new-AutopilotEnrollApp.ps1

# Install required modules if not present
$requiredModules = @('Microsoft.Graph.Applications', 'Microsoft.Graph.Authentication')
foreach ($module in $requiredModules) {
    if (!(Get-Module -ListAvailable -Name $module)) {
        Install-Module -Name $module -Force -AllowClobber -Scope CurrentUser
    }
}

# Import the modules
Import-Module Microsoft.Graph.Applications
Import-Module Microsoft.Graph.Authentication

# Connect to Microsoft Graph with required permissions
Connect-MgGraph -Scopes "Application.ReadWrite.All", "Directory.ReadWrite.All"

# Get tenant ID
$tenantId = (Get-MgContext).TenantId

# Create the application
$appName = "Autopilot Device Registration App"
$app = New-MgApplication -DisplayName $appName `
    -RequiredResourceAccess @(
        @{
            ResourceAppId = "00000003-0000-0000-c000-000000000000" # Microsoft Graph
            ResourceAccess = @(
                @{
                    Id = "0c5e8a55-87a6-4556-be89-624c6ded1964" # Read and write Microsoft Intune Autopilot device information
                    Type = "Role"
                }
            )
        }
    ) `
    -SignInAudience "AzureADMyOrg"

# Create a client secret
$endDateTime = (Get-Date).AddYears(2)
$passwordCred = Add-MgApplicationPassword -ApplicationId $app.Id -PasswordCredential @{
    DisplayName = "Autopilot Registration Secret"
    EndDateTime = $endDateTime
}

# Create the service principal
$sp = New-MgServicePrincipal -AppId $app.AppId

# Output the details
Write-Host "`nApplication created successfully!"
Write-Host "Please make sure to grant admin consent for the API permissions in the Azure Portal"
Write-Host "`nApplication Details:"
Write-Host "Tenant ID: $tenantId"
Write-Host "Application (Client) ID: $($app.AppId)"
Write-Host "Client Secret: $($passwordCred.SecretText)"

# Update enroll.cmd with new credentials
$enrollPath = Join-Path $PSScriptRoot "enroll.cmd"
$enrollContent = Get-Content -Path $enrollPath -Raw

# Replace the credentials in enroll.cmd
$enrollContent = $enrollContent -replace "'[^']*' # TenantId", "'$tenantId' # TenantId"
$enrollContent = $enrollContent -replace "'[^']*' # AppId", "'$($app.AppId)' # AppId"
$enrollContent = $enrollContent -replace "'[^']*' # AppSecret", "'$($passwordCred.SecretText)' # AppSecret"

Set-Content -Path $enrollPath -Value $enrollContent

Write-Host "`nUpdated enroll.cmd with new credentials"
Write-Host "`nIMPORTANT: Go to Azure Portal -> Azure Active Directory -> App registrations -> $appName -> API permissions"
Write-Host "Click on 'Grant admin consent' button to enable the permissions"