The UPN
Migration Hub.

# Auth via client credentials
$tokenBody = @{
    client_id     = $config.clientId      # <client-id>
    client_secret = $config.clientSecret  # <client-secret>
    scope         = "https://graph.microsoft.com/.default"
    grant_type    = "client_credentials"
}
$token = (Invoke-RestMethod -Method POST `
    -Uri "https://login.microsoftonline.com/$($config.tenantId)/oauth2/v2.0/token" `
    -Body $tokenBody).access_token

$users = Import-Csv -Path $csvPath
$progressFile = Join-Path $PSScriptRoot "send_progress.json"

foreach ($user in $users) {
    $htmlBody = $template
    $htmlBody = $htmlBody -replace '\{\{DisplayName\}\}', $user.DisplayName
    $htmlBody = $htmlBody -replace '\{\{OldEmail\}\}', $user.UPN
    $htmlBody = $htmlBody -replace '\{\{NewEmail\}\}', ($user.UPN -replace '@x\.kry\.se$', '@kry.se')

    $mailPayload = @{
        message = @{
            subject      = $subjectLine
            body         = @{ contentType = "HTML"; content = $htmlBody }
            toRecipients = @( @{ emailAddress = @{ address = $user.Mail } } )
        }
        saveToSentItems = $false
    } | ConvertTo-Json -Depth 5

    Invoke-RestMethod -Method POST `
        -Uri "https://graph.microsoft.com/v1.0/users/$($config.serviceAccount)/sendMail" `
        -Headers $headers -Body $mailPayload

    # Update progress JSON (consumed by the live dashboard)
    Update-Progress -Sent (++$sent) -Total $users.Count -Status "running"
    Start-Sleep -Milliseconds 250
}

union
  (SigninLogs | extend SignInType = "Interactive"),
  (AADNonInteractiveUserSignInLogs | extend SignInType = "NonInteractive")
| where TimeGenerated >= datetime(<cutoff-timestamp>)
| where tolower(UserPrincipalName) endswith "@kry.se"
    or tolower(UserPrincipalName) endswith "@x.kry.se"
| project
    UserPrincipalName,
    UserDisplayName,
    CreatedDateTime,
    AppDisplayName,
    ResultType,
    ResultDescription,
    SignInType
| order by CreatedDateTime desc

# --- INTUNE: OneDrive UPN Fix (PRODUCTION) ---
# Forces OneDrive re-auth after UPN migration (x.kry.se -> kry.se)
# Fix runs in detection script to bypass runRemediationScript API bug.
# Uses a registry breadcrumb to run only once per device.

$regPath = "HKCU:\Software\Microsoft\OneDrive\Accounts\Business1"
$breadcrumb = "HKCU:\Software\OrgIT\OneDriveUPNFix"

# Already remediated on a previous run? Skip.
if (Test-Path $breadcrumb) {
    $fixed = Get-ItemProperty -Path $breadcrumb -ErrorAction SilentlyContinue
    Write-Output "Already remediated on $($fixed.FixedAt). Old: $($fixed.OldEmail). Skipping."
    exit 0
}

# No OneDrive Business config? Nothing to fix.
if (-not (Test-Path $regPath)) {
    Write-Output "OneDrive Business account not configured - skipping"
    exit 0
}

$email = (Get-ItemProperty -Path $regPath -Name "UserEmail" -ErrorAction SilentlyContinue).UserEmail

# Already on the new UPN? Mark done and skip.
if ($email -and $email -match '@kry\.(se|no)$' -and $email -notmatch '@x\.kry\.(se|no)$') {
    Write-Output "OneDrive already on new UPN: $email - no fix needed"
    New-Item -Path $breadcrumb -Force | Out-Null
    Set-ItemProperty -Path $breadcrumb -Name "OldEmail" -Value "n/a (already correct)"
    Set-ItemProperty -Path $breadcrumb -Name "NewEmail" -Value $email
    Set-ItemProperty -Path $breadcrumb -Name "FixedAt" -Value (Get-Date -Format "yyyy-MM-dd HH:mm:ss")
    Set-ItemProperty -Path $breadcrumb -Name "Action" -Value "none - already correct"
    exit 0
}

# Stale or unknown UPN — reset OneDrive
Write-Output "Stale/unknown OneDrive account: $email - resetting..."

$odProcesses = Get-Process -Name "OneDrive" -ErrorAction SilentlyContinue
if ($odProcesses) {
    Write-Output "Stopping OneDrive..."
    Stop-Process -Name "OneDrive" -Force
    Start-Sleep -Seconds 3
}

if (Test-Path $regPath) {
    Write-Output "Removing old account config..."
    Remove-Item -Path $regPath -Recurse -Force
}

$identityPath = "HKCU:\Software\Microsoft\OneDrive\Accounts\Business1\Tenants"
if (Test-Path $identityPath) {
    Remove-Item -Path $identityPath -Recurse -Force
}

$onedrivePath = Join-Path $env:LOCALAPPDATA "Microsoft\OneDrive\OneDrive.exe"
if (-not (Test-Path $onedrivePath)) {
    $onedrivePath = "C:\Program Files\Microsoft OneDrive\OneDrive.exe"
}
if (-not (Test-Path $onedrivePath)) {
    $onedrivePath = "C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe"
}

if (Test-Path $onedrivePath) {
    Write-Output "Restarting OneDrive from: $onedrivePath"
    Start-Process $onedrivePath
} else {
    Write-Output "WARNING: OneDrive executable not found"
}

# Leave breadcrumb so we don't run again
New-Item -Path $breadcrumb -Force | Out-Null
Set-ItemProperty -Path $breadcrumb -Name "OldEmail" -Value ($email ?? "unknown")
Set-ItemProperty -Path $breadcrumb -Name "FixedAt" -Value (Get-Date -Format "yyyy-MM-dd HH:mm:ss")
Set-ItemProperty -Path $breadcrumb -Name "Action" -Value "reset"

Write-Output "OneDrive reset complete. Was: $email. Breadcrumb written."
exit 0