameter $licenseParams
        Write-Host "  ✓ $userEmail - License assigned successfully" -ForegroundColor Green

        $successCount++
        $results += [PSCustomObject]@{{
            UserPrincipalName = $userEmail
            Status = "Success"
            Message = "License assigned"
        }}

    }} catch {{
        Write-Host "  ✗ $userEmail - Error: $_" -ForegroundColor Red
        $errorCount++
        $results += [PSCustomObject]@{{
            UserPrincipalName = $userEmail
            Status = "Failed"
            Message = $_.Exception.Message
        }}
    }}
}}

# Export results
$resultsPath = "LicenseAssignment_Results_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
$results | Export-Csv -Path $resultsPath -NoTypeInformation

# Summary
Write-Host ""
Write-Host "=== Summary ===" -ForegroundColor Cyan
Write-Host "Total users processed: $($users.Count)"
Write-Host "Successfully assigned: $successCount" -ForegroundColor Green
Write-Host "Errors: $errorCount" -ForegroundColor $(if($errorCount -gt 0){{'Red'}}else{{'Green'}})
Write-Host ""
Write-Host "Results saved to: $resultsPath" -ForegroundColor Cyan

# Disconnect
Disconnect-MgGraph
"""
        return script


def main():
    """CLI entry point."""
    import argparse
    import json

    parser = argparse.ArgumentParser(
        description="Generate ready-to-run M365 admin PowerShell scripts (Graph SDK based)"
    )
    parser.add_argument("--tenant-domain", required=True, help="Primary tenant domain (e.g. acme.com)")
    parser.add_argument("--task", required=True,
                        choices=["conditional-access", "security-audit", "bulk-license"],
                        help="Which script to generate")
    parser.add_argument("--policy-config", help="Policy config JSON file (conditional-access)")
    parser.add_argument("--users-csv", help="Users CSV path baked into the script (bulk-license)")
    parser.add_argument("--license-sku", help="License SKU (bulk-license)")
    parser.add_argument("--output", "-o", help="Output file (default: stdout)")
    args = parser.parse_args()

    generator = PowerShellScriptGenerator(args.tenant_domain)

    if args.task == "conditional-access":
        policy = {}
        if args.policy_config:
            with open(args.policy_config, "r", encoding="utf-8") as f:
                policy = json.load(f)
        result = generator.generate_conditional_access_policy_script(policy)
    elif args.task == "security-audit":
        result = generator.generate_security_audit_script()
    else:  # bulk-license
        if not (args.users_csv and args.license_sku):
            parser.error("--users-csv and --license-sku are required for --task bulk-license")
        result = generator.generate_bulk_license_assignment_script(args.users_csv, args.license_sku)

    if args.output:
        with open(args.output, "w", encoding="utf-8") as f:
            f.write(result)
    else:
        print(result)


if __name__ == "__main__":
    main()

"""
Microsoft 365 tenant setup and configuration module.
Generates guidance and scripts for initial tenant configuration.
"""

from typing import Dict, List, Any, Optional


class TenantSetupManager:
    """Manage Microsoft 365 tenant setup and initial configuration."""

    def __init__(self, tenant_config: Dict[str, Any]):
        """
        Initialize with tenant configuration.

        Args:
            tenant_config: Dictionary containing tenant details and requirements
        """
        self.company_name = tenant_config.get('company_name', '')
        self.domain_name = tenant_config.get('domain_name', '')
        self.user_count = tenant_config.get('user_count', 0)
        self.industry = tenant_config.get('industry', 'general')
        self.compliance_requirements = tenant_config.get('compliance_requirements', [])
        self.licenses = tenant_config.get('licenses', {})
        self.setup_steps = []

    def generate_setup_checklist(self) -> List[Dict[str, Any]]:
        """
        Generate comprehensive tenant setup checklist.

