#!/usr/bin/env pwsh
# Frontier Pilot Enablement Script
# Assigns Copilot licenses and creates the Frontier security group
# Prerequisites: Install-Module Microsoft.Graph -Force
# Run as: Global Admin or M365 Apps Admin

Connect-MgGraph -Scopes "User.ReadWrite.All", "Group.Create", "Directory.ReadWrite.All"

### Step 1: Define your Copilot SKU
### Use Get-MgSubscribedSku to find exact SKU ID in your tenant
$copilotSku = Get-MgSubscribedSku -Filter "skuPartNumber eq 'MICROSOFT_365_COPILOT'" | Select-Object -First 1
if (-not $copilotSku) {
  Write-Error "Copilot license SKU not found. Verify tenant entitlement."
  exit 1
}

$skuId = $copilotSku.SkuId
Write-Host "Found Copilot SKU: $($copilotSku.SkuPartNumber) (ID: $skuId)"

### Step 2: Create Frontier pilot security group
$groupName = "Frontier-Pilots"
$existingGroup = Get-MgGroup -Filter "displayName eq '$groupName'" -ErrorAction SilentlyContinue

if ($existingGroup) {
  Write-Host "Group '$groupName' already exists (ID: $($existingGroup.Id))"
  $groupId = $existingGroup.Id
} else {
  $newGroup = New-MgGroup -DisplayName $groupName `
    -MailNickname "frontierpilots" `
    -GroupTypes @("Unified") `
    -SecurityEnabled:$true `
    -MailEnabled:$false
  $groupId = $newGroup.Id
  Write-Host "Created security group: $groupName (ID: $groupId)"
}

### Step 3: Bulk assign licenses to pilot users
### Example: replace with your actual user UPNs or CSV import
$pilotUsers = @(
  "alice@tenant.onmicrosoft.com",
  "bob@tenant.onmicrosoft.com",
  "charlie@tenant.onmicrosoft.com"
)

foreach ($upn in $pilotUsers) {
  $user = Get-MgUser -Filter "userPrincipalName eq '$upn'" -ErrorAction SilentlyContinue
  if (-not $user) {
    Write-Warning "User not found: $upn"
    continue
  }
  
  $assignedLicenses = @{
    addLicenses = @(
      @{
        skuId = $skuId
      }
    )
    removeLicenses = @()
  }
  
  Set-MgUserLicense -UserId $user.Id -AddLicenses $assignedLicenses.addLicenses -RemoveLicenses $assignedLicenses.removeLicenses
  Write-Host "Assigned Copilot license to $upn"
  
  ### Add user to Frontier pilot group
  New-MgGroupMember -GroupId $groupId -DirectoryObjectId $user.Id -ErrorAction SilentlyContinue
  Write-Host "Added $upn to group $groupName"
}

Write-Host ""
Write-Host "=== NEXT STEPS ==="
Write-Host "1. Wait 24 hours for license propagation."
Write-Host "2. In M365 Admin Center, go to Settings → Copilot → Frontier."
Write-Host "3. Select access model 'Specific users' and add group: $groupName."
Write-Host "4. Wait 3 hours for feature propagation."
Write-Host "5. In Agents → All agents, deploy Frontier agents to the group."
Write-Host ""
Write-Host "Group membership sync to admin center: ~15 minutes."
Write-Host "Feature visibility to users: ~3 hours."

### GET /admin/microsoft365apps/getTenantAdminCopilotSetting
### Retrieve current Frontier configuration

GET https://graph.microsoft.com/beta/admin/microsoft365apps/getTenantAdminCopilotSetting

// Response (example):
{
  "frontierAccessLevel": "specificUsers", // or "allUsers" or "noAccess"
  "targetedGroups": [
    {
      "id": "12345678-1234-1234-1234-123456789012",
      "displayName": "Frontier-Pilots"
    }
  ],
  "isCoilotForMicrosoft365Enabled": true,
  "isAiProvidersAllowed": true
}

### GET /users/{userId} with assignedLicenses expansion
GET https://graph.microsoft.com/v1.0/users/{userId}?$select=assignedLicenses,id,userPrincipalName

// Check response.assignedLicenses for skuId matching Copilot
// If assignedLicenses is empty or lacks Copilot SKU:
// → User will not see Frontier features (silent failure)

### Intune: Deploy Windows Insider Beta ring to Cloud PCs
### This is a prerequisite for Cloud PC + AI features

// Use Windows Update for Business ring policy
// Assignment scope: Cloud PC device group
// Setting: "Update ring for Windows Insiders" = "Beta"

POST https://graph.microsoft.com/beta/deviceManagement/windowsUpdateForBusinessConfigurations

{
  "displayName": "Cloud PC Frontier Pilot - Windows Insider Beta",
  "description": "Enroll Cloud PCs in Beta channel for Frontier AI features",
  "featureUpdatesPaused": false,
  "microsoftUpdateServiceAllowed": true,
  "prereleaseFeatures": "settingsOnly",
  "businessReadyUpdatesOnly": false
}

### Then assign Intune device group containing your Cloud PCs

#!/usr/bin/env pwsh
# Frontier Health Check: Audit licensing, group membership, agent deployment

Connect-MgGraph -Scopes "User.Read.All", "Group.Read.All"

### 1. Verify Frontier tenant setting
Write-Host "[1] Checking Frontier tenant configuration..."
try {
  $frontierConfig = Invoke-MgGraphRequest -Method GET `
    -Uri "https://graph.microsoft.com/beta/admin/microsoft365apps/getTenantAdminCopilotSetting" `
    -ErrorAction Stop
  Write-Host "  Access level: $($frontierConfig.frontierAccessLevel)"
  Write-Host "  Target groups: $($frontierConfig.targetedGroups.displayName -join ', ')"
} catch {
  Write-Warning "  Could not retrieve Frontier config: $_"
}

### 2. Check pilot group membership
Write-Host ""
Write-Host "[2] Checking Frontier pilot group membership..."
$pilotGroup = Get-MgGroup -Filter "displayName eq 'Frontier-Pilots'" -ErrorAction SilentlyContinue
if ($pilotGroup) {
  $members = Get-MgGroupMember -GroupId $pilotGroup.Id | \
    Where-Object { $_.AdditionalProperties['@odata.type'] -eq '#microsoft.graph.user' }
  Write-Host "  Group: $($pilotGroup.displayName)"
  Write-Host "  Member count: $($members.Count)"
  Write-Host "  Members:"
  $members | ForEach-Object {
    Write-Host "    - $($_.AdditionalProperties['userPrincipalName'])"
  }
} else {
  Write-Warning "  Frontier-Pilots group not found"
}

### 3. Verify licenses on pilot users
Write-Host ""
Write-Host "[3] Checking Copilot license assignments..."
if ($pilotGroup) {
  $members | ForEach-Object {
    $userId = $_.Id
    $user = Get-MgUser -UserId $userId -Property "userPrincipalName,assignedLicenses"
    $hasCopilot = $user.assignedLicenses | \
      Where-Object { $_.skuId -match "84a8f78e" } // Copilot SKU pattern
    $licenseStatus = if ($hasCopilot) { "✓ HAS" } else { "✗ MISSING" }
    Write-Host "  $($user.userPrincipalName): $licenseStatus"
  }
}

Write-Host ""
Write-Host "=== Health Check Complete ==="
Write-Host "If any 'MISSING' licenses appear, licensing delay (24h) may not have elapsed."
Write-Host "If member count is 0, check group creation timestamp (should exist)."