PowerBITenantSettings

<#
Created by claude AI
to be reviewed!
#>

# ============================================================================
# Power BI Tenant Settings Inventory - CLEAN VERSION
# ============================================================================

# HELPER FUNCTIONS - Must be at the top
function Get-SettingCategory {
    param([string]$settingName)
    
    switch -Wildcard ($settingName) {
        "*Export*" { return "Export & Sharing" }
        "*Share*" { return "Export & Sharing" }
        "*Publish*" { return "Export & Sharing" }
        "*Admin*" { return "Admin & API" }
        "*API*" { return "Admin & API" }
        "*ServicePrincipal*" { return "Admin & API" }
        "*Metadata*" { return "Admin & API" }
        "*Workspace*" { return "Workspace Management" }
        "*Capacity*" { return "Capacity & Performance" }
        "*Dataflow*" { return "Dataflows & Datasets" }
        "*Dataset*" { return "Dataflows & Datasets" }
        "*Template*" { return "Development" }
        "*CustomVisual*" { return "Development" }
        "*RScript*" { return "Development" }
        "*Python*" { return "Development" }
        "*Email*" { return "Notifications" }
        "*Subscription*" { return "Notifications" }
        "*Guest*" { return "Security & Access" }
        "*External*" { return "Security & Access" }
        "*B2B*" { return "Security & Access" }
        "*InformationProtection*" { return "Security & Access" }
        "*Sensitivity*" { return "Security & Access" }
        "*Certification*" { return "Governance" }
        "*Endorsement*" { return "Governance" }
        "*Discovery*" { return "Governance" }
        default { return "Other" }
    }
}

function Get-SecurityEvaluation {
    param(
        [string]$settingName,
        [string]$title,
        [bool]$enabled,
        [string]$enabledFor
    )
    
    # Return object with multiple dimensions
    # This allows counting a setting in multiple categories
    
    $result = @{
        NeedsAction = $false
        IsRisky = $false
        IsCompliant = $true
        RiskLevel = "None"
        DisplayLabel = "OK"
        DisplayColor = "#6c757d"
        DisplayIcon = "—"
        Reason = ""
    }
    
    switch -Wildcard ($settingName) {
        # HIGH RISK SETTINGS
        "*PublishToWeb*" {
            if ($enabled -and $enabledFor -eq "Entire Organization") {
                $result.NeedsAction = $true
                $result.IsRisky = $true
                $result.IsCompliant = $false
                $result.RiskLevel = "High"
                $result.DisplayLabel = "High Risk"
                $result.DisplayColor = "#dc3545"
                $result.DisplayIcon = "🚨"
                $result.Reason = "Public internet exposure"
            } elseif ($enabled) {
                $result.NeedsAction = $true
                $result.IsRisky = $true
                $result.RiskLevel = "Medium"
                $result.DisplayLabel = "Medium Risk"
                $result.DisplayColor = "#ffc107"
                $result.DisplayIcon = "⚠️"
                $result.Reason = "Limited public exposure"
            } else {
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "Public sharing disabled"
            }
        }
        
        "*ShareLinkToEntireOrganization*" {
            if ($enabled -and $enabledFor -eq "Entire Organization") {
                $result.NeedsAction = $true
                $result.IsRisky = $true
                $result.RiskLevel = "Medium"
                $result.DisplayLabel = "Medium Risk"
                $result.DisplayColor = "#ffc107"
                $result.DisplayIcon = "⚠️"
                $result.Reason = "Org-wide sharing enabled"
            } else {
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "Controlled sharing"
            }
        }
        
        "*ExternalDataSharing*" {
            if ($enabled -and $enabledFor -eq "Entire Organization") {
                $result.NeedsAction = $true
                $result.IsRisky = $true
                $result.IsCompliant = $false
                $result.RiskLevel = "High"
                $result.DisplayLabel = "High Risk"
                $result.DisplayColor = "#dc3545"
                $result.DisplayIcon = "🚨"
                $result.Reason = "External data sharing enabled"
            } elseif ($enabled) {
                $result.NeedsAction = $true
                $result.IsRisky = $true
                $result.RiskLevel = "Medium"
                $result.DisplayLabel = "Medium Risk"
                $result.DisplayColor = "#ffc107"
                $result.DisplayIcon = "⚠️"
                $result.Reason = "Limited external sharing"
            } else {
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "External sharing disabled"
            }
        }
        
