Script to add Azure AD gallery apps

$accesstoken = "eyJ0eXAiOiJKV1QiLCJub25jZS--- snip ---Cz57c44q23How7d1fVbCJg"


function Ensure-Application
{
    [CmdletBinding()]
    Param
    (
        [Parameter(Mandatory=$true,
            Position=0)]
        [String] $AccessToken,

        [Parameter(Mandatory=$false,
            Position=1)]
        [String] $TemplateName = 'GitHub Enterprise Cloud - Organization',

        [Parameter(Mandatory=$false,
            Position=2)]
        [String] $Prefix = 'Github - ',

        [Parameter(Mandatory=$false,
            Position=3)]
        [String] $Suffix = ' (Enterprise Cloud)',

        [Parameter(Mandatory=$false,
            Position=4)]
        [String[]] $Owners = @(),

        [Parameter(Mandatory=$false,
            Position=5)]
        [Boolean] $AppRoleAssignmentRequired = $true,

        [Parameter(Mandatory=$true,
            ValueFromPipeline=$true)]
        [String] $InstanceName

        
    )

    Begin
    {
        # Build rest parameters (providing authorzation header)
        $restParams = @{Headers = @{Authorization = "Bearer $accesstoken"}}

        # Get all templates (returns all without paging)
        $template = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/applicationTemplates" @restParams |
            Select-Object -ExpandProperty value | 
            Where-Object displayName -eq $TemplateName

        if(!$template.id) {
            throw "Unable to find template '$TemplateName' in the Azure AD App Gallery"
        } else {
            Write-Debug "Found template: $($template | ConvertTo-Json)"
        }
    }
    Process
    {
        # Calculate displayname
        $DisplayName = "{0}{1}{2}" -f $Prefix, $InstanceName, $Suffix
        Write-Verbose "Calculated displayname '$DisplayName'"

        # Find existing application
        $application = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/applications?`$filter=displayName eq '$DisplayName'" @restParams |
            Select-Object -ExpandProperty Value

        # Find existing service principal
        $servicePrincipal = $null
        if($application) {
            $servicePrincipal = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appid eq '$($application.appId)'" @restParams |
                Select-Object -ExpandProperty Value
        }

        if(!$servicePrincipal) {
            Write-Verbose "Instantiating application '$DisplayName'"

            # Instantiate template
            $body = @{
                displayName = $DisplayName
            } | ConvertTo-Json
            $instantiation = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/applicationTemplates/$($template.id)/instantiate" -Method Post @restParams -Body $body -ContentType "application/json"

            # Check status of instantiation
            if($instantiation.application.appId) {
                Write-Verbose "Created application '$DisplayName' with id $($instantiation.application.id) and appid $($instantiation.application.appid)"
            } else {
                throw "Something failed when instantiating app :("
            }

            # Get application
            #$application = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/applications/$($instantiation.application.id)" @restParams |
            #    Select-Object -ExpandProperty Value

            # Get service principal
            $servicePrincipal = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appid eq '$($instantiation.application.appid)'" @restParams |
                Select-Object -ExpandProperty Value
            
            if(!$servicePrincipal) {
                throw "Could not find service principal for appid $($instantiation.application.appid)"
            }
        } else {
            Write-Verbose "Application '$DisplayName' already exists, checking settings"
        }

        # Ensure appRoleAssignmentRequired is correct
        if($servicePrincipal.appRoleAssignmentRequired -ne $AppRoleAssignmentRequired) {
            Write-Verbose "Updating AppRoleAssignmentRequired from $($servicePrincipal.appRoleAssignmentRequired) to $($AppRoleAssignmentRequired)"
            $body = @{
                appRoleAssignmentRequired = $AppRoleAssignmentRequired
            } | ConvertTo-Json
            Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/servicePrincipals/$($servicePrincipal.id)" -Method Patch -Body $body -ContentType "application/json" @restParams 
        }

        # If owners defined, change to these owners
        if($Owners) {
            # Get user objects of owners group Azure AD
            $OwnerObjects = $Owners | ForEach-Object {
                $upn = $_
                try {
                    Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users/$($upn)" @restParams 
                } catch {
                    throw "User $upn not found"
                }
            }

            # Get current owners
            $OwnersInAzureAD = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/servicePrincipals/$($servicePrincipal.id)/owners" @restParams | 
                Select-Object -ExpandProperty Value

            # For each owner sendt in parameter, ensure they are added as owner
            $OwnerObjects | 
                Where-Object {
                    $_.id -notin $OwnersInAzureAD.id
                } |
                ForEach-Object {
                    Write-Verbose "Adding user $($_.userPrincipalName) as owner of app"
                    $body = @{
                        "@odata.id" = "https://graph.microsoft.com/v1.0/users/{0}" -f $_.id
                    } | ConvertTo-Json
                    Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/servicePrincipals/$($servicePrincipal.id)/owners/`$ref" @restParams -Body $body -ContentType "application/json" -Method Post
                }

            # For each owner ni Azure AD, that should not be there, ensure they are removed as owner
            $OwnersInAzureAD  | 
                Where-Object {
                    $_.id -notin $OwnerObjects.id
                } |
                ForEach-Object {
                    Write-Verbose "Removing user $($_.id) as owner of app"
                    Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/servicePrincipals/$($servicePrincipal.id)/owners/$($_.id)/`$ref" @restParams -Method Delete
                }
        }
    }
    End
    {

    }
}

Ensure-Application -AccessToken $accesstoken -InstanceName "Test1" -Verbose -Owners @("AdeleV@M365x330461.OnMicrosoft.com")
Ensure-Application -AccessToken $accesstoken -InstanceName "Test2" -Verbose -Owners @("AdeleV@M365x330461.OnMicrosoft.com")
Ensure-Application -AccessToken $accesstoken -InstanceName "Test3" -Verbose -Owners @("AdeleV@M365x330461.OnMicrosoft.com")