        Returns:
            List of setup steps with details and priorities
        """
        checklist = []

        # Phase 1: Initial Configuration
        checklist.append({
            'phase': 1,
            'name': 'Initial Tenant Configuration',
            'priority': 'critical',
            'tasks': [
                {
                    'task': 'Sign in to Microsoft 365 Admin Center',
                    'url': 'https://admin.microsoft.com',
                    'estimated_time': '5 minutes'
                },
                {
                    'task': 'Complete tenant setup wizard',
                    'details': 'Set organization profile, contact info, and preferences',
                    'estimated_time': '10 minutes'
                },
                {
                    'task': 'Configure company branding',
                    'details': 'Upload logo, set theme colors, customize sign-in page',
                    'estimated_time': '15 minutes'
                }
            ]
        })

        # Phase 2: Domain Setup
        checklist.append({
            'phase': 2,
            'name': 'Custom Domain Configuration',
            'priority': 'critical',
            'tasks': [
                {
                    'task': 'Add custom domain',
                    'details': f'Add {self.domain_name} to tenant',
                    'estimated_time': '5 minutes'
                },
                {
                    'task': 'Verify domain ownership',
                    'details': 'Add TXT record to DNS: MS=msXXXXXXXX',
                    'estimated_time': '10 minutes (plus DNS propagation)'
                },
                {
                    'task': 'Configure DNS records',
                    'details': 'Add MX, CNAME, TXT records for services',
                    'estimated_time': '20 minutes'
                },
                {
                    'task': 'Set as default domain',
                    'details': f'Make {self.domain_name} the default for new users',
                    'estimated_time': '2 minutes'
                }
            ]
        })

        # Phase 3: Security Baseline
        checklist.append({
            'phase': 3,
            'name': 'Security Baseline Configuration',
            'priority': 'critical',
            'tasks': [
                {
                    'task': 'Enable Security Defaults or Conditional Access',
                    'details': 'Enforce MFA and modern authentication',
                    'estimated_time': '15 minutes'
                },
                {
                    'task': 'Configure named locations',
                    'details': 'Define trusted IP ranges for office locations',
                    'estimated_time': '10 minutes'
                },
                {
                    'task': 'Set up admin accounts',
                    'details': 'Create separate admin accounts, enable PIM',
                    'estimated_time': '20 minutes'
                },
                {
                    'task': 'Enable audit logging',
                    'details': 'Turn on unified audit log for compliance',
                    'estimated_time': '5 minutes'
                },
                {
                    'task': 'Configure password policies',
                    'details': 'Set expiration, complexity, banned passwords',
                    'estimated_time': '10 minutes'
                }
            ]
        })

        # Phase 4: Service Provisioning
        checklist.append({
            'phase': 4,
            'name': 'Service Configuration',
            'priority': 'high',
            'tasks': [
                {
                    'task': 'Configure Exchange Online',
                    'details': 'Set up mailboxes, mail flow, anti-spam policies',
                    'estimated_time': '30 minutes'
                },
                {
                    'task': 'Set up SharePoint Online',
                    'details': 'Configure sharing settings, storage limits, site templates',
                    'estimated_time': '25 minutes'
                },
                {
                    'task': 'Enable Microsoft Teams',
                    'details': 'Configure Teams policies, guest access, meeting settings',
                    'estimated_time': '20 minutes'
                },
                {
                    'task': 'Configure OneDrive for Business',
                    'details': 'Set storage quotas, sync restrictions, sharing policies',
                    'estimated_time': '15 minutes'
                }
            ]
        })

        # Phase 5: Compliance (if required)
        if self.compliance_requirements:
            compliance_tasks = []
            if 'GDPR' in self.compliance_requirements:
                compliance_tasks.append({
                    'task': 'Configure GDPR compliance',
                    'details': 'Set up data residency, retention policies, DSR workflows',
                    'estimated_time': '45 minutes'
                })
            if 'HIPAA' in self.compliance_requirements:
                compliance_tasks.append({
                    'task': 'Enable HIPAA compliance features',
                    'details': 'Configure encryption, audit logs, access controls',
                    'estimated_time': '40 minutes'
                })

            checklist.append({
                'phase': 5,
                'name': 'Compliance Configuration',
                'priority': 'high',
                'tasks': compliance_tasks
            })

        return checklist

    def generate_dns_records(self) -> Dict[str, List[Dict[str, str]]]:
        """
        Generate required DNS records for Microsoft 365 services.