        "*Guest*" {
            if ($enabled -and $enabledFor -eq "Entire Organization") {
                $result.NeedsAction = $true
                $result.RiskLevel = "Medium"
                $result.DisplayLabel = "Review"
                $result.DisplayColor = "#17a2b8"
                $result.DisplayIcon = "ℹ️"
                $result.Reason = "Guest access enabled org-wide"
            } elseif ($enabled) {
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "Controlled guest access"
            } else {
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "No guest access"
            }
        }
        
        # COMPLIANCE SETTINGS (should be enabled)
        "*InformationProtection*" {
            if ($enabled) {
                $result.IsCompliant = $true
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "Data protection enabled"
            } else {
                $result.NeedsAction = $true
                $result.IsCompliant = $false
                $result.RiskLevel = "High"
                $result.DisplayLabel = "Compliance Gap"
                $result.DisplayColor = "#dc3545"
                $result.DisplayIcon = "🚨"
                $result.Reason = "Missing data protection"
            }
        }
        
        "*Sensitivity*" {
            if ($enabled) {
                $result.IsCompliant = $true
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "Sensitivity labeling enabled"
            } else {
                $result.NeedsAction = $true
                $result.IsCompliant = $false
                $result.RiskLevel = "Medium"
                $result.DisplayLabel = "Compliance Gap"
                $result.DisplayColor = "#ffc107"
                $result.DisplayIcon = "⚠️"
                $result.Reason = "No sensitivity labels"
            }
        }
        
        # GOVERNANCE SETTINGS (best practice to enable)
        "*Certification*" {
            if ($enabled) {
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "Certification available"
            } else {
                $result.NeedsAction = $true
                $result.RiskLevel = "Low"
                $result.DisplayLabel = "Governance Gap"
                $result.DisplayColor = "#17a2b8"
                $result.DisplayIcon = "ℹ️"
                $result.Reason = "No certification process"
            }
        }
        
        "*Endorsement*" {
            if ($enabled) {
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "Endorsement enabled"
            } else {
                $result.NeedsAction = $true
                $result.RiskLevel = "Low"
                $result.DisplayLabel = "Governance Gap"
                $result.DisplayColor = "#17a2b8"
                $result.DisplayIcon = "ℹ️"
                $result.Reason = "No endorsement"
            }
        }
        
        # ADMIN API SETTINGS
        "*ServicePrincipal*" {
            if ($enabled -and $enabledFor -like "Specific Groups:*") {
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "API access properly restricted"
            } elseif ($enabled -and $enabledFor -eq "Entire Organization") {
                $result.NeedsAction = $true
                $result.IsRisky = $true
                $result.RiskLevel = "Medium"
                $result.DisplayLabel = "Medium Risk"
                $result.DisplayColor = "#ffc107"
                $result.DisplayIcon = "⚠️"
                $result.Reason = "Unrestricted API access"
            } elseif ($enabled) {
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "API access enabled"
            } else {
                $result.NeedsAction = $true
                $result.RiskLevel = "Low"
                $result.DisplayLabel = "Review"
                $result.DisplayColor = "#17a2b8"
                $result.DisplayIcon = "ℹ️"
                $result.Reason = "Admin API disabled"
            }
        }
        
        "*AdminApi*" {
            if ($enabled) {
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "Admin capabilities enabled"
            } else {
                $result.NeedsAction = $true
                $result.RiskLevel = "Low"
                $result.DisplayLabel = "Review"
                $result.DisplayColor = "#17a2b8"
                $result.DisplayIcon = "ℹ️"
                $result.Reason = "Admin API disabled"
            }
        }
        
        "*Metadata*" {
            if ($enabled) {
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "Metadata access enabled"
            } else {
                $result.NeedsAction = $true
                $result.RiskLevel = "Low"
                $result.DisplayLabel = "Review"
                $result.DisplayColor = "#17a2b8"
                $result.DisplayIcon = "ℹ️"
                $result.Reason = "Metadata access limited"
            }
        }
        
