)
}

#-----------------------------
# MAIN
#-----------------------------

try{
    $errorMessage = 'unable to login using AA managed identity'
    Connect-AzAccount -Identity
    Set-AzContext 'Prod'
    $appId = $null # retrieved from Key Vault
    $appSecret = $null # retrieved from Key Vault
    $tenantId = "xxxxxxx-xxxx-xxxx-xxxx-xxxxxxx" # Azure tenant
    $recipientEmail = 'wwbusinessprojects@company.com.au'
    Write-Output "recipientEmail: $recipientEmail"
    # Get the log analytics workspace
    $errorMessage = 'OperationalInsightsQuery failed'
    $workspace = Get-AzOperationalInsightsWorkspace -ResourceGroupName "rg-p-ase-securitycontrols" -Name "la-p-ase-security"
    # get all past signins for ProMapp
    $query = "SigninLogs
        | where AppId == 'xxxxxxx-xxxx-xxxx-xxxx-xxxxxxx'"
    $result = Invoke-AzOperationalInsightsQuery -Workspace $workspace -Query $query
    # sumarise user sign-ins using a hash    
    $userSignIns = @{}
    $count = 0
    foreach($signIn in $result.Results){
        $userKey = "$($signIn.UserDisplayName.Split(' ')[-1])~$($signIn.UserPrincipalName)"
        if($userSignIns.Contains($userKey)){
            $data = $userSignIns.Get_Item($userKey)
            $data += $signIn.TimeGenerated
            $userSignIns.Set_Item($userKey,$data)
        } else {
            $userSignIns.Add($userKey,@($signIn.TimeGenerated))
        }
        $count ++
    }
    <# testing
        $userSignIns
        $userSignIns.Count
    #>
    Write-Output "$count application signins"
    Write-Output "$($userSignIns.Count) unique users"
    # check for sign-ins within last 5 minutes - only check users with one sign-in
    foreach($user in $userSignIns.GetEnumerator() | Where-Object{$_.Value.Count -eq 1}){
        $time = $user.value[0]
        $timeDiff = New-TimeSpan –Start $(Get-Date) –End $time
        $newUserCount = 0
        if($timeDiff.TotalMinutes -ge -5){
            Write-Output "Processing new user: $($user.Name), $time "
            $newUserCount ++
            if(-not $appId){
                # initialisation for first user
                $errorMessage = 'unable to access Key Vault'
                $appId = Get-AzKeyVaultSecret -VaultName kv-p-ae-cloudteam -Name AzureAutomationAppId -AsPlainText # only valid for PS 5.1
                $appSecret = Get-AzKeyVaultSecret -VaultName kv-p-ae-cloudteam -Name AzureAutomationAppSecret -AsPlainText # only valid for PS 5.1
# download the company logo file from Azure storage
                $errorMessage = 'unable to download logo file from storage'
                $sa = Get-AzStorageAccount -ResourceGroupName rg-p-ae-cloudteam -Name companyaecloudteam
                $null = Get-AzStorageBlobContent -Blob 'company_logo.png' -Container 'config' -Context $($sa.Context) -Destination "$env:TEMP\cogc_logo.png" -Force
                $cogcLogo = [convert]::ToBase64String((Get-Content "$env:TEMP\company_logo.png" -Encoding Byte -ReadCount 0))
                Write-Output 'Downloaded company logo file'
                $headers = GetAccessTokenHeaders $tenantId $appId $appSecret
                if(-not $headers){
                    $errorMessage = 'GetAccessTokenHeaders failed'
                    throw $null
                }
            }
            # login was within last 5 minutes
            # get user's details
            $userEmail = $user.Name.Split('~')[-1]
            $errorMessage = 'get user details failed'
            #$resourcesUrl = "https://graph.microsoft.com/v1.0/groups/xxxxxxx-250e-417f-8694-xxxxxxxxxxxx/members/microsoft.graph.user?`$select=employeeId,&`$expand=manager(`$select=displayName,userPrincipalName,employeeId,extension_eccb56601fe44c7584b1a2134dd30bc9_cogcdirectoratedesc,extension_eccb56601fe44c7584b1a2134dd30bc9_cogcbranchdesc,extension_eccb56601fe44c7584b1a2134dd30bc9_cogcsectiondesc,jobTitle)"
            $resourcesUrl = "https://graph.microsoft.com/v1.0/users/$($userEmail)?`$select=displayName,userPrincipalName,employeeId,officeLocation,extension_eccb56601fe44c7584b1a2134dd30bc9_cogcdirectoratedesc,extension_eccb56601fe44c7584b1a2134dd30bc9_cogcbranchdesc,extension_eccb56601fe44c7584b1a2134dd30bc9_cogcsectiondesc,extension_eccb56601fe44c7584b1a2134dd30bc9_cogccostcentredesc,jobTitle&`$expand=manager"
            $response = Invoke-RestMethod -Method Get -Uri $resourcesUrl -Headers $headers -ContentType 'application/json'
            $userDetails = [PsCustomObject]@{
                Name = $response.displayName
                Payroll = $response.employeeId
                Email = $response.userPrincipalName
                Directorate = $response.extension_eccb56601fe44c7584b1a2134dd30bc9_cogcdirectoratedesc
                Branch = $response.extension_eccb56601fe44c7584b1a2134dd30bc9_cogcbranchdesc
                Department = $response.extension_eccb56601fe44c7584b1a2134dd30bc9_cogcsectiondesc
            }
            Write-Output ". Payroll: $($userDetails.Payroll)"
            Write-Output ". Email: $($userDetails.Email)"
            Write-Output ". Directorate: $($userDetails.Directorate)"
            Write-Output ". Branch: $($userDetails.Branch)"
            Write-Output ". Department: $($userDetails.Department)"
            # send email to user
            $htmlMsg = BuildMessage $userDetails 
            $MessageParams = GetMessageParams -emailFrom 'noreply@company.com.au' -emailTo $recipientEmail $htmlMsg $headers -userName $userDetails.Name
            $errorMessage = 'unable to send email'
            Invoke-RestMethod @Messageparams
            <# testing
                $MessageParams.Body.message | fl
            #>
            Write-Output 'Email notification sent'
        }
    }
} catch {
    Write-Output "ERROR: $errorMessage"
    Write-Output ". system message: $($_.Exception.Message)"
}

<# testing
    foreach($signIn in $result.Results){
        "$($signIn.UserDisplayName.Split(' ')[-1])~$($signIn.UserPrincipalName)"
    }
#>