Offboarding nhân viên nghỉ việc trên Microsoft 365: khóa truy cập ngay, giữ dữ liệu, bàn giao đúng thứ tự

Connect-MgGraph -Scopes "User.ReadWrite.All","Group.ReadWrite.All","Directory.ReadWrite.All",
    "UserAuthenticationMethod.ReadWrite.All","DeviceManagementManagedDevices.PrivilegedOperations.All" -NoWelcome
Connect-ExchangeOnline -ShowBanner:$false
$user = Get-MgUser -UserId $r.UserPrincipalName -Property Id,DisplayName,UserPrincipalName
$to   = if ($r.HandoverTo) { Get-MgUser -UserId $r.HandoverTo }
        else { Get-MgUserManager -UserId $user.Id | ForEach-Object { Get-MgUser -UserId $_.Id } }
if (-not $to) { throw "Không xác định được người nhận bàn giao cho $($user.UserPrincipalName)" }

Update-MgUser -UserId $user.Id -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $user.Id
Get-MgUserAuthenticationMethod -UserId $user.Id | Where-Object {
    $_.AdditionalProperties.'@odata.type' -eq '#microsoft.graph.microsoftAuthenticatorAuthenticationMethod' } |
    ForEach-Object { Remove-MgUserAuthenticationMicrosoftAuthenticatorMethod -UserId $user.Id `
        -MicrosoftAuthenticatorAuthenticationMethodId $_.Id }

Set-Mailbox -Identity $user.UserPrincipalName -ForwardingAddress $null -ForwardingSmtpAddress $null `
    -DeliverToMailboxAndForward $false
Get-InboxRule -Mailbox $user.UserPrincipalName |
    Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo } |
    Remove-InboxRule -Confirm:$false

Get-MgUserManagedDevice -UserId $user.Id | ForEach-Object {
    Invoke-MgRetireDeviceManagementManagedDevice -ManagedDeviceId $_.Id
    Write-Host "Retire: $($_.DeviceName) ($($_.OperatingSystem))" }

$upn  = $user.UserPrincipalName
$size = (Get-EXOMailboxStatistics -Identity $upn).TotalItemSize.Value.ToBytes() / 1GB
if ($r.LegalHold -eq 'Yes') {
    Set-Mailbox -Identity $upn -LitigationHoldEnabled $true -LitigationHoldDuration 2555 }
Set-Mailbox -Identity $upn -Type Shared
Add-MailboxPermission -Identity $upn -User $to.UserPrincipalName -AccessRights FullAccess `
    -InheritanceType All -AutoMapping $true | Out-Null
Write-Host ("Mailbox {0:N1} GB" -f $size)

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"
$od = (Get-SPOSite -IncludePersonalSite $true -Limit All -Filter "Owner -eq '$upn'").Url
Set-SPOSite -Identity $od -SharingCapability Disabled
Set-SPOUser -Site $od -LoginName $to.UserPrincipalName -IsSiteCollectionAdmin $true | Out-Null

Get-MgUserOwnedObject -UserId $user.Id -All |
  Where-Object { $_.AdditionalProperties.'@odata.type' -eq '#microsoft.graph.group' } |
  ForEach-Object {
    $gid = $_.Id
    $owners = (Get-MgGroupOwner -GroupId $gid -All).Id
    if ($to.Id -notin $owners) {
        New-MgGroupOwnerByRef -GroupId $gid -BodyParameter @{
            "@odata.id" = "https://graph.microsoft.com/v1.0/users/$($to.Id)" } }
    Remove-MgGroupOwnerDirectoryObjectByRef -GroupId $gid -DirectoryObjectId $user.Id }
Get-MgUserMemberOf -UserId $user.Id -All |
  Where-Object { $_.AdditionalProperties.'@odata.type' -eq '#microsoft.graph.group' -and
                 -not $_.AdditionalProperties.membershipRule } |
  ForEach-Object { Remove-MgGroupMemberDirectoryObjectByRef -GroupId $_.Id -DirectoryObjectId $user.Id `
                     -ErrorAction SilentlyContinue }

Update-MgUser -UserId $user.Id -Department $null -JobTitle $null -EmployeeType $null
Remove-MgUserManagerByRef -UserId $user.Id -ErrorAction SilentlyContinue
$direct = (Get-MgUserLicenseDetail -UserId $user.Id).SkuId
if ($direct) { Set-MgUserLicense -UserId $user.Id -AddLicenses @() -RemoveLicenses $direct | Out-Null }
Set-Mailbox -Identity $upn -HiddenFromAddressListsEnabled $true