        # DEVELOPMENT FEATURES
        "*CustomVisual*" {
            if ($enabled -and $enabledFor -eq "Entire Organization") {
                $result.NeedsAction = $true
                $result.IsRisky = $true
                $result.RiskLevel = "Medium"
                $result.DisplayLabel = "Medium Risk"
                $result.DisplayColor = "#ffc107"
                $result.DisplayIcon = "⚠️"
                $result.Reason = "Uncertified visuals allowed org-wide"
            } else {
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "Controlled visual usage"
            }
        }
        
        "*RScript*" {
            if ($enabled) {
                $result.NeedsAction = $true
                $result.IsRisky = $true
                $result.RiskLevel = "Medium"
                $result.DisplayLabel = "Review"
                $result.DisplayColor = "#ffc107"
                $result.DisplayIcon = "⚠️"
                $result.Reason = "R script execution enabled"
            } else {
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "Script execution disabled"
            }
        }
        
        "*Python*" {
            if ($enabled) {
                $result.NeedsAction = $true
                $result.IsRisky = $true
                $result.RiskLevel = "Medium"
                $result.DisplayLabel = "Review"
                $result.DisplayColor = "#ffc107"
                $result.DisplayIcon = "⚠️"
                $result.Reason = "Python script execution enabled"
            } else {
                $result.DisplayLabel = "OK"
                $result.DisplayColor = "#28a745"
                $result.DisplayIcon = "✓"
                $result.Reason = "Script execution disabled"
            }
        }
        
        # DEFAULT - everything else is OK
        default {
            $result.DisplayLabel = "OK"
            $result.DisplayColor = "#6c757d"
            $result.DisplayIcon = "✓"
            $result.Reason = "Standard configuration"
        }
    }
    
    return $result
}

$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$reportDate = Get-Date -Format "yyyy-MM-dd HH:mm"

Write-Host "========================================" -ForegroundColor Cyan
Write-Host "POWER BI TENANT SETTINGS EXPORT" -ForegroundColor Cyan
Write-Host "========================================`n" -ForegroundColor Cyan

# ============================================================================
# AUTHENTICATION - TRY MULTIPLE METHODS
# ============================================================================

Write-Host "Attempting authentication..." -ForegroundColor Yellow

$token = $null
$authMethod = $null

# METHOD 1: Try Power BI PowerShell Module
try {
    Write-Host "Method 1: Trying Power BI PowerShell module..." -ForegroundColor Gray
    Connect-PowerBIServiceAccount -ErrorAction Stop
    $tokenInfo = Get-PowerBIAccessToken
    $token = $tokenInfo["Authorization"].Replace("Bearer ", "")
    $authMethod = "PowerBI Module"
    Write-Host "✓ Authenticated via Power BI module`n" -ForegroundColor Green
}
catch {
    Write-Host "  Power BI module failed, trying alternative...`n" -ForegroundColor Yellow
}

# METHOD 2: Try Azure with Power BI scope
if (-not $token) {
    try {
        Write-Host "Method 2: Trying Azure authentication with Power BI scope..." -ForegroundColor Gray
        Connect-AzAccount -ErrorAction Stop
        
        $tokenResponse = Get-AzAccessToken -ResourceUrl "https://analysis.windows.net/powerbi/api" -ErrorAction Stop
        $token = $tokenResponse.Token
        $authMethod = "Azure (Power BI scope)"
        Write-Host "✓ Authenticated via Azure with Power BI scope`n" -ForegroundColor Green
    }
    catch {
        Write-Host "  Azure Power BI scope failed`n" -ForegroundColor Yellow
    }
}

if (-not $token) {
    Write-Host "✗ All authentication methods failed!" -ForegroundColor Red
    # exit
}

Write-Host "Using authentication method: $authMethod" -ForegroundColor Cyan

# ============================================================================
# TRY MULTIPLE API ENDPOINTS
# ============================================================================

Write-Host "Retrieving tenant settings..." -ForegroundColor Yellow

$response = $null
$apiEndpoint = $null

# ENDPOINT 1: Try Power BI API
try {
    Write-Host "Trying Power BI API endpoint..." -ForegroundColor Gray
    $response = Invoke-RestMethod `
        -Uri "https://api.powerbi.com/v1.0/myorg/admin/tenantsettings" `
        -Method Get `
        -Headers @{ Authorization = "Bearer $token" } `
        -ErrorAction Stop
    
