CreateNewAADUser&DuplicateGroups_v2.ps1

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Users
using namespace System.Web.Security

[CmdletBinding(SupportsShouldProcess, ConfirmImpact="High")]
param (
    [Parameter(Mandatory, ValueFromPipelineByPropertyName, HelpMessage="Enter username@domain to copy from:")]
        [ValidateScript({
            if(Get-MgUser -Filter "UserPrincipalName eq '$_'"){
                return $true
            }
            throw "Could not find a user '$_' by UserPrincipalName"
        })]
        [string]$UserTemplate,
    [Parameter(Mandatory, ValueFromPipelineByPropertyName, HelpMessage="Enter the new staff FIRST name:")]
        [Alias('fName')]
        [AllowEmptyString()][string]$FirstName,
    [Parameter(Mandatory, ValueFromPipelineByPropertyName, HelpMessage="Enter the new staff LAST name:")]
        [Alias('lName')][string]$LastName
)

begin {
    Add-Type -AssemblyName "System.Web"

    [string[]]$CurrentScopes = (Get-MgContext).Scopes
    [string[]]$RequiredScopes = @(
        "User.ReadWrite.All"
        "Organization.Read.All"
    )
    if($RequiredScopes | Where-Object { $CurrentScopes -notcontains $_ }){
        Connect-MgGraph -Scopes $RequiredScopes
    }

    function Get-RandomPassword {
        [CmdletBinding()]
        param (
            [Parameter(Mandatory, Position=0)][int]$Length,
            [int]$NonAlphanumericCharacters = 1
        )

        [Membership]::GeneratePassword($Length, $NonAlphanumericCharacters)
    }
}

process {
    $TemplateUserObject = Get-MgUser -UserId $UserTemplate -Property @(
        "Id"
        "JobTitle"
        "Department"
        "AssignedLicenses"
    )
    $NewUserName = "$($FirstName[0])$LastName"
    $NewUserEmail = "$NewUserName@domain"

    if($PSCmdlet.ShouldProcess("Create new user $NewUserEmail based on $UserTemplate?", $NewUserEmail, "Create")){
        $RandomPassword = Get-RandomPassword -Length 12
        $CreateUserParameters = @{
            DisplayName = "$FirstName $LastName"
            PasswordProfile = @{
                Password = $RandomPassword
            }
            UserPrincipalName = $NewUserEmail
            AccountEnabled = $true
            MailNickname = $NewUserName
            JobTitle = $TemplateUserObject.JobTitle
            ShowInAddressList = $TemplateUserObject.JobTitle -ne "<dept>"
        }
        $NewUser = New-MgUser @CreateUserParameters

        $Manager = Get-MgUserManagerByRef -UserId $TemplateUserObject.Id
        Set-MgUserManagerByRef -UserId $NewUser.Id -BodyParameter $Manager

        # Assign groups excluding dynamic
        $MembershipGroups = Get-MgUserMemberOfAsGroup -UserId $TemplateUserObject.Id -Property "id", "displayName", "GroupTypes"
        foreach($Group in $MembershipGroups){
            foreach($Gtype in $Group.GroupTypes){
                 if($Gtype -eq "DynamicMembership"){
                        Write-Host "Skipping dynamic group $($Group.DisplayName)..."
                        continue
                    }
                Write-Host "Adding $NewUserEmail to $($Group.DisplayName)..."
                New-MgGroupMember -GroupId $Group.Id -DirectoryObjectId $NewUser.Id
            }
        }

        #Assign the same licenses
        Set-MgUserLicense -UserId "$($NewUserEmail)" -AddLicenses $TemplateUserObject.AssignedLicenses -RemoveLicenses @()

        # Do use Write-Host here, we don't want to hide this message.
        Write-Host "The temporary password for user: $NewUserEmail is: $RandomPassword"
    }
}