Automate Talkdesk RingGroups → Teams Call Queue Backup

PowerShell sync script

This script reads users + RingGroups from Talkdesk and ensures the correct Azure AD group membership per mapping. Set $EnforceExactMembership to $true if you want removals when people leave a RingGroup.

📝 Copy#requires -Version 7.0
# Talkdesk → Teams DR Sync
# Last updated: 2025-08-29

$ErrorActionPreference = "Stop"

# ================== CONFIG ==================
$TD_BaseUrl      = $env:TD_BASEURL
$TD_ClientId     = $env:TD_CLIENT_ID
$TD_ClientSecret = $env:TD_CLIENT_SECRET

$TenantId     = $env:AZ_TENANT_ID
$ClientId     = $env:AZ_APP_ID
$ClientSecret = $env:AZ_APP_SECRET

$MappingPath  = "C:\\TD2Teams\\rg-to-groupid.json"
$EnforceExactMembership = $true

# ================== HELPERS ==================
function Get-TalkdeskToken {
  param([string]$Scope = "users:read ring-groups:read user-ring-groups:read")
  $body = @{ grant_type="client_credentials"; client_id=$TD_ClientId; client_secret=$TD_ClientSecret; scope=$Scope }
  $token = Invoke-RestMethod -Method Post -Uri "$TD_BaseUrl/oauth/token" -Body $body
  return $token.access_token
}

function Get-TalkdeskUsersWithRingGroups {
  param([string]$AccessToken)
  $headers = @{ Authorization = "Bearer $AccessToken" }

  # Preferred: Guardian Users list endpoint includes ring_groups per user.
  $guardianUrlCandidates = @(
    "$TD_BaseUrl/guardian/users",
    "$TD_BaseUrl/v1/guardian/users"
  )

  foreach ($u in $guardianUrlCandidates) {
    try {
      $res = Invoke-RestMethod -Headers $headers -Uri $u -Method Get -ErrorAction Stop
      if ($res) { return $res }
    } catch { }
  }

  # Fallback: enumerate RingGroups then members
  $rgList = Invoke-RestMethod -Headers $headers -Uri "$TD_BaseUrl/ring-groups" -Method Get
  $byUser = @{}
  foreach ($rg in $rgList._embedded.ring_groups) {
    $rgName = $rg.name
    $usersInRg = Invoke-RestMethod -Headers $headers -Uri "$TD_BaseUrl/ring-groups/$($rg.id)/users" -Method Get
    foreach ($u in $usersInRg._embedded.users) {
      if (-not $byUser.ContainsKey($u.id)) { $byUser[$u.id] = [ordered]@{ email=$u.email; ring_groups=@() } }
      $byUser[$u.id].ring_groups += $rgName
    }
  }
  return ($byUser.GetEnumerator() | ForEach-Object { $_.Value })
}

function Connect-GraphApp {
  $SecureSecret = (ConvertTo-SecureString $ClientSecret -AsPlainText -Force)
  Connect-MgGraph -TenantId $TenantId -ClientId $ClientId -ClientSecret $SecureSecret -NoWelcome | Out-Null
  Select-MgProfile -Name "v1.0" | Out-Null
}

function Ensure-GroupMembership {
  param(
    [Parameter(Mandatory=$true)] [string]$GroupId,
    [Parameter(Mandatory=$true)] [string[]]$TargetUserObjectIds,
    [bool]$Enforce = $false
  )
  $members = Get-MgGroupMember -GroupId $GroupId -All
  $currentIds = $members.Id

  $toAdd = $TargetUserObjectIds | Where-Object { $_ -and -not ($currentIds -contains $_) }
  foreach ($id in $toAdd) {
    New-MgGroupMemberByRef -GroupId $GroupId -BodyParameter @{ "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$id" } | Out-Null
  }

  if ($Enforce) {
    $toRemove = $currentIds | Where-Object { $_ -and -not ($TargetUserObjectIds -contains $_) }
    foreach ($id in $toRemove) {
      Remove-MgGroupMemberByRef -GroupId $GroupId -DirectoryObjectId $id -Confirm:$false | Out-Null
    }
  }
}

# ================== MAIN ==================
# Install modules once (uncomment on first run):
# Install-Module Microsoft.Graph -Scope AllUsers -Force
# Import-Module Microsoft.Graph

Write-Host "Acquiring Talkdesk token..."
$tdToken = Get-TalkdeskToken

Write-Host "Fetching users & RingGroups from Talkdesk..."
$tdUsers = Get-TalkdeskUsersWithRingGroups -AccessToken $tdToken  # expects .email and .ring_groups

Write-Host "Loading RG→Group mapping..."
$rgMap = Get-Content $MappingPath | ConvertFrom-Json

Write-Host "Connecting to Microsoft Graph (app-only)..."
Connect-GraphApp

# Resolve emails to Azure AD object IDs and bucket by RingGroup
$desired = @{}
foreach ($rgName in $rgMap.PSObject.Properties.Name) { $desired[$rgName] = New-Object System.Collections.Generic.HashSet[string] }

foreach ($u in $tdUsers) {
  $email = $u.email
  if (-not $email) { continue }
  try {
    $aadUser = Get-MgUser -Filter "mail eq '$email' or userPrincipalName eq '$email'" -ConsistencyLevel eventual -CountVariable ct
    if ($aadUser) {
      foreach ($rg in ($u.ring_groups | Where-Object { $_ })) {
        if ($desired.ContainsKey($rg)) { $null = $desired[$rg].Add($aadUser.Id) }
      }
    } else {
      Write-Warning "No AAD user for $email"
    }
  } catch {
    Write-Warning "Lookup failed for $email: $($_.Exception.Message)"
  }
}

# Apply desired membership
foreach ($rgName in $rgMap.PSObject.Properties.Name) {
  $groupId = $rgMap.$rgName
  $objectIds = @($desired[$rgName])
  Write-Host "Syncing '$rgName' → Group $groupId (target members: $($objectIds.Count))"
  Ensure-GroupMembership -GroupId $groupId -TargetUserObjectIds $objectIds -Enforce:$EnforceExactMembership
}

Write-Host "TD → Teams sync complete."

📝 Copy$audit = foreach ($u in $tdUsers) {
  [pscustomobject]@{
    Email       = $u.email
    RingGroups  = ($u.ring_groups -join "; ")
  }
}
$path = "C:\\TD2Teams\\audit-$(Get-Date -Format yyyyMMdd-HHmm).csv"
$audit | Export-Csv -NoTypeInformation -Encoding UTF8 -Path $path
Write-Host "Wrote audit: $path"