##################################################
# Conectando
##################################################

$Account = Login-AzureRmAccount -SubscriptionId $SubscriptionId

##################################################
# Criando o usuário
##################################################

Connect-AzureAD -TenantId $Account.Context.Tenant.Id

$Domain = Get-AzureADDomain

$AutomationUserEmail = "$($AutomationUserName)@$($Domain.Name)"

$PasswordProfile = New-Object -TypeName Microsoft.Open.AzureAD.Model.PasswordProfile
$PasswordProfile.Password = $AutomationUserSenha
$PasswordProfile.EnforceChangePasswordPolicy = $false
$PasswordProfile.ForceChangePasswordNextLogin = $false

$AutomationUser = New-AzureADUser -DisplayName $AutomationUserName -PasswordProfile $PasswordProfile -UserPrincipalName $AutomationUserEmail -AccountEnabled $true -MailNickName $AutomationUserName

#Aplicando perfil de acesso

$RoleId = Get-AzureADDirectoryRole | where { $_.DisplayName -ieq "Cloud Application Administrator" }[0]

if($RoleId -eq $null){
    $RoleTemplateId = Get-AzureADDirectoryRoleTemplate | where { $_.DisplayName -ieq "Cloud Application Administrator" }[0]
    $RoleId = Enable-AzureADDirectoryRole -RoleTemplateId $RoleTemplateId.ObjectId
}

Add-AzureADDirectoryRoleMember -ObjectId $RoleId.ObjectId -RefObjectId $AutomationUser.ObjectId

#Access control (IAM)
New-AzureRmRoleAssignment -SignInName $AutomationUserEmail -RoleDefinitionName Owner