Connect-EntraIga.ps1

function Connect-EntraIga {
    [CmdletBinding()]
    param (
        [Parameter(ParameterSetName="All",Mandatory)]
        [switch]$All,

        [Parameter(ParameterSetName="Graph",Mandatory)]
        [switch]$Graph,        
        [Parameter(ParameterSetName="All")]
        [Parameter(ParameterSetName="Graph")]
        [ValidateSet("China", "Germany", "Global", "USGov", "USGovDoD")]
        [string]$GraphEnvironment = "Global",
        
        [Parameter(ParameterSetName="Azure",Mandatory)]
        [switch]$Azure,
        [Parameter(ParameterSetName="All")]
        [Parameter(ParameterSetName="Azure")]
        [ValidateSet("AzureChinaCloud", "AzureCloud", "AzureUSGovernment")]
        [string]$AzureEnvironment = "AzureCloud",
        
        [switch]$UseDeviceCode,
        [switch]$Identity
    )
    
    begin {
        $scopes = @(
            "Directory.AccessAsUser.All",
            "EntitlementManagement.ReadWrite.All",
            "RoleManagementPolicy.ReadWrite.AzureADGroup",
            "RoleManagementPolicy.ReadWrite.Directory",
            "RoleManagement.ReadWrite.Directory",
            "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup",
            "PrivilegedAccess.ReadWrite.AzureADGroup"
        )
        $prefixInfo = "[Info][$($MyInvocation.MyCommand.Name)]"
    }
    
    process {
        if($All){
            $Graph = $Azure = $All
        }
        
        if($Azure){
            $azureSplat = @{
                Environment = $AzureEnvironment
            }
            if($UseDeviceCode){
                $azureSplat.UseDeviceAuthentication = $UseDeviceCode
            }
            if($Identity){
                $azureSplat.Identity = $Identity
            }
            Write-Output "$prefixInfo Connecting to Azure"
            Connect-AzAccount @azureSplat

            if($Graph){
                #$data = Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/v1.0/me" -Method GET -OutputType HttpResponseMessage
                #$data.RequestMessage.Headers.Authorization.Parameter
                #The opposite isn't possible today https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/2023
                #Uses .default scope, https://github.com/Azure/azure-powershell/issues/14085#issuecomment-1163204817
                ## .default for interactive: AuditLog.Read.All,Directory.AccessAsUser.All,email,openid,profile
                $AccessToken = (Get-AzAccessToken -ResourceUrl "https://graph.microsoft.com").Token
                $graphSplat = @{
                    AccessToken = $($AccessToken|ConvertTo-SecureString -AsPlainText)
                    Environment = $GraphEnvironment
                    NoWelcome   = $true
                }
                Write-Output "$prefixInfo Connecting to Graph using Azure App Registration"
                Connect-MgGraph @graphSplat

                $addScopes = $scopes | Where-Object {`
                    $_ -notin $((Get-MgContext).Scopes)
                }
            }
        }

        if((-not $Azure -and $Graph) -or $addScopes){
            $graphSplat = @{
                Scopes        = $scopes
                NoWelcome     = $true
                Environment   = $GraphEnvironment
            }
            if($UseDeviceCode){
                $azureSplat.UseDeviceCode = $UseDeviceCode
            }
            if($Identity){
                $azureSplat.Identity = $Identity
            }
            Write-Output "$prefixInfo Connecting to Graph"
            Connect-MgGraph @graphSplat
        }
    }
}