    $apiEndpoint = "Power BI API"
    Write-Host "✓ Retrieved from Power BI API`n" -ForegroundColor Green
}
catch {
    Write-Host "  Power BI API failed, trying cmdlet wrapper...`n" -ForegroundColor Yellow
}

# ENDPOINT 2: Try PowerBI cmdlet wrapper
if (-not $response) {
    try {
        Write-Host "Trying PowerShell cmdlet wrapper..." -ForegroundColor Gray
        $responseJson = Invoke-PowerBIRestMethod -Url "admin/tenantsettings" -Method Get
        $response = $responseJson | ConvertFrom-Json
        $apiEndpoint = "PowerBI Cmdlet"
        Write-Host "✓ Retrieved via PowerShell cmdlet`n" -ForegroundColor Green
    }
    catch {
        Write-Host "  PowerShell cmdlet failed`n" -ForegroundColor Yellow
    }
}

if (-not $response) {
    Write-Host "✗ All API endpoints failed!" -ForegroundColor Red
    exit
}

Write-Host "✓ Successfully retrieved $($response.tenantSettings.Count) settings" -ForegroundColor Green
Write-Host "API Endpoint: $apiEndpoint`n" -ForegroundColor Cyan

# ============================================================================
# PARSE AND STRUCTURE SETTINGS
# ============================================================================

Write-Host "Processing settings..." -ForegroundColor Yellow

$allSettings = foreach ($setting in $response.tenantSettings) {
    
    # Determine who can use this setting - CLEANED UP
    $enabledFor = if ($setting.enabled -eq $true) {
        if ($setting.canSpecifySecurityGroups -eq $true) {
            if ($setting.tenantSettingGroup) {
                $groupNames = ($setting.tenantSettingGroup | ForEach-Object { $_.groupName }) -join "; "
                "Specific Groups: $groupNames"
            }
            elseif ($setting.excludedSecurityGroups) {
                $excludedNames = ($setting.excludedSecurityGroups | ForEach-Object { $_.groupName }) -join "; "
                "All except: $excludedNames"
            }
            else {
                "Entire Organization"
            }
        }
        else {
            "Entire Organization"
        }
    }
    else {
        "" # Empty instead of "Disabled" - redundant with status column
    }
    
    $delegatedTo = if ($setting.delegatedToUsers) {
        ($setting.delegatedToUsers | ForEach-Object { $_.groupName }) -join "; "
    }
    else {
        ""
    }
    
    $properties = if ($setting.properties) {
        ($setting.properties | ForEach-Object { "$($_.name): $($_.value)" }) -join "; "
    }
    else {
        ""
    }
    
    # Get category and security evaluation
    $category = Get-SettingCategory -settingName $setting.settingName
    $securityEval = Get-SecurityEvaluation -settingName $setting.settingName -title $setting.title -enabled $setting.enabled -enabledFor $enabledFor
    
    [PSCustomObject]@{
        SettingName              = $setting.settingName
        Title                    = $setting.title
        Category                 = $category
        Enabled                  = $setting.enabled
        EnabledFor               = $enabledFor
        SecurityStatus           = $securityEval.DisplayLabel
        Reason                   = $securityEval.Reason
        NeedsAction              = $securityEval.NeedsAction
        IsRisky                  = $securityEval.IsRisky
        IsCompliant              = $securityEval.IsCompliant
        RiskLevel                = $securityEval.RiskLevel
        CanSpecifySecurityGroups = $setting.canSpecifySecurityGroups
        DelegatedToUsers         = $delegatedTo
        AdditionalProperties     = $properties
        DisplayColor             = $securityEval.DisplayColor
        DisplayIcon              = $securityEval.DisplayIcon
    }
}

# ============================================================================
# EXPORT TO CSV
# ============================================================================

$csvPath = "PowerBI_TenantSettings_$timestamp.csv"
$allSettings | Select-Object SettingName, Title, Category, Enabled, EnabledFor, SecurityStatus, Reason, RiskLevel, NeedsAction, CanSpecifySecurityGroups, DelegatedToUsers, AdditionalProperties |
    Export-Csv -Path $csvPath -NoTypeInformation -Encoding UTF8