<#
.SYNOPSIS  Offboarding user Microsoft 365: chan truy cap, giu du lieu, ban giao, go license.
.EXAMPLE   .\Invoke-M365Offboarding.ps1 -CsvPath .\hr-offboarding-batch.csv -WhatIfOnly
.EXAMPLE   .\Invoke-M365Offboarding.ps1 -CsvPath .\hr-offboarding-batch.csv
#>
[CmdletBinding()]
param(
    [Parameter(Mandatory)] [string]$CsvPath,
    [switch]$WhatIfOnly
)
#region ===== CONFIG =====
$SpoAdminUrl     = "https://contoso-admin.sharepoint.com"
$SenderMailbox   = "it-offboarding@contoso.com"
$HrMailbox       = "hr@contoso.com"
$SharedLimitGB   = 50
$HoldDays        = 2555
$OutDir          = Join-Path $PSScriptRoot "output"
#endregion
$ErrorActionPreference = 'Stop'
New-Item -ItemType Directory -Path $OutDir -Force | Out-Null
# ===== CONNECT =====
Connect-MgGraph -NoWelcome -Scopes "User.ReadWrite.All","Group.ReadWrite.All","Directory.ReadWrite.All",
    "UserAuthenticationMethod.ReadWrite.All","DeviceManagementManagedDevices.PrivilegedOperations.All",
    "DeviceManagementManagedDevices.Read.All","Mail.Send"
Connect-ExchangeOnline -ShowBanner:$false
Connect-SPOService -Url $SpoAdminUrl
$Rows   = Import-Csv $CsvPath
$Result = [System.Collections.Generic.List[object]]::new()
foreach ($r in $Rows) {
    $log = [ordered]@{ UPN = $r.UserPrincipalName; HandoverTo=''; BlockSignIn='SKIP'; RevokeSessions='SKIP'
        Forwarding='SKIP'; Devices='SKIP'; Mailbox='SKIP'; OneDrive='SKIP'; Groups='SKIP'
        License='SKIP'; HideGAL='SKIP'; OneDriveUrl=''; MailboxGB=0; Error='' }
    try {
        $user = Get-MgUser -UserId $r.UserPrincipalName -Property Id,DisplayName,UserPrincipalName,AccountEnabled
        $upn  = $user.UserPrincipalName
        # Nguoi nhan ban giao
        $to = if ($r.HandoverTo) { Get-MgUser -UserId $r.HandoverTo -Property Id,DisplayName,UserPrincipalName,Mail }
              else { $m = Get-MgUserManager -UserId $user.Id -ErrorAction SilentlyContinue
                     if ($m) { Get-MgUser -UserId $m.Id -Property Id,DisplayName,UserPrincipalName,Mail } }
        if (-not $to) { throw "Khong xac dinh duoc nguoi nhan ban giao" }
        $log.HandoverTo = $to.UserPrincipalName
        $mbxStat = Get-EXOMailboxStatistics -Identity $upn -ErrorAction SilentlyContinue
        $sizeGB  = if ($mbxStat) { [math]::Round($mbxStat.TotalItemSize.Value.ToBytes()/1GB,2) } else { 0 }
        $mbx     = Get-EXOMailbox -Identity $upn -Properties ArchiveStatus -ErrorAction SilentlyContinue
        $log.MailboxGB = $sizeGB
        $keepLicense = ($sizeGB -ge $SharedLimitGB) -or ($mbx.ArchiveStatus -eq 'Active') -or ($r.LegalHold -eq 'Yes')
        if ($WhatIfOnly) {
            Write-Host "[WHATIF] $upn -> ban giao cho $($to.UserPrincipalName); mailbox $sizeGB GB; giu license: $keepLicense" -ForegroundColor Yellow
            $Result.Add([pscustomobject]$log); continue
        }
        # 1. Chan dang nhap
        Update-MgUser -UserId $user.Id -AccountEnabled:$false
        $log.BlockSignIn = 'OK'
        # 2. Thu hoi phien + go Authenticator
        Revoke-MgUserSignInSession -UserId $user.Id | Out-Null
        Get-MgUserAuthenticationMicrosoftAuthenticatorMethod -UserId $user.Id -ErrorAction SilentlyContinue |
            ForEach-Object { Remove-MgUserAuthenticationMicrosoftAuthenticatorMethod -UserId $user.Id `
                -MicrosoftAuthenticatorAuthenticationMethodId $_.Id }
        $log.RevokeSessions = 'OK'
        if ($mbx) {
            # 3. Forwarding + inbox rule chuyen tiep
            Set-Mailbox -Identity $upn -ForwardingAddress $null -ForwardingSmtpAddress $null -DeliverToMailboxAndForward $false
            Get-InboxRule -Mailbox $upn | Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo } |
                Remove-InboxRule -Confirm:$false
            $log.Forwarding = 'OK'
        }
        # 4. Retire thiet bi
        $devices = Get-MgUserManagedDevice -UserId $user.Id -ErrorAction SilentlyContinue
        foreach ($d in $devices) { Invoke-MgRetireDeviceManagementManagedDevice -ManagedDeviceId $d.Id }
        $log.Devices = if ($devices) { "OK ($(@($devices).Count))" } else { 'SKIP' }
        # 5. Hold + shared mailbox + FullAccess
        if ($mbx) {
