Get-IntuneNetworkRequirements.ps1

#Requires -Version 7.0
<#
.SYNOPSIS
This script will test network connections to various Intune services using PowerShell 7
.DESCRIPTION
Welcome to the first release of INR - Intune Network Requirements. This script will allow you to test several different service areas 
related to Intune. The main way this script is intended to run is not once, but at least **twice**.
**Requirements
* PowerShell 7
* RTFM https://manima.de/2024/08/intune-network-requirements-everything-i-learned/
* Admin rights (if you want to test your currently set NTP server)

Instructions:
1. Run the script on an unmanaged network, but ideally close to you or on the same provider.
2. Run the script using the same parameters on your managed network where you're experiencing issues
3. Run the script again (if necessary) to compare the two results and get a difference between the results.

This is the only way to reliably verify results. It is not possible to deterministically test the endpoints because there is no
documentation of which endpoint has which responses.
.PARAMETER TestAllServiceAreas
Specifies whether to test all target services.
.PARAMETER UseMSJSON
Specifies whether to use MSJSON for network requests.
.PARAMETER UseMS365JSON
Specifies whether to use MS365JSON for network requests. 
.PARAMETER CustomURLFile
Recommended. Put this file next to the script. Specifies the path to the CSV file containing the URLs, ports, and protocols to test. The default value is "INRCustomList.csv".
.PARAMETER AllowBestEffort
Recommended. Specifies whether to allow best effort testing (will try to resolve wildcard URLs) for URLs that don't have an exact match. 
.PARAMETER CheckCertRevocation
Recommended. Will verify if certificates that are presented by URLs are verified. This parameter _requires_ either -UseMSJSON, -UseMS365JSON or -CustomURLFile.
That is because the switch requires that one of following IDs is available: 
125 = Common CRLs (available in MSJson and MS365JSON)
84 = Microsoft CRLs (available in MSJson and MS365JSON)
9993 = Custom CRLs (from INRCustomList.csv). If your custom list does not contain this ID, certificate revocation checks will not be possible.
.PARAMETER GCC
Will test the GCC specific URLs - this related to RemoteHelp and Device Health currently.
.PARAMETER Intune
Specifies whether to test all of the Intune service area (this merges a lot of different areas).
.PARAMETER Autopilot
Specifies whether to test all of the Autopilot service area (this merges a lot of different areas).
.PARAMETER WindowsActivation
Specifies whether to test the Windows Activation service area.
.PARAMETER EntraID
Specifies whether to test the EntraID service area.
.PARAMETER WindowsUpdate
Specifies whether to test the Windows Update service area.
.PARAMETER DeliveryOptimization
Specifies whether to test the Delivery Optimization service area.
.PARAMETER NTP
Specifies whether to test the NTP service area.
.PARAMETER DNS
Warning: This is not put into the result CSV. It will be available in the log. Specifies whether to test the DNS service area.
.PARAMETER DiagnosticsData
Specifies whether to test the Diagnostics Data service area.
.PARAMETER DiagnosticsDataUpload
Specifies whether to test the Diagnostics Data Upload service area.
.PARAMETER NCSI
Specifies whether to test the NCSI service area.
.PARAMETER WindowsNotificationService
Specifies whether to test the WindowsNotificationService service area.
.PARAMETER WindowsStore
Specifies whether to test the Windows Store service area.
.PARAMETER M365
Warning: This is a _lot_ of URLs and will run for a couple minutes. Specifies whether to test the M365 service area.
.PARAMETER CRLs
Specifies whether to test the CRLs service area. These are the well known CRLs by Microsoft, plus my own if you import the CSV.
.PARAMETER SelfDeploying
Specifies whether to test the self-deploying service area.
.PARAMETER RemoteHelp
Specifies whether to test the Remote Help service area.
.PARAMETER TPMAttestation
Specifies whether to test the TPM attestation service area.
.PARAMETER DeviceHealth
Specifies whether to test the device health service area.
.PARAMETER Apple
Specifies whether to test the Apple (iOS/iPadOS) service area.
.PARAMETER Android
Specifies whether to test the Android (Google) service area.
.PARAMETER EndpointAnalytics
Specifies whether to test the Endpoint Analytics service area.
.PARAMETER AppInstaller
Specifies whether to test the app installer (winget) service area.
.PARAMETER UniversalPrint
Specifies whether to test the universal print service area.
.PARAMETER ConnectedCache
Specifies whether to test the connected cache service area. Not included in TestAllServiceAreas.
.PARAMETER VisualStudioFull
Specifies whether to test all Visual Studio services. Not included in TestAllServiceAreas.
.PARAMETER VisualStudioInstallation
Will test all required endpoints for Visual Studio installation. Not included in TestAllServiceAreas.
.PARAMETER DefenderFull
Specifies whether to test the Defender Full service area. Not included in TestAllServiceAreas.
.PARAMETER DefenderOptional
Specifies whether to test the Defender Optional service area. Not included in TestAllServiceAreas.
.PARAMETER DefenderLiveResponse
Specifies whether to test the Defender Live Response service area. Not included in TestAllServiceAreas.
.PARAMETER DefenderVulnTool
