Automatiser l'Audit Sécurité Microsoft 365 : Guide Expert

function Initialize-M365AuditEnvironment {
    [CmdletBinding()]
    param(
        [string]$LogPath = "C:\M365Audit\Logs",
        [switch]$InstallModules,
        [switch]$UpdateModules,
        [switch]$ConfigureScheduledTasks
    )

    # Vérification des prérequis
    Write-Host "🚀 Initialisation environnement M365 Audit..." -ForegroundColor Cyan

    # Création de l'arborescence de travail
    $auditStructure = @(
        "$LogPath",
        "$LogPath\Reports",
        "$LogPath\Archives",
        "$LogPath\Temp",
        "C:\M365Audit\Scripts",
        "C:\M365Audit\Config",
        "C:\M365Audit\Credentials"
    )

    foreach ($path in $auditStructure) {
        if (-not (Test-Path $path)) {
            New-Item -ItemType Directory -Path $path -Force | Out-Null
            Write-Host "✅ Dossier créé: $path" -ForegroundColor Green
        }
    }

    # Modules M365 essentiels avec versions minimum
    $requiredModules = @{
        "Microsoft.Graph" = @{
            MinVersion = "2.0.0"
            Description = "Microsoft Graph PowerShell SDK"
            SubModules = @(
                "Microsoft.Graph.Authentication",
                "Microsoft.Graph.Users",
                "Microsoft.Graph.Groups",
                "Microsoft.Graph.Identity.SignIns",
                "Microsoft.Graph.Security",
                "Microsoft.Graph.Compliance",
                "Microsoft.Graph.Reports"
            )
        }
        "ExchangeOnlineManagement" = @{
            MinVersion = "3.4.0"
            Description = "Exchange Online PowerShell V3"
        }
        "Microsoft.Online.SharePoint.PowerShell" = @{
            MinVersion = "16.0.24211"
            Description = "SharePoint Online Management Shell"
        }
        "MicrosoftTeams" = @{
            MinVersion = "5.8.0"
            Description = "Microsoft Teams PowerShell"
        }
        "Az.Accounts" = @{
            MinVersion = "2.12.1"
            Description = "Azure PowerShell Authentication"
        }
        "Az.Resources" = @{
            MinVersion = "6.16.2"
            Description = "Azure Resource Management"
        }
        "Az.Storage" = @{
            MinVersion = "6.1.3"
            Description = "Azure Storage Management"
        }
        "Az.KeyVault" = @{
            MinVersion = "5.2.1"
            Description = "Azure Key Vault Management"
        }
        "ImportExcel" = @{
            MinVersion = "7.8.6"
            Description = "Excel manipulation for reports"
        }
        "PSWriteHTML" = @{
            MinVersion = "1.23.0"
            Description = "HTML report generation"
        }
    }

    if ($InstallModules -or $UpdateModules) {
        Write-Host "📦 Installation/Mise à jour des modules..." -ForegroundColor Yellow

        # Configuration du repository PSGallery comme trusted
        if (-not (Get-PSRepository -Name "PSGallery" | Where-Object {$_.InstallationPolicy -eq "Trusted"})) {
            Set-PSRepository -Name "PSGallery" -InstallationPolicy Trusted
        }

        foreach ($moduleName in $requiredModules.Keys) {
            $moduleInfo = $requiredModules[$moduleName]
            $currentModule = Get-InstalledModule -Name $moduleName -ErrorAction SilentlyContinue

            try {
                if ($null -eq $currentModule) {
                    Write-Host "⬇️  Installation: $moduleName" -ForegroundColor Cyan
                    Install-Module -Name $moduleName -MinimumVersion $moduleInfo.MinVersion -Scope CurrentUser -Force -AllowClobber
                    Write-Host "✅ $moduleName installé (v$($moduleInfo.MinVersion)+)" -ForegroundColor Green

                    # Installation des sous-modules si nécessaire
                    if ($moduleInfo.SubModules) {
                        foreach ($subModule in $moduleInfo.SubModules) {
                            Install-Module -Name $subModule -Scope CurrentUser -Force -AllowClobber -ErrorAction SilentlyContinue
                        }
                    }
                } elseif ($UpdateModules -and [version]$currentModule.Version -lt [version]$moduleInfo.MinVersion) {
                    Write-Host "⬆️  Mise à jour: $moduleName ($($currentModule.Version) → $($moduleInfo.MinVersion)+)" -ForegroundColor Yellow
                    Update-Module -Name $moduleName -Force
                    Write-Host "✅ $moduleName mis à jour" -ForegroundColor Green
                } else {
                    Write-Host "✅ $moduleName OK (v$($currentModule.Version))" -ForegroundColor Green
                }
            } catch {
                Write-Warning "⚠️ Erreur avec le module $moduleName : $($_.Exception.Message)"
            }
        }
    }

    # Création du fichier de configuration principal
    $configFile = "C:\M365Audit\Config\AuditConfig.json"
    if (-not (Test-Path $configFile)) {
        $defaultConfig = @{
            General = @{
                TenantId = ""
                DefaultReportPath = "$LogPath\Reports"
                RetentionDays = 90
                LogLevel = "Information"
                MaxConcurrentJobs = 10
            }
            Notifications = @{
                EmailEnabled = $false
                SMTPServer = ""
                FromAddress = ""
                ToAddresses = @()
                TeamsWebhook = ""
            }
            Schedule = @{
                DailyAudit = "06:00"
                WeeklyReport = "Monday 08:00"
                MonthlyComplianceCheck = "1st Monday 10:00"
            }
            Security = @{
                EncryptCredentials = $true
                UseAzureKeyVault = $false
                KeyVaultName = ""
                CertificateThumbprint = ""
            }
            Modules = $requiredModules.Keys
        }