        Returns:
            Dictionary of DNS record types and configurations
        """
        domain = self.domain_name

        return {
            'mx_records': [
                {
                    'type': 'MX',
                    'name': '@',
                    'value': f'{domain.replace(".", "-")}.mail.protection.outlook.com',
                    'priority': '0',
                    'ttl': '3600',
                    'purpose': 'Email delivery to Exchange Online'
                }
            ],
            'txt_records': [
                {
                    'type': 'TXT',
                    'name': '@',
                    'value': 'v=spf1 include:spf.protection.outlook.com -all',
                    'ttl': '3600',
                    'purpose': 'SPF record for email authentication'
                },
                {
                    'type': 'TXT',
                    'name': '@',
                    'value': 'MS=msXXXXXXXX',
                    'ttl': '3600',
                    'purpose': 'Domain verification (replace XXXXXXXX with actual value)'
                }
            ],
            'cname_records': [
                {
                    'type': 'CNAME',
                    'name': 'autodiscover',
                    'value': 'autodiscover.outlook.com',
                    'ttl': '3600',
                    'purpose': 'Outlook autodiscover for automatic email configuration'
                },
                {
                    'type': 'CNAME',
                    'name': 'selector1._domainkey',
                    'value': f'selector1-{domain.replace(".", "-")}._domainkey.onmicrosoft.com',
                    'ttl': '3600',
                    'purpose': 'DKIM signature for email security'
                },
                {
                    'type': 'CNAME',
                    'name': 'selector2._domainkey',
                    'value': f'selector2-{domain.replace(".", "-")}._domainkey.onmicrosoft.com',
                    'ttl': '3600',
                    'purpose': 'DKIM signature for email security (rotation)'
                },
                {
                    'type': 'CNAME',
                    'name': 'msoid',
                    'value': 'clientconfig.microsoftonline-p.net',
                    'ttl': '3600',
                    'purpose': 'Azure AD authentication'
                },
                {
                    'type': 'CNAME',
                    'name': 'enterpriseregistration',
                    'value': 'enterpriseregistration.windows.net',
                    'ttl': '3600',
                    'purpose': 'Device registration for Azure AD join'
                },
                {
                    'type': 'CNAME',
                    'name': 'enterpriseenrollment',
                    'value': 'enterpriseenrollment.manage.microsoft.com',
                    'ttl': '3600',
                    'purpose': 'Mobile device management (Intune)'
                }
            ],
            'srv_records': [
                {
                    'type': 'SRV',
                    'name': '_sip._tls',
                    'value': 'sipdir.online.lync.com',
                    'port': '443',
                    'priority': '100',
                    'weight': '1',
                    'ttl': '3600',
                    'purpose': 'Skype for Business / Teams federation'
                },
                {
                    'type': 'SRV',
                    'name': '_sipfederationtls._tcp',
                    'value': 'sipfed.online.lync.com',
                    'port': '5061',
                    'priority': '100',
                    'weight': '1',
                    'ttl': '3600',
                    'purpose': 'Teams external federation'
                }
            ]
        }

    def generate_powershell_setup_script(self) -> str:
        """
        Generate PowerShell script for initial tenant configuration.

        Returns:
            Complete PowerShell script as string
        """
        script = f"""<#
.SYNOPSIS
    Microsoft 365 Tenant Initial Setup Script
    Generated for: {self.company_name}
    Domain: {self.domain_name}

.DESCRIPTION
    This script performs initial Microsoft 365 tenant configuration.
    Run this script with Global Administrator credentials.

.NOTES
    Prerequisites:
    - Install Microsoft.Graph module: Install-Module Microsoft.Graph -Scope CurrentUser
    - Install ExchangeOnlineManagement: Install-Module ExchangeOnlineManagement
    - Install MicrosoftTeams: Install-Module MicrosoftTeams
#>

# Connect to Microsoft 365 services
Write-Host "Connecting to Microsoft 365..." -ForegroundColor Cyan

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "Organization.ReadWrite.All", "Directory.ReadWrite.All", "Policy.ReadWrite.ConditionalAccess"

# Connect to Exchange Online
Connect-ExchangeOnline

# Connect to Microsoft Teams
Connect-MicrosoftTeams

# Step 1: Configure organization settings
Write-Host "Configuring organization settings..." -ForegroundColor Green

$orgSettings = @{{
    DisplayName = "{self.company_name}"
    PreferredLanguage = "en-US"
}}

Update-MgOrganization -OrganizationId (Get-MgOrganization).Id -BodyParameter $orgSettings

# Step 2: Enable Security Defaults (or use Conditional Access for advanced)
Write-Host "Enabling Security Defaults (MFA)..." -ForegroundColor Green

# Uncomment to enable Security Defaults:
# Update-MgPolicyIdentitySecurityDefaultEnforcementPolicy -IsEnabled $true

# Step 3: Enable audit logging
Write-Host "Enabling unified audit log..." -ForegroundColor Green
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

