Public/Permissions/Invoke-365TUNERevokeAll.ps1

function Invoke-365TUNERevokeAll {
    <#
    .SYNOPSIS
        Revokes all 365TUNE permissions — Azure and Exchange Online in one step.

    .DESCRIPTION
        Works in both local PowerShell and Azure Cloud Shell.
        - Local PowerShell : Logs in once, no subscription picker, auto-selects
          home tenant, then runs RevokeExchange and RevokeAzure in sequence.
        - Cloud Shell : Authenticates via Managed Identity (MSI) silently.

        Exchange is revoked first (best practice — remove app-level access
        before RBAC). Azure revoke proceeds even if Exchange revoke fails.

        Your account must have Global Administrator and Exchange Administrator rights.

    .EXAMPLE
        Invoke-365TUNERevokeAll

    .NOTES
        Author : Metawise Consulting LLC
        Module : 365TUNE
        Version : 2.1.5
    #>


    [CmdletBinding()]
    param()

    Write-Host "`n══════════════════════════════════════════════════════" -ForegroundColor Cyan
    Write-Host " 365TUNE — Full Permissions Revoke" -ForegroundColor Cyan
    Write-Host " Revoking Azure + Exchange Online in one step" -ForegroundColor Cyan
    Write-Host "══════════════════════════════════════════════════════`n" -ForegroundColor Cyan

    # Authenticate — Cloud Shell uses MSI, local PowerShell uses interactive login
    Write-Host "Authenticating..." -ForegroundColor Cyan

    $inCloudShell = ($env:ACC_CLOUD -eq "PROD") -or
                    ($env:POWERSHELL_DISTRIBUTION_CHANNEL -like "*CloudShell*") -or
                    ($env:AZUREPS_HOST_ENVIRONMENT -like "*cloud-shell*")

    if ($inCloudShell) {
        Write-Host " Cloud Shell detected — authenticating via Managed Identity." -ForegroundColor Gray
        Connect-AzAccount -Identity -WarningAction SilentlyContinue | Out-Null
        $context = Get-AzContext
        if (-not $context) { throw "No active Azure session found in Cloud Shell. Please reload Cloud Shell and try again." }
    } else {
        Disconnect-AzAccount -ErrorAction SilentlyContinue | Out-Null
        Connect-AzAccount -WarningAction SilentlyContinue -SkipContextPopulation | Out-Null
        $context = Get-AzContext
        if (-not $context) { throw "Authentication failed. Please try again." }

        # Auto-switch to home tenant — no subscription picker
        $allTenants = Get-AzTenant
        $userDomain = $context.Account.Id.Split("@")[1]
        $homeTenant = $allTenants | Where-Object { $_.Domains -contains $userDomain } | Select-Object -First 1

        if (-not $homeTenant) { throw "Could not identify home tenant for '$($context.Account.Id)'." }

        Set-AzContext -TenantId $homeTenant.Id -WarningAction SilentlyContinue | Out-Null
        $context = Get-AzContext
        if (-not $context) { throw "Could not connect to home tenant. Please try again." }
    }

    Write-Host " Tenant : $($context.Tenant.Id)" -ForegroundColor Gray
    Write-Host " Account : $($context.Account.Id)" -ForegroundColor Gray
    Write-Host " ✅ Authenticated.`n" -ForegroundColor Green

    # Step 1 — Exchange first
    Write-Host "[ STEP 1 OF 2 ] Exchange Online Permissions" -ForegroundColor Magenta
    Write-Host "──────────────────────────────────────────────────────" -ForegroundColor Magenta

    try {
        Invoke-365TuneRevokeExchange -SkipAuth
    } catch {
        Write-Host "`n❌ Exchange revoke failed: $($_.Exception.Message)" -ForegroundColor Red
        Write-Host " Azure revoke will still proceed." -ForegroundColor Yellow
        Write-Host " Fix Exchange errors and re-run Invoke-365TuneRevokeExchange if needed." -ForegroundColor Yellow
    }

    # Allow Exchange output to flush before Azure step (Cloud Shell buffer fix)
    Start-Sleep -Milliseconds 500

    # Step 2 — Azure
    Write-Host "[ STEP 2 OF 2 ] Azure Permissions" -ForegroundColor Magenta
    Write-Host "──────────────────────────────────────────────────────" -ForegroundColor Magenta
    try {
        Invoke-365TuneRevokeAzure -SkipAuth
    } catch {
        Write-Host "`n❌ Azure revoke failed: $($_.Exception.Message)" -ForegroundColor Red
        Write-Host " Fix Azure errors and re-run Invoke-365TuneRevokeAzure." -ForegroundColor Yellow
        return
    }

    Write-Host "`n══════════════════════════════════════════════════════" -ForegroundColor Cyan
    Write-Host " 365TUNE permissions fully revoked. ✅" -ForegroundColor Green
    Write-Host " ✅ Exchange: View-Only Configuration role removed" -ForegroundColor Green
    Write-Host " ✅ Azure : Reader removed from / and /providers/Microsoft.aadiam" -ForegroundColor Green
    Write-Host "══════════════════════════════════════════════════════`n" -ForegroundColor Cyan
}