Specifies whether to test the Defender Vulnerability Management service area. Not included in TestAllServiceAreas.
.PARAMETER DefenderSmartScreen
Specifies whether to test the Defender SmartScreen service area. Not included in TestAllServiceAreas.
.PARAMETER AppAndScript
Specifies whether to test the deployment domains for Win32, Windows script, macOS app and macOS script deployment.
.PARAMETER NuGet
Specifies whether to test for PowerShell Gallery with the default NuGet provider.
.PARAMETER TrustMeBro
Tests custom URL entries with ID 10000. This Custom-only test cannot be combined with another Artificial Service Area or Product and is not included in TestAllServiceAreas.
.PARAMETER AuthenticatedProxyOnly
Will test if there is an authenticated proxy in use - does not test other service areas.
.PARAMETER TestSSLInspectionOnly
Will test if there is any sort of SSL inspection - does not test other service areas.
.PARAMETER Legacy
This is not implemented yet. Specifies whether to test legacy service.
.PARAMETER TenantName
This must be specified if you want some of the M365 URLS to be populated automatically. This is the first part of your first <tenantname>.onmicrosoft.com
.PARAMETER MaxDelayInMS
Default: 300ms. This is my recommended value because some addresses tend to respond slowly.
.PARAMETER BurstMode
Will use the MaxDelayInMs, divide it into 50ms chunks and then do a quick test. Use this to find out response times.
.PARAMETER BrienMode
This mode allows you to run the script multiple times in succession and automatically merge the results. This can be used to 
change network settings in between running the script with the same parameters. The last two results will be compared. Recommended
value: 2
.PARAMETER ProxyMode
Controls which connection routes are tested. Auto tests a direct connection and every distinct proxy detected from environment variables,
Windows Settings, and WinHTTP. Direct bypasses configured proxies. CurrentUser, WinHTTP, and Environment test only that source.
.PARAMETER MergeResults
Will trigger the result merge path. If two CSV files are in the working directory, it will merge those. Otherwise use -MergeCSVs.
.PARAMETER MergeShowAllResults
Will merge _all_ results not just differences.
.PARAMETER MergeCSVs
This will accept two CSV filesnames as strings. The files must be placed next to the script or the working directory (if specified differently).
.PARAMETER NoLog
Specifies whether to disable logging. This is a switch parameter.
.PARAMETER TestMethods
This is not implemented yet. This allows you to chose the test methods that the script will go through.
.PARAMETER OutputCSV
Output the results to a CSV file. This is not enabled by default. This is a recommended default switch.
.PARAMETER ShowResults
Shows the results in an Out-Gridview.
.PARAMETER ToConsole
Specifies whether to output log messages to the console. Enabling this won't create a log.
.PARAMETER WorkingDirectory
Specifies the working directory where the script will be executed. The default value is "C:\INR\".
.PARAMETER LogDirectory
Specifies the directory where log files will be stored. The default value is "C:\INR\".
.EXAMPLE
This example will use the MS-JSON for MEM, ingest the custom CSV if it exists in the same folder, allow wildcard 
handling in URLS, check the CRLs of each certificate provided for the ASA TPM Attestation. The script will run twice, 
asking you to change the network environment in between (e.g. from home to VPN), and then display all the results 
of each pass and the merged results of the last two results.
.\Get-IntuneNetworkRequirements.ps1 -UseMSJSON -AllowBestEffort -CheckCertRevocation -ShowResults -TPMAttestation -BrienMode 2
.EXAMPLE
This example will use the MS-JSON for MEM, my custom CSV, allow for wildcard handling in URLS, check 
the CRLs of each certificate provided for the ASA TPMAttestation and then display the results in a grid, 
while displaying potential issues in the console for the service area TPMAttestation. 
.\Get-IntuneNetworkRequirements.ps1 -UseMSJSON -CustomURLFile '.\INRCustomList.csv' -AllowBestEffort -CheckCertRevocation -TPMAttestation -ShowResults -ToConsole
.EXAMPLE
This will ingest 2 files from the working directory and compare them. The comparison is written to another CSV file while also showing the results in a grid view. 
.\Get-IntuneNetworkRequirements.ps1 -MergeResults -MergeCSVs ResultList_29072024_110030_SADAME-PC.csv,ResultList_30072024_084101_3T0M4W3.csv -ShowResults
.EXAMPLE
This will test all Visual Studio endpoints and verify each CRL. It will output the results in a CSV file and show the results in a gridview.
.\Get-IntuneNetworkRequirements.ps1 -CustomURLFile .\VisualStudio.csv -UseMSJSON -CheckCertRevocation -VisualStudioFull -OutputCSV -ShowResults
.EXAMPLE
This will test all Defender endpoints and verify each CRL. It will output the results in a CSV file and show the results in a gridview.
.\Get-IntuneNetworkRequirements.ps1 -CustomURLFile .\MicrosoftDefender.csv -UseMSJSON -CheckCertRevocation -DefenderFull -OutputCSV -ShowResults
.NOTES
    Version: 1.4.0
    Versionname: Community-Is-Key
    Intial creation date: 19.02.2024
    Last change date: 03.11.2025
    Latest changes: https://github.com/MHimken/toolbox/tree/main/Autopilot/MEMNetworkRequirements/changelog.md
    Shoutouts: 
    * WinAdmins Community - especially Chris for helping me figure out some of the features.
    * badssl.com and httpstat.us are awesome!
#>