# Step 4: Configure Exchange Online settings
Write-Host "Configuring Exchange Online..." -ForegroundColor Green

# Set organization config
Set-OrganizationConfig -DefaultPublicFolderAgeLimit 30

# Configure anti-spam policy
$antiSpamPolicy = @{{
    Name = "Default Anti-Spam Policy"
    SpamAction = "MoveToJmf"  # Move to Junk folder
    HighConfidenceSpamAction = "Quarantine"
    BulkSpamAction = "MoveToJmf"
    EnableEndUserSpamNotifications = $true
}}

# Step 5: Configure SharePoint Online settings
Write-Host "Configuring SharePoint Online..." -ForegroundColor Green

# Note: SharePoint management requires SharePointPnPPowerShellOnline module
# Connect-PnPOnline -Url "https://{self.domain_name.split('.')[0]}-admin.sharepoint.com" -Interactive

# Step 6: Configure Microsoft Teams settings
Write-Host "Configuring Microsoft Teams..." -ForegroundColor Green

# Set Teams messaging policy
$messagingPolicy = @{{
    Identity = "Global"
    AllowUserChat = $true
    AllowUserDeleteMessage = $true
    AllowGiphy = $true
    GiphyRatingType = "Moderate"
}}

# Step 7: Summary
Write-Host "`nTenant setup complete!" -ForegroundColor Green
Write-Host "Next steps:" -ForegroundColor Cyan
Write-Host "1. Add and verify custom domain: {self.domain_name}"
Write-Host "2. Configure DNS records (see DNS configuration output)"
Write-Host "3. Create user accounts or set up AD Connect for hybrid"
Write-Host "4. Assign licenses to users"
Write-Host "5. Review and configure Conditional Access policies"
Write-Host "6. Complete compliance configuration if required"

# Disconnect from services
Disconnect-MgGraph
Disconnect-ExchangeOnline -Confirm:$false
Disconnect-MicrosoftTeams
"""
        return script

    def get_license_recommendations(self) -> Dict[str, Any]:
        """
        Recommend appropriate Microsoft 365 licenses based on requirements.

        Returns:
            Dictionary with license recommendations
        """
        recommendations = {
            'basic_users': {
                'license': 'Microsoft 365 Business Basic',
                'features': ['Web versions of Office apps', 'Teams', 'OneDrive (1TB)', 'Exchange (50GB)'],
                'cost_per_user_month': 6.00,
                'recommended_for': 'Frontline workers, part-time staff'
            },
            'standard_users': {
                'license': 'Microsoft 365 Business Standard',
                'features': ['Desktop Office apps', 'Teams', 'OneDrive (1TB)', 'Exchange (50GB)', 'SharePoint'],
                'cost_per_user_month': 12.50,
                'recommended_for': 'Most office workers'
            },
            'advanced_security': {
                'license': 'Microsoft 365 E3',
                'features': ['All Business Standard features', 'Advanced security', 'Compliance tools', 'Azure AD P1'],
                'cost_per_user_month': 36.00,
                'recommended_for': 'Users handling sensitive data, compliance requirements'
            },
            'executives_admins': {
                'license': 'Microsoft 365 E5',
                'features': ['All E3 features', 'Advanced threat protection', 'Azure AD P2', 'Advanced compliance'],
                'cost_per_user_month': 57.00,
                'recommended_for': 'Executives, IT admins, high-risk users'
            }
        }

        # Calculate recommended distribution
        total_users = self.user_count
        distribution = {
            'E5': min(5, int(total_users * 0.05)),  # 5% or 5 users, whichever is less
            'E3': int(total_users * 0.20) if total_users > 50 else 0,  # 20% for larger orgs
            'Business_Standard': int(total_users * 0.70),  # 70% standard users
            'Business_Basic': int(total_users * 0.05)  # 5% basic users
        }

        # Adjust for compliance requirements
        if self.compliance_requirements:
            distribution['E3'] = distribution['E3'] + distribution['Business_Standard'] // 2
            distribution['Business_Standard'] = distribution['Business_Standard'] // 2

        estimated_monthly_cost = (
            distribution['E5'] * 57.00 +
            distribution['E3'] * 36.00 +
            distribution['Business_Standard'] * 12.50 +
            distribution['Business_Basic'] * 6.00
        )

        return {
            'recommendations': recommendations,
            'suggested_distribution': distribution,
            'estimated_monthly_cost': round(estimated_monthly_cost, 2),
            'estimated_annual_cost': round(estimated_monthly_cost * 12, 2)
        }


