The Inactive
User Flow

param($Timer)

Import-Module "$PSScriptRoot/../Modules/GraphHelper.psm1"      -Force
Import-Module "$PSScriptRoot/../Modules/UserAnalyzer.psm1"     -Force
Import-Module "$PSScriptRoot/../Modules/ReportExporter.psm1"   -Force
Import-Module "$PSScriptRoot/../Modules/TeamsNotifier.psm1"    -Force
Import-Module "$PSScriptRoot/../Modules/ManagerNotifier.psm1"  -Force

$ErrorActionPreference = 'Stop'
$inactivityThresholdDays = 180

Write-Host "Starting inactive user report — threshold: $inactivityThresholdDays days"

try {
    # 1. Fetch all users with sign-in activity and manager details
    $allUsers = Get-AllUsersWithSignInActivity

    # 2. Classify users against the 180-day threshold
    $report = Get-InactiveUserReport -Users $allUsers -ThresholdDays $inactivityThresholdDays

    Write-Host "Classification complete — Inactive: $($report.Inactive.Count) | Stale: $($report.NeverLoggedInStale.Count)"

    if ($report.Inactive.Count -eq 0 -and $report.NeverLoggedInStale.Count -eq 0) {
        Write-Host "No inactive users found. Exiting."
        return
    }

    # 3. Export full CSV to blob storage and get a download URL
    $csvUrl = $null
    $storageAccount = $env:STORAGE_ACCOUNT_NAME
    $container      = $env:STORAGE_CONTAINER_NAME

    if ($storageAccount -and $container) {
        $csvUrl = Export-InactiveUserReport `
            -Report              $report `
            -StorageAccountName  $storageAccount `
            -ContainerName       $container
    }

    # 4. Post summary to Teams channel
    $webhookUrl = $env:TEAMS_WEBHOOK_URL
    if (-not $webhookUrl) {
        throw "TEAMS_WEBHOOK_URL is not set."
    }

    Send-InactiveUserReport -Report $report -WebhookUrl $webhookUrl -CsvDownloadUrl $csvUrl

    # 5. DM managers about their inactive employees
    $dmWebhookUrl = $env:MANAGER_DM_WEBHOOK_URL
    $dmAllowList  = @(
        'manager.one@contoso.com'
        'manager.two@contoso.com'
    )

    if ($dmWebhookUrl) {
        Send-ManagerNotifications -Report $report -WebhookUrl $dmWebhookUrl -AllowList $dmAllowList
    }
}
catch {
    Write-Error "Inactive user report failed: $_"
    throw
}

function Get-InactiveUserReport {
    param(
        [Parameter(Mandatory)]
        [object[]]$Users,
        [int]$ThresholdDays = 180
    )

    $cutoffDate  = (Get-Date).AddDays(-$ThresholdDays)
    $inactive    = [System.Collections.Generic.List[object]]::new()
    $neverStale  = [System.Collections.Generic.List[object]]::new()

    foreach ($user in $Users) {
        $lastSignIn    = $user.signInActivity?.lastSignInDateTime
        $createdDate   = $user.createdDateTime
        $parsedCreated = if ($createdDate) { [datetime]$createdDate } else { $null }

        if ($lastSignIn) {
            $parsedSignIn = [datetime]$lastSignIn
            if ($parsedSignIn -lt $cutoffDate) {
                $inactive.Add((Build-UserRecord -User $user -Category 'Inactive' -LastSignIn $parsedSignIn))
            }
        }
        else {
            if ($parsedCreated -and $parsedCreated -lt $cutoffDate) {
                $neverStale.Add((Build-UserRecord -User $user -Category 'NeverLoggedIn_Stale' -LastSignIn $null))
            }
        }
    }

    return @{
        Inactive           = $inactive.ToArray()
        NeverLoggedInStale = $neverStale.ToArray()
    }
}

function Build-UserRecord {
    param([object]$User, [string]$Category, [nullable[datetime]]$LastSignIn)

    $manager = $User.manager
    return [PSCustomObject]@{
        Category     = $Category
        DisplayName  = $User.displayName
        UPN          = $User.userPrincipalName
        Mail         = $User.mail
        EmployeeType = if ($User.employeeType) { $User.employeeType } else { 'Unknown' }
        CreatedDate  = if ($User.createdDateTime) { ([datetime]$User.createdDateTime).ToString('yyyy-MM-dd') } else { 'Unknown' }
        LastSignIn   = if ($LastSignIn) { $LastSignIn.ToString('yyyy-MM-dd') } else { 'Never' }
        ManagerName  = if ($manager) { $manager.displayName } else { 'No manager assigned' }
        ManagerUPN   = if ($manager) { $manager.userPrincipalName } else { $null }
        ManagerMail  = if ($manager) { $manager.mail } else { $null }
    }
}