            if ($r.LegalHold -eq 'Yes') { Set-Mailbox -Identity $upn -LitigationHoldEnabled $true -LitigationHoldDuration $HoldDays }
            Set-Mailbox -Identity $upn -Type Shared
            Add-MailboxPermission -Identity $upn -User $to.UserPrincipalName -AccessRights FullAccess `
                -InheritanceType All -AutoMapping $true | Out-Null
            $log.Mailbox = 'OK'
        }
        # 6. OneDrive
        $od = Get-SPOSite -IncludePersonalSite $true -Limit All -Filter "Owner -eq '$upn'" -ErrorAction SilentlyContinue |
              Where-Object Url -like "*-my.sharepoint.com/personal/*" | Select-Object -First 1
        if ($od) {
            Set-SPOSite -Identity $od.Url -SharingCapability Disabled
            Set-SPOUser -Site $od.Url -LoginName $to.UserPrincipalName -IsSiteCollectionAdmin $true | Out-Null
            $log.OneDrive = 'OK'; $log.OneDriveUrl = $od.Url
        }
        # 7. Chuyen chu group (them truoc, go sau) + go membership tinh
        Get-MgUserOwnedObject -UserId $user.Id -All |
          Where-Object { $_.AdditionalProperties.'@odata.type' -eq '#microsoft.graph.group' } | ForEach-Object {
            $gid = $_.Id
            if ($to.Id -notin (Get-MgGroupOwner -GroupId $gid -All).Id) {
                New-MgGroupOwnerByRef -GroupId $gid -BodyParameter @{
                    "@odata.id" = "https://graph.microsoft.com/v1.0/users/$($to.Id)" } }
            Remove-MgGroupOwnerDirectoryObjectByRef -GroupId $gid -DirectoryObjectId $user.Id }
        Get-MgUserMemberOf -UserId $user.Id -All |
          Where-Object { $_.AdditionalProperties.'@odata.type' -eq '#microsoft.graph.group' -and
                         -not $_.AdditionalProperties.membershipRule -and
                         -not $_.AdditionalProperties.onPremisesSyncEnabled } | ForEach-Object {
            Remove-MgGroupMemberDirectoryObjectByRef -GroupId $_.Id -DirectoryObjectId $user.Id -ErrorAction SilentlyContinue }
        $log.Groups = 'OK'
        # 8. Xoa thuoc tinh to chuc, go license (neu an toan), an khoi GAL
        Update-MgUser -UserId $user.Id -BodyParameter @{ department = $null; jobTitle = $null; employeeType = $null }
        Remove-MgUserManagerByRef -UserId $user.Id -ErrorAction SilentlyContinue
        if ($keepLicense) { $log.License = 'KEPT (>50GB/archive/hold)' }
        else {
            $direct = (Get-MgUser -UserId $user.Id -Property LicenseAssignmentStates).LicenseAssignmentStates |
                      Where-Object { -not $_.AssignedByGroup } | Select-Object -ExpandProperty SkuId -Unique
            if ($direct) { Set-MgUserLicense -UserId $user.Id -AddLicenses @() -RemoveLicenses @($direct) | Out-Null }
            $log.License = 'OK'
        }
        if ($mbx) { Set-Mailbox -Identity $upn -HiddenFromAddressListsEnabled $true; $log.HideGAL = 'OK' }
        # 9. Bao cao cho nguoi nhan ban giao + HR
        $body = "<p>Tai khoan <b>$($user.DisplayName)</b> ($upn) da duoc offboard.</p>" +
                "<ul><li>Mailbox (shared, $sizeGB GB): da cap FullAccess cho $($to.UserPrincipalName)</li>" +
                "<li>OneDrive: $($log.OneDriveUrl)</li><li>License: $($log.License)</li></ul>" +
                "<p>Vui long chuyen file can thiet sang SharePoint cua nhom truoc thoi han luu giu OneDrive.</p>"
        Send-MgUserMail -UserId $SenderMailbox -BodyParameter @{ message = @{
            subject = "[Offboarding] $($user.DisplayName)"
            body = @{ contentType = "HTML"; content = $body }
            toRecipients = @(@{ emailAddress = @{ address = $to.Mail } }, @{ emailAddress = @{ address = $HrMailbox } }) } }
        Write-Host "OK  $upn" -ForegroundColor Green
    }
    catch { $log.Error = $_.Exception.Message; Write-Host "ERR $($r.UserPrincipalName): $($log.Error)" -ForegroundColor Red }
    $Result.Add([pscustomobject]$log)
}
$ResultFile = Join-Path $OutDir ("offboarding-result-{0:yyyyMMdd-HHmm}.csv" -f (Get-Date))
$Result | Export-Csv $ResultFile -NoTypeInformation -Encoding UTF8
$Result | Format-Table UPN,HandoverTo,BlockSignIn,Mailbox,OneDrive,Groups,License -AutoSize
Write-Host "DONE -> $ResultFile" -ForegroundColor Cyan