def main():
    """CLI entry point."""
    import argparse
    import json

    parser = argparse.ArgumentParser(
        description="Generate M365 tenant setup checklist, DNS records, license plan, and PowerShell setup script"
    )
    parser.add_argument("--config", required=True,
                        help="Tenant config JSON file (top-level 'tenant_config' key or the config object itself)")
    parser.add_argument("--format", choices=["json", "powershell"], default="json",
                        help="json = checklist + DNS + license plan; powershell = setup script")
    parser.add_argument("--output", "-o", help="Output file (default: stdout)")
    args = parser.parse_args()

    with open(args.config, "r", encoding="utf-8") as f:
        data = json.load(f)
    config = data.get("tenant_config", data)
    manager = TenantSetupManager(config)

    if args.format == "powershell":
        result = manager.generate_powershell_setup_script()
    else:
        result = json.dumps({
            "setup_checklist": manager.generate_setup_checklist(),
            "dns_records": manager.generate_dns_records(),
            "license_recommendations": manager.get_license_recommendations(),
        }, indent=2)

    if args.output:
        with open(args.output, "w", encoding="utf-8") as f:
            f.write(result)
    else:
        print(result)


if __name__ == "__main__":
    main()

"""
User lifecycle management module for Microsoft 365.
Handles user creation, modification, license assignment, and deprovisioning.
"""

from typing import Dict, List, Any, Optional
from datetime import datetime


class UserLifecycleManager:
    """Manage Microsoft 365 user lifecycle operations."""

    def __init__(self, domain: str):
        """
        Initialize with tenant domain.

        Args:
            domain: Primary domain name for the tenant
        """
        self.domain = domain
        self.operations_log = []

    def generate_user_creation_script(self, users: List[Dict[str, Any]]) -> str:
        """
        Generate PowerShell script for bulk user creation.

        Args:
            users: List of user dictionaries with details

        Returns:
            PowerShell script for user provisioning
        """
        script = """<#
.SYNOPSIS
    Bulk User Provisioning Script for Microsoft 365

.DESCRIPTION
    Creates multiple users, assigns licenses, and configures mailboxes.

.NOTES
    Prerequisites:
    - Install-Module Microsoft.Graph -Scope CurrentUser
    - Install-Module ExchangeOnlineManagement
#>

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.ReadWrite.All", "Group.ReadWrite.All"

# Connect to Exchange Online
Connect-ExchangeOnline

# Define users to create
$users = @(
"""

        for user in users:
            upn = f"{user.get('username', '')}@{self.domain}"
            display_name = user.get('display_name', '')
            first_name = user.get('first_name', '')
            last_name = user.get('last_name', '')
            job_title = user.get('job_title', '')
            department = user.get('department', '')
            license_sku = user.get('license_sku', 'Microsoft_365_Business_Standard')

            script += f"""    @{{
        UserPrincipalName = "{upn}"
        DisplayName = "{display_name}"
        GivenName = "{first_name}"
        Surname = "{last_name}"
        JobTitle = "{job_title}"
        Department = "{department}"
        LicenseSku = "{license_sku}"
        UsageLocation = "US"
        PasswordProfile = @{{
            Password = "ChangeMe@$(Get-Random -Minimum 1000 -Maximum 9999)"
            ForceChangePasswordNextSignIn = $true
        }}
    }}
"""

        script += """
)

# Create users
foreach ($user in $users) {
    try {
        Write-Host "Creating user: $($user.DisplayName)..." -ForegroundColor Cyan

        # Create user account
        $newUser = New-MgUser -UserPrincipalName $user.UserPrincipalName `
                              -DisplayName $user.DisplayName `
                              -GivenName $user.GivenName `
                              -Surname $user.Surname `
                              -JobTitle $user.JobTitle `
                              -Department $user.Department `
                              -PasswordProfile $user.PasswordProfile `
                              -UsageLocation $user.UsageLocation `
                              -AccountEnabled $true `
                              -MailNickname ($user.UserPrincipalName -split '@')[0]

        Write-Host "  ✓ User created successfully" -ForegroundColor Green

        # Wait for user provisioning
        Start-Sleep -Seconds 5

        # Assign license
        $licenseParams = @{
            AddLicenses = @(
                @{
                    SkuId = (Get-MgSubscribedSku -All | Where-Object {$_.SkuPartNumber -eq $user.LicenseSku}).SkuId
                }
            )
        }

        Set-MgUserLicense -UserId $newUser.Id -BodyParameter $licenseParams
        Write-Host "  ✓ License assigned: $($user.LicenseSku)" -ForegroundColor Green