Write-Host "✓ Settings exported to CSV: $csvPath`n" -ForegroundColor Green

# ============================================================================
# ANALYSIS - Cleaner Classification
# ============================================================================

Write-Host "Analyzing security posture..." -ForegroundColor Yellow

# Count by action needed (not mutually exclusive)
$needsAttention = ($allSettings | Where-Object { $_.NeedsAction }).Count
$allOK = $allSettings.Count - $needsAttention

# Count by risk level
$highRisk = ($allSettings | Where-Object { $_.RiskLevel -eq "High" }).Count
$mediumRisk = ($allSettings | Where-Object { $_.RiskLevel -eq "Medium" }).Count
$lowRisk = ($allSettings | Where-Object { $_.RiskLevel -eq "Low" }).Count

# Count compliance issues
$nonCompliant = ($allSettings | Where-Object { -not $_.IsCompliant }).Count

# ============================================================================
# ANALYSIS - Category Summary
# ============================================================================

$categorySummary = $allSettings | Group-Object Category | ForEach-Object {
    $needsAction = ($_.Group | Where-Object { $_.NeedsAction }).Count
    $highRisk = ($_.Group | Where-Object { $_.RiskLevel -eq "High" }).Count
    $mediumRisk = ($_.Group | Where-Object { $_.RiskLevel -eq "Medium" }).Count
    
    [PSCustomObject]@{
        Category = $_.Name
        Total = $_.Count
        NeedsAttention = $needsAction
        HighRisk = $highRisk
        MediumRisk = $mediumRisk
    }
} | Sort-Object Category

# ============================================================================
# ANALYSIS - Critical Findings
# ============================================================================

$settingsNeedingAction = $allSettings | Where-Object { $_.NeedsAction }
$highRiskSettings = $allSettings | Where-Object { $_.RiskLevel -eq "High" }
$complianceIssues = $allSettings | Where-Object { -not $_.IsCompliant }

# ============================================================================
# BUILD HTML REPORT
# ============================================================================

Write-Host "Building HTML report..." -ForegroundColor Yellow

$sb = New-Object System.Text.StringBuilder

# Security metrics HTML - SIMPLIFIED
$securityMetricsHtml = @"
<div class='metric-card' style='border-left-color: #28a745;'>
    <h4>All OK</h4>
    <div class='value' style='color: #28a745;'>$allOK</div>
    <div class='subvalue'>$([Math]::Round(($allOK / $allSettings.Count) * 100, 1))% properly configured</div>
</div>
<div class='metric-card' style='border-left-color: #ffc107;'>
    <h4>Needs Attention</h4>
    <div class='value' style='color: #ffc107;'>$needsAttention</div>
    <div class='subvalue'>$([Math]::Round(($needsAttention / $allSettings.Count) * 100, 1))% require review</div>
</div>
<div class='metric-card' style='border-left-color: #dc3545;'>
    <h4>High Risk</h4>
    <div class='value' style='color: #dc3545;'>$highRisk</div>
    <div class='subvalue'>Critical security concerns</div>
</div>
<div class='metric-card' style='border-left-color: #fd7e14;'>
    <h4>Compliance Issues</h4>
    <div class='value' style='color: #fd7e14;'>$nonCompliant</div>
    <div class='subvalue'>Settings not meeting standards</div>
</div>
"@

# All settings table HTML
$allSettingsTableHtml = ($allSettings | Sort-Object Category, Title | ForEach-Object {
    $statusBadge = if ($_.Enabled) { 
        "<span style='background:#28a745; color:white; padding:3px 8px; border-radius:10px; font-size:0.75em; font-weight:600;'>ON</span>" 
    } else { 
        "<span style='background:#6c757d; color:white; padding:3px 8px; border-radius:10px; font-size:0.75em; font-weight:600;'>OFF</span>" 
    }
    
    $enabledForDisplay = if ($_.EnabledFor -eq "") { 
        "<span style='color:#999; font-size:0.85em;'>—</span>" 
    } else { 
        $_.EnabledFor 
    }
    
