Public/Permissions/Invoke-365TuneRevokeExchange.ps1

function Invoke-365TuneRevokeExchange {
    <#
    .SYNOPSIS
        Revokes Exchange Online View-Only Configuration role from the 365TUNE Enterprise App.

    .DESCRIPTION
        Removes the View-Only Configuration role assignment and Service Principal
        registration from Exchange Online. Safe to re-run — exits cleanly if
        nothing is found.

        Run from local PowerShell only (not Cloud Shell).
        Your account must have Global Administrator and Exchange Administrator rights.

    .EXAMPLE
        Invoke-365TuneRevokeExchange

    .NOTES
        Author : Metawise Consulting LLC
        Module : 365TUNE
        Version : 1.9.0
    #>


    [CmdletBinding()]
    param(
        [switch]$SkipAuth
    )

    $displayName = "365TUNE - Security and Compliance"

    Write-Host "`n══════════════════════════════════════════════════════" -ForegroundColor Cyan
    Write-Host " 365TUNE — Revoke Exchange Online Permissions" -ForegroundColor Cyan
    Write-Host "══════════════════════════════════════════════════════`n" -ForegroundColor Cyan

    # Step 1 — Check modules
    Write-Host "[1/4] Checking required modules..." -ForegroundColor Cyan
    foreach ($module in @("Az.Accounts", "ExchangeOnlineManagement")) {
        if (-not (Get-Module -ListAvailable -Name $module)) {
            Write-Host " Installing $module..." -ForegroundColor Yellow
            Install-Module -Name $module -Force -Scope CurrentUser
        }
    }
    Import-Module Az.Accounts, ExchangeOnlineManagement
    Write-Host " ✅ All modules ready." -ForegroundColor Green

    # Step 2 — Authenticate
    Write-Host "`n[2/4] Authenticating..." -ForegroundColor Cyan
    if (-not $SkipAuth) {
        Disconnect-AzAccount -ErrorAction SilentlyContinue | Out-Null
        Connect-AzAccount -WarningAction SilentlyContinue | Out-Null
    }
    $context = Get-AzContext
    if (-not $context) { throw "Not authenticated. Run without -SkipAuth or log in manually first." }
    Write-Host " Tenant : $($context.Tenant.Id)" -ForegroundColor Gray
    Write-Host " Account : $($context.Account.Id)" -ForegroundColor Gray
    Write-Host " ✅ Authenticated." -ForegroundColor Green

    # Step 3 — Connect to Exchange Online and check assignments
    Write-Host "`n[3/4] Connecting to Exchange Online..." -ForegroundColor Cyan
    Connect-ExchangeOnline -ShowBanner:$false
    Write-Host " ✅ Connected." -ForegroundColor Green

    $existingAssignment = Get-ManagementRoleAssignment -ErrorAction SilentlyContinue |
        Where-Object { $_.RoleAssigneeName -eq $displayName -and $_.Role -eq "View-Only Configuration" }

    $existingSP = Get-ServicePrincipal -ErrorAction SilentlyContinue |
        Where-Object { $_.DisplayName -eq $displayName }

    if (-not $existingAssignment -and -not $existingSP) {
        Write-Host "`n══════════════════════════════════════════════════════" -ForegroundColor Cyan
        Write-Host " No Exchange permissions found — nothing to revoke. ✅" -ForegroundColor Green
        Write-Host "══════════════════════════════════════════════════════`n" -ForegroundColor Cyan
        Disconnect-ExchangeOnline -Confirm:$false
        return
    }

    # Step 4 — Remove role and Service Principal
    Write-Host "`n[4/4] Removing role and Service Principal..." -ForegroundColor Cyan

    if ($existingAssignment) {
        try {
            Remove-ManagementRoleAssignment -Identity "$($existingAssignment.Name)" -Confirm:$false -ErrorAction Stop
            Write-Host " ✅ View-Only Configuration role removed." -ForegroundColor Green
        } catch {
            if ($_.Exception.Message -like "*couldn't be found*" -or $_.Exception.Message -like "*NotFound*") {
                Write-Warning " ⚠️ Role assignment not found — already removed"
            } else { throw }
        }
    } else {
        Write-Warning " ⚠️ No role assignment found — already removed"
    }

    if ($existingSP) {
        try {
            Remove-ServicePrincipal -Identity $existingSP.Identity -Confirm:$false -ErrorAction Stop
            Write-Host " ✅ Service Principal removed from Exchange Online." -ForegroundColor Green
        } catch {
            if ($_.Exception.Message -like "*couldn't be found*" -or $_.Exception.Message -like "*NotFound*") {
                Write-Warning " ⚠️ Service Principal not found — already removed"
            } else { throw }
        }
    } else {
        Write-Warning " ⚠️ No Service Principal found — already removed"
    }

    Disconnect-ExchangeOnline -Confirm:$false
    Write-Host " Exchange Online session closed." -ForegroundColor Gray

    Write-Host "`n══════════════════════════════════════════════════════" -ForegroundColor Cyan
    Write-Host " 365TUNE Exchange Online permissions revoked. ✅" -ForegroundColor Green
    Write-Host " Tenant : $($context.Tenant.Id)" -ForegroundColor Green
    Write-Host " Account : $($context.Account.Id)" -ForegroundColor Green
    Write-Host "══════════════════════════════════════════════════════`n" -ForegroundColor Cyan
}