        $defaultConfig | ConvertTo-Json -Depth 5 | Out-File -FilePath $configFile -Encoding UTF8
        Write-Host "📝 Configuration par défaut créée: $configFile" -ForegroundColor Green
    }

    # Création du module de logging personnalisé
    $loggingModulePath = "C:\M365Audit\Scripts\M365AuditLogging.psm1"
    if (-not (Test-Path $loggingModulePath)) {
        $loggingModule = @"
# M365 Audit Logging Module
function Write-AuditLog {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]`$Message,

        [ValidateSet("Information", "Warning", "Error", "Critical")]
        [string]`$Level = "Information",

        [string]`$Category = "General",

        [string]`$LogPath = "$LogPath"
    )

    `$timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    `$logEntry = "[`$timestamp] [`$Level] [`$Category] `$Message"

    # Console output with colors
    switch (`$Level) {
        "Information" { Write-Host `$logEntry -ForegroundColor Cyan }
        "Warning" { Write-Host `$logEntry -ForegroundColor Yellow }
        "Error" { Write-Host `$logEntry -ForegroundColor Red }
        "Critical" { Write-Host `$logEntry -ForegroundColor Magenta }
    }

    # File logging
    `$logFile = Join-Path `$LogPath "M365Audit_`$(Get-Date -Format 'yyyyMMdd').log"
    `$logEntry | Out-File -FilePath `$logFile -Append -Encoding UTF8

    # Structured logging for analysis
    `$structuredLog = @{
        Timestamp = Get-Date
        Level = `$Level
        Category = `$Category
        Message = `$Message
        ProcessId = `$PID
        SessionId = [System.Environment]::SessionId
    }

    `$jsonLog = `$structuredLog | ConvertTo-Json -Compress
    `$jsonFile = Join-Path `$LogPath "M365Audit_Structured_`$(Get-Date -Format 'yyyyMMdd').json"
    `$jsonLog | Out-File -FilePath `$jsonFile -Append -Encoding UTF8
}

function Start-AuditSession {
    [CmdletBinding()]
    param([string]`$SessionName = "M365Audit")

    `$global:AuditSessionStart = Get-Date
    `$global:AuditSessionId = [guid]::NewGuid().ToString()

    Write-AuditLog "Audit session started: `$SessionName (ID: `$(`$global:AuditSessionId))" -Category "Session"

    return `$global:AuditSessionId
}

function Stop-AuditSession {
    [CmdletBinding()]
    param([string]`$SessionId = `$global:AuditSessionId)

    if (`$global:AuditSessionStart) {
        `$duration = (Get-Date) - `$global:AuditSessionStart
        Write-AuditLog "Audit session completed in `$(`$duration.TotalMinutes.ToString('F2')) minutes" -Category "Session"
    }

    `$global:AuditSessionStart = `$null
    `$global:AuditSessionId = `$null
}

Export-ModuleMember -Function Write-AuditLog, Start-AuditSession, Stop-AuditSession
"@
        $loggingModule | Out-File -FilePath $loggingModulePath -Encoding UTF8
        Write-Host "📝 Module de logging créé: $loggingModulePath" -ForegroundColor Green
    }

    # Test de connectivité aux services M365
    Write-Host "🔍 Test de connectivité aux services M365..." -ForegroundColor Yellow
    $connectivityResults = @{}

    try {
        # Test Microsoft Graph
        $graphTest = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0" -Method Get -ErrorAction Stop
        $connectivityResults["Microsoft Graph"] = "✅ Accessible"
    } catch {
        $connectivityResults["Microsoft Graph"] = "❌ Inaccessible: $($_.Exception.Message)"
    }

    try {
        # Test Exchange Online
        $exoTest = Invoke-RestMethod -Uri "https://outlook.office365.com/powershell-liveid" -Method Get -ErrorAction Stop
        $connectivityResults["Exchange Online"] = "✅ Accessible"
    } catch {
        $connectivityResults["Exchange Online"] = "❌ Inaccessible: $($_.Exception.Message)"
    }

    # Affichage des résultats
    Write-Host "`n📊 Résultats de connectivité:" -ForegroundColor Cyan
    foreach ($service in $connectivityResults.Keys) {
        Write-Host "   $service`: $($connectivityResults[$service])" -ForegroundColor White
    }

    # Configuration des tâches planifiées si demandé
    if ($ConfigureScheduledTasks) {
        Write-Host "`n⏰ Configuration des tâches planifiées..." -ForegroundColor Yellow
        # TODO: Implémenter la création de tâches planifiées
        Write-Host "   Configuration manuelle requise via Task Scheduler" -ForegroundColor Yellow
    }

    # Résumé final
    $summary = @{
        Status = "Completed"
        LogPath = $LogPath
        ConfigFile = $configFile
        LoggingModule = $loggingModulePath
        ModulesInstalled = $requiredModules.Keys -join ", "
        Connectivity = $connectivityResults
        NextSteps = @(
            "Configurer les credentials d'authentification",
            "Personnaliser AuditConfig.json",
            "Tester les premiers scripts d'audit",
            "Configurer les tâches planifiées"
        )
    }

    Write-Host "`n🎉 Environnement M365 Audit initialisé avec succès!" -ForegroundColor Green
    return $summary
}