        # Log success
        $user | Add-Member -NotePropertyName "Status" -NotePropertyValue "Success" -Force
        $user | Add-Member -NotePropertyName "CreatedDate" -NotePropertyValue (Get-Date) -Force

    } catch {
        Write-Host "  ✗ Error creating user: $_" -ForegroundColor Red
        $user | Add-Member -NotePropertyName "Status" -NotePropertyValue "Failed" -Force
        $user | Add-Member -NotePropertyName "Error" -NotePropertyValue $_.Exception.Message -Force
    }
}

# Export results
$users | Export-Csv -Path "UserCreation_Results_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation

# Disconnect
Disconnect-MgGraph
Disconnect-ExchangeOnline -Confirm:$false

Write-Host "`nUser provisioning complete!" -ForegroundColor Green
"""
        return script

    def generate_user_offboarding_script(self, user_email: str) -> str:
        """
        Generate script for secure user offboarding.

        Args:
            user_email: Email address of user to offboard

        Returns:
            PowerShell script for offboarding
        """
        script = f"""<#
.SYNOPSIS
    User Offboarding Script - Secure Deprovisioning

.DESCRIPTION
    Securely offboards user: {user_email}
    - Revokes access and signs out all sessions
    - Converts mailbox to shared (preserves emails)
    - Removes licenses
    - Archives OneDrive
    - Documents all actions
#>

# Connect to services
Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.ReadWrite.All"
Connect-ExchangeOnline

$userEmail = "{user_email}"
$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"

Write-Host "Starting offboarding for: $userEmail" -ForegroundColor Cyan

try {{
    # Step 1: Get user details
    $user = Get-MgUser -UserId $userEmail
    Write-Host "✓ User found: $($user.DisplayName)" -ForegroundColor Green

    # Step 2: Disable sign-in (immediately revokes access)
    Update-MgUser -UserId $user.Id -AccountEnabled $false
    Write-Host "✓ Account disabled - user cannot sign in" -ForegroundColor Green

    # Step 3: Revoke all active sessions
    Revoke-MgUserSignInSession -UserId $user.Id
    Write-Host "✓ All active sessions revoked" -ForegroundColor Green

    # Step 4: Remove from all groups (except retained groups)
    $groups = Get-MgUserMemberOf -UserId $user.Id
    foreach ($group in $groups) {{
        if ($group.AdditionalProperties["@odata.type"] -eq "#microsoft.graph.group") {{
            Remove-MgGroupMemberByRef -GroupId $group.Id -DirectoryObjectId $user.Id
            Write-Host "  - Removed from group: $($group.AdditionalProperties.displayName)"
        }}
    }}
    Write-Host "✓ Removed from all groups" -ForegroundColor Green

    # Step 5: Remove mobile devices
    $devices = Get-MgUserRegisteredDevice -UserId $user.Id
    foreach ($device in $devices) {{
        Remove-MgUserRegisteredDeviceByRef -UserId $user.Id -DirectoryObjectId $device.Id
        Write-Host "  - Removed device: $($device.AdditionalProperties.displayName)"
    }}
    Write-Host "✓ All mobile devices removed" -ForegroundColor Green

    # Step 6: Convert mailbox to shared (preserves emails, removes license requirement)
    Set-Mailbox -Identity $userEmail -Type Shared
    Write-Host "✓ Mailbox converted to shared mailbox" -ForegroundColor Green

    # Step 7: Set up email forwarding (optional - update recipient as needed)
    # Set-Mailbox -Identity $userEmail -ForwardingAddress "manager@{self.domain}"
    # Write-Host "✓ Email forwarding configured" -ForegroundColor Green

    # Step 8: Set auto-reply
    $autoReplyMessage = @"
Thank you for your email. This mailbox is no longer actively monitored as the employee has left the organization.
For assistance, please contact: support@{self.domain}
"@

    Set-MailboxAutoReplyConfiguration -Identity $userEmail `
        -AutoReplyState Enabled `
        -InternalMessage $autoReplyMessage `
        -ExternalMessage $autoReplyMessage
    Write-Host "✓ Auto-reply configured" -ForegroundColor Green

    # Step 9: Remove licenses (wait a bit after mailbox conversion)
    Start-Sleep -Seconds 30
    $licenses = Get-MgUserLicenseDetail -UserId $user.Id
    if ($licenses) {{
        $licenseParams = @{{
            RemoveLicenses = @($licenses.SkuId)
        }}
        Set-MgUserLicense -UserId $user.Id -BodyParameter $licenseParams
        Write-Host "✓ Licenses removed" -ForegroundColor Green
    }}

