<#
.SYNOPSIS
   Automated Intune Device Compliance and Health Auditor.

.DESCRIPTION
   Audits Microsoft Intune enrolled endpoints using Microsoft Graph PowerShell SDK v2.
   Checks compliance states, operating system versions, and sync intervals to enforce Zero Trust hygiene.

.PARAMETER ComplianceFilter
   Filter by compliance status: All, Compliant, Noncompliant, or InGracePeriod. Default: Noncompliant.

.PARAMETER Top
   Maximum number of records to retrieve. Default: 100.

.EXAMPLE
   .\Test-IntuneDeviceReadiness.ps1 -ComplianceFilter Noncompliant

.NOTES
   Author:      Souhaiel Morhag
   Company:     MSEndpoint.com
   Blog:        https://msendpoint.com
   Academy:     https://app.msendpoint.com/academy
   LinkedIn:    https://linkedin.com/in/souhaiel-morhag
   GitHub:      https://github.com/Msendpoint
   License:     MIT
#>

[CmdletBinding()]
param(
    [Parameter(Mandatory = $false)]
    [ValidateSet('All', 'Compliant', 'Noncompliant', 'InGracePeriod')]
    [string]$ComplianceFilter = 'Noncompliant',

    [Parameter(Mandatory = $false)]
    [int]$Top = 100
)

Begin {
    Write-Host "[INIT] Verifying Microsoft Graph Authentication context..." -ForegroundColor Cyan
    try {
        $context = Get-MgContext -ErrorAction Stop
        if (-not $context) {
            throw "No active Graph session detected. Run 'Connect-MgGraph -Scopes DeviceManagementManagedDevices.Read.All'"
        }
        Write-Host "  -> Connected to Tenant ID: $($context.TenantId)" -ForegroundColor Green
    }
    catch {
        Write-Error "Authentication failure: $_"
        exit 1
    }
}

Process {
    Write-Host "[QUERY] Fetching managed endpoints (Filter: $ComplianceFilter)..." -ForegroundColor Cyan
    
    $filterExpression = $null
    if ($ComplianceFilter -ne 'All') {
        $filterExpression = "complianceState eq '$($ComplianceFilter.ToLower())'"
    }

    try {
        $params = @{
            Property = @(
                'id', 'deviceName', 'operatingSystem', 'osVersion', 
                'complianceState', 'userPrincipalName', 'lastSyncDateTime',
                'enrolledDateTime', 'serialNumber', 'manufacturer', 'model'
            )
            Top = $Top
        }

        if ($filterExpression) {
            $params['Filter'] = $filterExpression
        }

        $devices = Get-MgDeviceManagementManagedDevice @params -ErrorAction Stop

        if (-not $devices -or $devices.Count -eq 0) {
            Write-Host "  -> No devices matched criteria '$ComplianceFilter'." -ForegroundColor Yellow
            return
        }

        Write-Host "  -> Retrieved $($devices.Count) device records. Analyzing compliance telemetry..." -ForegroundColor Green

        $report = foreach ($dev in $devices) {
            [PSCustomObject]@{
                DeviceId         = $dev.Id
                DeviceName       = $dev.DeviceName
                PrimaryUser      = $dev.UserPrincipalName
                OS               = "$($dev.OperatingSystem) ($($dev.OsVersion))"
                Hardware         = "$($dev.Manufacturer) $($dev.Model)"
                ComplianceState  = $dev.ComplianceState
                LastSyncUTC      = $dev.LastSyncDateTime
                DaysSinceSync    = if ($dev.LastSyncDateTime) { [math]::Round(((Get-Date) - $dev.LastSyncDateTime).TotalDays, 1) } else { 'N/A' }
            }
        }

        $report | Format-Table -AutoSize
        return $report
    }
    catch {
        Write-Error "Failed to retrieve Intune device inventory: $_"
        exit 1
    }
}