    "<tr>
        <td>$($_.Category)</td>
        <td><strong>$($_.Title)</strong><br><small style='color:#666;'>$($_.SettingName)</small></td>
        <td style='text-align:center;'>$statusBadge</td>
        <td style='font-size:0.9em;'>$enabledForDisplay</td>
        <td style='text-align:center;'>
            <span style='background:$($_.DisplayColor); color:white; padding:4px 12px; border-radius:12px; font-weight:600; font-size:0.85em; white-space:nowrap;'>
                $($_.DisplayIcon) $($_.SecurityStatus)
            </span>
            <br><small style='color:#666; font-size:0.8em;'>$($_.Reason)</small>
        </td>
    </tr>"
}) -join "`n"

# Settings needing action HTML
$needsActionHtml = if ($settingsNeedingAction) {
    ($settingsNeedingAction | ForEach-Object {
        $alertClass = switch ($_.RiskLevel) {
            "High" { "alert-danger" }
            "Medium" { "alert-warning" }
            default { "alert-info" }
        }
        
        "<div class='alert $alertClass'>
            <strong>$($_.DisplayIcon) $($_.Title)</strong><br>
            Status: $(if ($_.Enabled) { 'ENABLED' } else { 'DISABLED' }) | Scope: $(if ($_.EnabledFor) { $_.EnabledFor } else { 'Not applicable' })<br>
            <small>$($_.Reason)</small>
        </div>"
    }) -join "`n"
} else {
    "<div class='alert alert-success'><strong>✓ No settings require immediate attention</strong></div>"
}

# Category summary table HTML
$categorySummaryHtml = ($categorySummary | ForEach-Object {
    $alertIcon = if ($_.HighRisk -gt 0) {
        "<span style='color:#dc3545; font-weight:bold;'>🚨 $($_.HighRisk)</span>"
    } elseif ($_.MediumRisk -gt 0) {
        "<span style='color:#ffc107; font-weight:bold;'>⚠️ $($_.MediumRisk)</span>"
    } elseif ($_.NeedsAttention -gt 0) {
        "<span style='color:#17a2b8;'>ℹ️ $($_.NeedsAttention)</span>"
    } else {
        "<span style='color:#28a745;'>✓</span>"
    }
    
    "<tr>
        <td><strong>$($_.Category)</strong></td>
        <td style='text-align:center;'>$($_.Total)</td>
        <td style='text-align:center;'>$($_.NeedsAttention)</td>
        <td style='text-align:center;'>$alertIcon</td>
    </tr>"
}) -join "`n"

# Build complete HTML
[void]$sb.AppendLine(@"
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Power BI Tenant Settings Report - $reportDate</title>
    <style>
        * { margin: 0; padding: 0; box-sizing: border-box; }
        body { font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif; background: #f5f5f5; color: #333; line-height: 1.6; }
        .container { max-width: 1600px; margin: 0 auto; padding: 20px; }
        header { background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); color: white; padding: 40px; border-radius: 10px; margin-bottom: 30px; box-shadow: 0 4px 6px rgba(0,0,0,0.1); }
        header h1 { font-size: 2.5em; margin-bottom: 10px; }
        header p { font-size: 1.1em; opacity: 0.9; }
        .section { background: white; padding: 30px; border-radius: 10px; margin-bottom: 20px; box-shadow: 0 2px 4px rgba(0,0,0,0.1); }
        .section h2 { color: #667eea; border-bottom: 3px solid #667eea; padding-bottom: 10px; margin-bottom: 20px; font-size: 1.8em; }
        .section h3 { color: #764ba2; margin-top: 25px; margin-bottom: 15px; font-size: 1.3em; }
        table { width: 100%; border-collapse: collapse; margin: 20px 0; }
        th { background: #667eea; color: white; padding: 12px; text-align: left; font-weight: 600; position: sticky; top: 0; }
        td { padding: 10px 12px; border-bottom: 1px solid #e0e0e0; vertical-align: top; }
        tr:hover { background: #f8f9fa; }
        .metric-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 20px; margin: 20px 0; }
        .metric-card { background: linear-gradient(135deg, #f5f7fa 0%, #c3cfe2 100%); padding: 20px; border-radius: 8px; border-left: 4px solid #667eea; }
        .metric-card h4 { color: #555; font-size: 0.9em; margin-bottom: 10px; text-transform: uppercase; }
        .metric-card .value { font-size: 2em; font-weight: bold; color: #333; }
        .metric-card .subvalue { color: #666; fontContinue10:55-size: 0.85em; margin-top: 5px; }
.alert { padding: 15px 20px; border-radius: 8px; margin: 15px 0; border-left: 4px solid; }
.alert-danger { background: #f8d7da; border-color: #dc3545; color: #721c24; }
.alert-warning { background: #fff3cd; border-color: #ffc107; color: #856404; }
.alert-success { background: #d4edda; border-color: #28a745; color: #155724; }
.alert-info { background: #d1ecf1; border-color: #17a2b8; color: #0c5460; }
footer { text-align: center; padding: 30px; color: #666; font-size: 0.9em; }
</style>
</head>
<body>
    <div class="container">
        <header>
            <h1>⚙️ Power BI Tenant Settings Report</h1>
            <p>Generated: $reportDate</p>
            <p>Total Settings: $($allSettings.Count) | Authentication: $authMethod | API: $apiEndpoint</p>
        </header>
    <!-- SUMMARY -->
    <div class="section">
        <h2>📊 Overview</h2>
        <div class="metric-grid">
            $securityMetricsHtml
        </div>
    </div>
    