    # Step 10: Hide from GAL (Global Address List)
    Set-Mailbox -Identity $userEmail -HiddenFromAddressListsEnabled $true
    Write-Host "✓ Hidden from Global Address List" -ForegroundColor Green

    # Step 11: Document offboarding
    $offboardingReport = @{{
        UserEmail = $userEmail
        DisplayName = $user.DisplayName
        OffboardingDate = Get-Date
        MailboxStatus = "Converted to Shared"
        LicensesRemoved = $licenses.SkuPartNumber -join ", "
        AccountDisabled = $true
        SessionsRevoked = $true
    }}

    $offboardingReport | Export-Csv -Path "Offboarding_${{userEmail}}_$timestamp.csv" -NoTypeInformation

    Write-Host "`n✓ Offboarding completed successfully!" -ForegroundColor Green
    Write-Host "`nNext steps:" -ForegroundColor Cyan
    Write-Host "1. Archive user's OneDrive data (available for 30 days by default)"
    Write-Host "2. Review shared mailbox permissions"
    Write-Host "3. After 30 days, consider permanently deleting the account if no longer needed"
    Write-Host "4. Review and transfer any owned resources (Teams, SharePoint sites, etc.)"

}} catch {{
    Write-Host "✗ Error during offboarding: $_" -ForegroundColor Red
}}

# Disconnect
Disconnect-MgGraph
Disconnect-ExchangeOnline -Confirm:$false
"""
        return script

    def generate_license_assignment_recommendations(self, user_role: str, department: str) -> Dict[str, Any]:
        """
        Recommend appropriate license based on user role and department.

        Args:
            user_role: Job title or role
            department: Department name

        Returns:
            License recommendations with justification
        """
        # License decision matrix
        if any(keyword in user_role.lower() for keyword in ['ceo', 'cto', 'cfo', 'executive', 'director', 'vp']):
            return {
                'recommended_license': 'Microsoft 365 E5',
                'justification': 'Executive level - requires advanced security, compliance, and full feature set',
                'features_needed': [
                    'Advanced Threat Protection',
                    'Azure AD P2 with PIM',
                    'Advanced compliance and eDiscovery',
                    'Phone System and Audio Conferencing'
                ],
                'monthly_cost': 57.00
            }

        elif any(keyword in user_role.lower() for keyword in ['admin', 'it', 'security', 'compliance']):
            return {
                'recommended_license': 'Microsoft 365 E5',
                'justification': 'IT/Security role - requires full admin and security capabilities',
                'features_needed': [
                    'Advanced security and compliance tools',
                    'Azure AD P2',
                    'Privileged Identity Management',
                    'Advanced analytics'
                ],
                'monthly_cost': 57.00
            }

        elif department.lower() in ['legal', 'finance', 'hr', 'accounting']:
            return {
                'recommended_license': 'Microsoft 365 E3',
                'justification': 'Handles sensitive data - requires enhanced security and compliance',
                'features_needed': [
                    'Data Loss Prevention',
                    'Information Protection',
                    'Azure AD P1',
                    'Advanced compliance tools'
                ],
                'monthly_cost': 36.00
            }

        elif any(keyword in user_role.lower() for keyword in ['manager', 'lead', 'supervisor']):
            return {
                'recommended_license': 'Microsoft 365 Business Premium',
                'justification': 'Management role - needs full productivity suite with security',
                'features_needed': [
                    'Desktop Office apps',
                    'Advanced security',
                    'Device management',
                    'Teams advanced features'
                ],
                'monthly_cost': 22.00
            }

        elif any(keyword in user_role.lower() for keyword in ['part-time', 'contractor', 'temporary', 'intern']):
            return {
                'recommended_license': 'Microsoft 365 Business Basic',
                'justification': 'Temporary/part-time role - web apps and basic features sufficient',
                'features_needed': [
                    'Web versions of Office apps',
                    'Teams',
                    'OneDrive (1TB)',
                    'Exchange (50GB)'
                ],
                'monthly_cost': 6.00
            }

        else:
            return {
                'recommended_license': 'Microsoft 365 Business Standard',
                'justification': 'Standard office worker - full productivity suite',
                'features_needed': [
                    'Desktop Office apps',
                    'Teams',
                    'OneDrive (1TB)',
                    'Exchange (50GB)',
                    'SharePoint'
                ],
                'monthly_cost': 12.50
            }

    def generate_group_membership_recommendations(self, user: Dict[str, Any]) -> List[str]:
        """
        Recommend security and distribution groups based on user attributes.