Export-ModuleMember -Function Get-InactiveUserReport

function Send-ManagerNotifications {
    param(
        [Parameter(Mandatory)]
        [hashtable]$Report,
        [Parameter(Mandatory)]
        [string]$WebhookUrl,
        [string[]]$AllowList = @()
    )

    if ($AllowList.Count -eq 0) {
        Write-Host "Allow list empty — skipping manager notifications."
        return
    }

    # Filter to allow-listed managers only
    $eligibleInactive = @($Report.Inactive | Where-Object {
        $_.ManagerUPN -and ($AllowList -contains $_.ManagerUPN)
    })
    $eligibleNeverLoggedIn = @($Report.NeverLoggedInStale | Where-Object {
        $_.ManagerUPN -and ($AllowList -contains $_.ManagerUPN)
    })

    $allManagerUpns = @(
        $eligibleInactive       | Select-Object -ExpandProperty ManagerUPN
        $eligibleNeverLoggedIn  | Select-Object -ExpandProperty ManagerUPN
    ) | Select-Object -Unique

    foreach ($managerUpn in $allManagerUpns) {
        $inactiveGroup      = @($eligibleInactive      | Where-Object { $_.ManagerUPN -eq $managerUpn })
        $neverLoggedInGroup = @($eligibleNeverLoggedIn | Where-Object { $_.ManagerUPN -eq $managerUpn })

        $message = Build-ManagerDmMessage `
            -ManagerFirstName ($inactiveGroup[0].ManagerName -split ' ')[0] `
            -InactiveEmployees      $inactiveGroup `
            -NeverLoggedInEmployees $neverLoggedInGroup

        $payload = @{
            recipientUpn = $managerUpn
            message      = $message
        } | ConvertTo-Json

        try {
            Invoke-RestMethod -Uri $WebhookUrl -Method POST -Body $payload -ContentType 'application/json'
            Write-Host "DM sent to $managerUpn"
        }
        catch {
            Write-Warning "Failed to send DM to $managerUpn`: $_"
        }
    }
}

Export-ModuleMember -Function Send-ManagerNotifications

param environmentName string = 'sandbox'
param location string = resourceGroup().location
param teamsGroupId string    // Team Object ID
param teamsChannelId string  // Channel ID
param teamsSenderUpn string  // DM sender UPN
param ropcClientId string    // ROPC app registration

var appName        = 'inactive-users'
var resourceSuffix = '${appName}-${environmentName}'

module keyVault 'modules/keyVault.bicep' = {
  name: 'deploy-keyVault'
  params: {
    resourceSuffix : resourceSuffix
    location       : location
  }
}

module functionApp 'modules/functionApp.bicep' = {
  name: 'deploy-functionApp'
  params: {
    resourceSuffix : resourceSuffix
    location       : location
    keyVaultName   : keyVault.outputs.keyVaultName
  }
}

module logicApp 'modules/logicApp.bicep' = {
  name: 'deploy-logicApp'
  params: {
    resourceSuffix : resourceSuffix
    location       : location
    teamsGroupId   : teamsGroupId
    teamsChannelId : teamsChannelId
  }
}

module logicAppManagerDm 'modules/logicAppManagerDm.bicep' = {
  name: 'deploy-logicAppManagerDm'
  params: {
    resourceSuffix: resourceSuffix
    location      : location
    keyVaultName  : keyVault.outputs.keyVaultName
    tenantId      : tenant().tenantId
    ropcClientId  : ropcClientId
    senderUpn     : teamsSenderUpn
  }
}

module kvAccessPolicy 'modules/keyVaultAccessPolicy.bicep' = {
  name: 'deploy-kvAccessPolicy'
  params: {
    keyVaultName : keyVault.outputs.keyVaultName
    principalId  : functionApp.outputs.managedIdentityPrincipalId
  }
}

output functionAppName            string = functionApp.outputs.functionAppName
output managedIdentityPrincipalId string = functionApp.outputs.managedIdentityPrincipalId
output keyVaultName               string = keyVault.outputs.keyVaultName
output logicAppName               string = logicApp.outputs.logicAppName