# Ensure ImportExcel module is installed
if (-not (Get-Module -ListAvailable -Name ImportExcel)) {
    Write-Host "📦 ImportExcel module not found. Installing..."
    Install-Module -Name ImportExcel -Scope CurrentUser -Force
} else {
    Write-Host "✅ ImportExcel module is already installed."
}

# Ensure ExchangeOnlineManagement module is installed
if (-not (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) {
    Write-Host "📦 ExchangeOnlineManagement module not found. Installing..."
    Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser -Force
} else {
    Write-Host "✅ ExchangeOnlineManagement module is already installed."
}

# Set output path
$excelPath = "C:\Temp\SharedMailboxesReport.xlsx"

# Ensure C:\Temp exists
if (!(Test-Path -Path "C:\Temp")) {
    New-Item -Path "C:\" -Name "Temp" -ItemType Directory | Out-Null
}

# Connect to Exchange Online
Connect-ExchangeOnline

# Get all shared mailboxes
$sharedMailboxes = Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails SharedMailbox

# Build report with interpretation
$sharedMailboxReport = $sharedMailboxes | ForEach-Object {
    $signInBlocked = $_.AccountDisabled
    $interpretation = if ($signInBlocked) {
        "✅ Sign-in is blocked (secure - default for shared mailboxes)"
    } else {
        "❌ Sign-in is enabled (unusual - investigate)"
    }

    [PSCustomObject]@{
        DisplayName             = $_.DisplayName
        PrimarySmtpAddress      = $_.PrimarySmtpAddress
        Alias                   = $_.Alias
        EmailAddresses          = ($_.EmailAddresses -join ", ")
        SignInBlocked           = $signInBlocked
        SignInStatusExplanation = $interpretation
    }
}

# Export to Excel
$sharedMailboxReport | Export-Excel -Path $excelPath -WorksheetName "Shared Mailboxes" -AutoSize

Write-Host "`n✅ Report exported to $excelPath"

# Disconnect session
Disconnect-ExchangeOnline -Confirm:$false

# Clear cached credentials to force reauthentication next time
Remove-Item "$env:USERPROFILE\.ExchangeOnline\TokenCache" -Force -ErrorAction SilentlyContinue
Write-Host "`n🧹 Cached credentials cleared. Reauthentication will be required on next run."