        Args:
            user: User dictionary with role, department, location

        Returns:
            List of recommended group names
        """
        recommended_groups = []

        # Department-based groups
        department = user.get('department', '').lower()
        if department:
            recommended_groups.append(f"DL-{department.capitalize()}")  # Distribution list
            recommended_groups.append(f"SG-{department.capitalize()}")  # Security group

        # Location-based groups
        location = user.get('location', '').lower()
        if location:
            recommended_groups.append(f"SG-Location-{location.capitalize()}")

        # Role-based groups
        job_title = user.get('job_title', '').lower()
        if any(keyword in job_title for keyword in ['manager', 'director', 'vp', 'executive']):
            recommended_groups.append("SG-Management")

        if any(keyword in job_title for keyword in ['admin', 'administrator']):
            recommended_groups.append("SG-ITAdmins")

        # Functional groups
        if user.get('needs_sharepoint_access'):
            recommended_groups.append(f"SG-SharePoint-{department.capitalize()}")

        if user.get('needs_project_access'):
            recommended_groups.append("SG-ProjectUsers")

        return recommended_groups

    def validate_user_data(self, user_data: Dict[str, Any]) -> Dict[str, Any]:
        """
        Validate user data before provisioning.

        Args:
            user_data: User information dictionary

        Returns:
            Validation results with errors and warnings
        """
        errors = []
        warnings = []

        # Required fields
        required_fields = ['first_name', 'last_name', 'username']
        for field in required_fields:
            if not user_data.get(field):
                errors.append(f"Missing required field: {field}")

        # Username validation
        username = user_data.get('username', '')
        if username:
            if ' ' in username:
                errors.append("Username cannot contain spaces")
            if not username.islower():
                warnings.append("Username should be lowercase")
            if len(username) < 3:
                errors.append("Username must be at least 3 characters")

        # Email validation
        email = user_data.get('email')
        if email and '@' not in email:
            errors.append("Invalid email format")

        # Display name
        if not user_data.get('display_name'):
            first = user_data.get('first_name', '')
            last = user_data.get('last_name', '')
            warnings.append(f"Display name not provided, will use: {first} {last}")

        # License validation
        if not user_data.get('license_sku'):
            warnings.append("No license specified, will need manual assignment")

        return {
            'is_valid': len(errors) == 0,
            'errors': errors,
            'warnings': warnings
        }


def main():
    """CLI entry point."""
    import argparse
    import json

    parser = argparse.ArgumentParser(
        description="Generate M365 user lifecycle PowerShell scripts and license/group recommendations"
    )
    parser.add_argument("--domain", required=True, help="Primary tenant domain (e.g. acme.com)")
    parser.add_argument("--action", required=True, choices=["create", "offboard", "validate", "recommend"],
                        help="create = bulk user creation script; offboard = offboarding script; "
                             "validate = check user data; recommend = license + group recommendations")
    parser.add_argument("--users", help="Users JSON file (list of user objects) for create/validate/recommend")
    parser.add_argument("--user-email", help="User email for offboard action")
    parser.add_argument("--output", "-o", help="Output file (default: stdout)")
    args = parser.parse_args()

    manager = UserLifecycleManager(args.domain)

    if args.action == "offboard":
        if not args.user_email:
            parser.error("--user-email is required for --action offboard")
        result = manager.generate_user_offboarding_script(args.user_email)
    else:
        if not args.users:
            parser.error("--users is required for this action")
        with open(args.users, "r", encoding="utf-8") as f:
            users = json.load(f)
        if isinstance(users, dict):
            users = users.get("users", [users])
        if args.action == "create":
            result = manager.generate_user_creation_script(users)
        elif args.action == "validate":
            result = json.dumps([manager.validate_user_data(u) for u in users], indent=2)
        else:  # recommend
            result = json.dumps([{
                "user": u.get("email", u.get("first_name", "unknown")),
                "licenses": manager.generate_license_assignment_recommendations(
                    u.get("role", "staff"), u.get("department", "general")),
                "groups": manager.generate_group_membership_recommendations(u),
            } for u in users], indent=2)

    if args.output:
        with open(args.output, "w", encoding="utf-8") as f:
            f.write(result)
    else:
        print(result)


if __name__ == "__main__":
    main()