Connect-ExchangeOnline -UserPrincipalName admin@yourtenant.onmicrosoft.com -ShowBanner:$false

Set-CASMailbox -Identity "user1@yourdomain.com" -SmtpClientAuthenticationDisabled $false -ImapEnabled $true

try {
    # Provisioning commands here
    Write-Host "Provisioned: $($user.UserPrincipalName)" -ForegroundColor Green
} catch {
    $errorMsg = "$($user.UserPrincipalName): $($_.Exception.Message)"
    Write-Error $errorMsg
    Out-File -FilePath "C:\logs\provisioning_errors.log" -InputObject $errorMsg -Append
}

param(
    [Parameter(Mandatory=$true)]
    [string]$CsvPath,
    [string]$LogPath = ".\provisioning_errors.log",
    [Parameter(Mandatory=$true)]
    [string]$AdminUpn
)

# Connect to Microsoft Graph and Exchange Online
Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.ReadWrite.All"
Connect-ExchangeOnline -UserPrincipalName $AdminUpn -ShowBanner:$false

$users = Import-Csv -Path $CsvPath
$credentialExport = @()

foreach ($user in $users) {
    try {
        # Generate a unique secure password for each inbox
        Add-Type -AssemblyName System.Web
        $generatedPassword = [System.Web.Security.Membership]::GeneratePassword(14, 3)

        $passwordProfile = @{
            Password                      = $generatedPassword
            ForceChangePasswordNextSignIn = $false
        }

        # Create user in Entra ID
        New-MgUser `
            -UserPrincipalName $user.UserPrincipalName `
            -DisplayName       $user.DisplayName `
            -GivenName         $user.GivenName `
            -Surname           $user.SurName `
            -AccountEnabled    $true `
            -MailNickname      ($user.GivenName + $user.SurName).ToLower() `
            -PasswordProfile   $passwordProfile `
            -UsageLocation     $user.UsageLocation

        Start-Sleep -Seconds 10  # Allow time for user object sync

        # Assign license
        $mgUser = Get-MgUser -Filter "userPrincipalName eq '$($user.UserPrincipalName)'"
        $sku = Get-MgSubscribedSku | Where-Object { $_.SkuPartNumber -eq $user.LicenseSku }
        if (-not $sku) { throw "License SKU '$($user.LicenseSku)' not found in tenant." }
        Set-MgUserLicense -UserId $mgUser.Id -AddLicenses @{ SkuId = $sku.SkuId } -RemoveLicenses @()

        Start-Sleep -Seconds 20  # Allow time for mailbox provisioning

        # Enable IMAP and SMTP AUTH
        Set-CASMailbox -Identity $user.UserPrincipalName `
            -SmtpClientAuthenticationDisabled $false `
            -ImapEnabled $true

        # Add to credentials export
        $credentialExport += [PSCustomObject]@{
            Email     = $user.UserPrincipalName
            Password  = $generatedPassword
            IMAP_Host = "outlook.office365.com"
            IMAP_Port = 993
            SMTP_Host = "smtp.office365.com"
            SMTP_Port = 587
        }

        Write-Host "Provisioned: $($user.UserPrincipalName)" -ForegroundColor Green

    } catch {
        $errorMsg = "FAILED [$($user.UserPrincipalName)]: $($_.Exception.Message)"
        Write-Error $errorMsg
        Out-File -FilePath $LogPath -InputObject $errorMsg -Append
    }
}

# Export credentials CSV for sending platform import
$credentialExport | Export-Csv -Path ".\inbox_credentials.csv" -NoTypeInformation
Write-Host "Credentials exported. Review $LogPath for failures." -ForegroundColor Yellow

Disconnect-ExchangeOnline -Confirm:$false
Disconnect-MgGraph