    <!-- NEEDS ATTENTION -->
    <div class="section">
        <h2>⚠️ Settings Requiring Attention ($needsAttention)</h2>
        <p>These settings should be reviewed and potentially adjusted.</p>
        $needsActionHtml
    </div>
    
    <!-- CATEGORY BREAKDOWN -->
    <div class="section">
        <h2>📁 Analysis by Category</h2>
        <table>
            <thead>
                <tr>
                    <th>Category</th>
                    <th style="text-align:center;">Total</th>
                    <th style="text-align:center;">Needs Attention</th>
                    <th style="text-align:center;">Highest Risk</th>
                </tr>
            </thead>
            <tbody>
                $categorySummaryHtml
            </tbody>
        </table>
    </div>
    
    <!-- ALL SETTINGS -->
    <div class="section">
        <h2>📋 All Tenant Settings</h2>
        <p>Complete list with security evaluation. Use Ctrl+F to search.</p>
        <table>
            <thead>
                <tr>
                    <th>Category</th>
                    <th>Setting</th>
                    <th style="text-align:center;">Status</th>
                    <th>Scope</th>
                    <th style="text-align:center; min-width:200px;">Security Evaluation</th>
                </tr>
            </thead>
            <tbody>
                $allSettingsTableHtml
            </tbody>
        </table>
    </div>
    
    <footer>
        <p>Power BI Tenant Settings Report | Generated: $reportDate</p>
        <p>CSV Export: $csvPath</p>
    </footer>
</div>
</body>
</html>
"@)
Save HTML
htmlPath = "PowerBI_TenantSettings_Report_
timestamp.html"
$sb.ToString() | Out-File -FilePath $htmlPath -Encoding UTF8

Write-Host "n========================================" -ForegroundColor Green Write-Host "✓ EXPORT COMPLETE" -ForegroundColor Green Write-Host "========================================" -ForegroundColor Green Write-Host "Authentication: $authMethod" -ForegroundColor White Write-Host "API Endpoint: $apiEndpoint" -ForegroundColor White Write-Host "Total Settings: $($allSettings.Count)" -ForegroundColor White Write-Host "All OK: $allOK" -ForegroundColor Green Write-Host "Needs Attention: $needsAttention" -ForegroundColor Yellow Write-Host "High Risk: $highRisk" -ForegroundColor Red Write-Host "Compliance Issues: $nonCompliant" -ForegroundColor Red Write-Host "nFiles created:" -ForegroundColor Cyan
Write-Host "  CSV:  $csvPath" -ForegroundColor White
Write-Host "  HTML: $htmlPath" -ForegroundColor White
Write-Host "`nOpening HTML report..." -ForegroundColor Cyan
Start-Process $htmlPath
Write-Host "`n✓ Done!" -ForegroundColor Green