# Requires Azure Resource Manager and Azure Active Directory Cmdlets
# Install-Module AzureRM
# Install-Module AzureADPreview

Login-AzureRmAccount

$TenantId = (Get-AzureRmSubscription).TenantId
Connect-AzureAD -TenantId $TenantId

$ResourceGroupName = "TestRG"
$Location = "westus2"
$StorageAccountBaseName = -join ((97..122) | Get-Random -Count 19 | % {[char]$_})

$ResourceGroup = New-AzureRmResourceGroup -Name $ResourceGroupName -Location $Location
$StorageAccountA = New-AzureRmStorageAccount -ResourceGroupName $ResourceGroup.ResourceGroupName -Name "$($StorageAccountBaseName)1a" -Kind Storage -SkuName Standard_LRS -Location $ResourceGroup.Location
$StorageAccountB = New-AzureRmStorageAccount -ResourceGroupName $ResourceGroup.ResourceGroupName -Name "$($StorageAccountBaseName)1b" -Kind Storage -SkuName Standard_LRS -Location $ResourceGroup.Location

$StopWatch = New-Object -TypeName System.Diagnostics.Stopwatch
$StopWatch.Start()

$GroupName = "TestADGroup"
$ADGroup = New-AzureADGroup -DisplayName $GroupName -MailEnabled $False -SecurityEnabled $True -MailNickName "NotSet"


$Domain = (Get-AzureADDomain).Name
$UserName = "testStudent"
$UserPrincipalName = "$UserName@$Domain"
$Password = "Password"
$PasswordPolicy = "DisablePasswordExpiration, DisableStrongPassword"
$PasswordProfile = New-Object -TypeName Microsoft.Open.AzureAD.Model.PasswordProfile
$PasswordProfile.Password = $Password
$ADUser = New-AzureADUser -AccountEnabled $True -DisplayName $UserName -MailNickName $UserName -UserPrincipalName $UserPrincipalName `
                          -UserType "Member" -PasswordProfile $PasswordProfile -PasswordPolicies $PasswordPolicy

Add-AzureADGroupMember -ObjectId $ADGroup.ObjectId -RefObjectId $ADUser.ObjectId

$RbacFile = $env:TEMP + "\rbac.json"
@"
{
  "Name": "Reader Storage",
  "Id": null,
  "IsCustom": true,
  "Description": "Allows for read access to Azure storage",
  "Actions": [
    "Microsoft.Storage/*/read",
    "Microsoft.Storage/storageAccounts/listKeys/action"
  ],
  "NotActions": [
  ],
  "AssignableScopes": [
    "$($StorageAccountA.Id)"
  ]
}
"@ > $RbacFile

$RoleDefinition = New-AzureRmRoleDefinition -InputFile $RbacFile


New-AzureRmRoleAssignment -ObjectId $ADGroup.ObjectId -RoleDefinitionId $RoleDefinition.Id -Scope $StorageAccountA.Id


$StopWatch.Stop()
"AD Group Created, User Created, User Added to Group, Role Created, Group Assigned to Role in:"
$StopWatch.Elapsed.TotalSeconds

$StopWatch
Remove-AzureRmRoleAssignment -ObjectId $ADGroup.ObjectId -RoleDefinitionId $RoleDefinition.Id -Scope $StorageAccountA.Id

Remove-AzureRmRoleDefinition -Id $RoleDefinition.Id -Force

Remove-AzureRmResourceGroup -Name $ResourceGroupName -Force

Remove-AzureADUser -ObjectId $ADUser.ObjectId

Remove-AzureADGroup -ObjectId $ADGroup.ObjectId