[CmdletBinding()]
param(
    #Main modes
    [Parameter(ParameterSetName = 'AllAreas', Position = 1, Mandatory)]
    [Parameter(ParameterSetName = 'TestMSJSON', Position = 0, Mandatory)]
    [switch]$UseMSJSON,

    [Parameter(ParameterSetName = 'AllAreas', Position = 2, Mandatory)]
    [Parameter(ParameterSetName = 'TestMS365JSON', Position = 0, Mandatory)]
    [switch]$UseMS365JSON,

    [Parameter(ParameterSetName = 'AllAreas')]
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestMS365JSON')]
    [Parameter(ParameterSetName = 'TestCustom', Position = 0, Mandatory)]
    [Parameter(ParameterSetName = 'TrustMeBroOnly', Mandatory)]
    [string]$CustomURLFile,

    [Parameter(ParameterSetName = 'AllAreas', Position = 0, Mandatory)]
    [switch]$TestAllServiceAreas,
    
    #Options
    [Parameter(ParameterSetName = 'AllAreas')]
    [Parameter(ParameterSetName = 'TestMSJSON', Position = 1)]
    [Parameter(ParameterSetName = 'TestMS365JSON')]
    [Parameter(ParameterSetName = 'TestCustom', Position = 1)]
    [Parameter(ParameterSetName = 'TrustMeBroOnly')]
    [switch]$AllowBestEffort,

    [Parameter(ParameterSetName = 'AllAreas')]
    [Parameter(ParameterSetName = 'TestMSJSON', Position = 2)]
    [Parameter(ParameterSetName = 'TestMS365JSON')]
    [Parameter(ParameterSetName = 'TestCustom', Position = 2)]
    [Parameter(ParameterSetName = 'TrustMeBroOnly')]
    [switch]$CheckCertRevocation,

    [Parameter(ParameterSetName = 'AllAreas')]
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$GCC,

    #Artificial Service Areas
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$Intune,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$Autopilot,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$WindowsActivation,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$EntraID,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$WindowsUpdate,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$DeliveryOptimization,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$NTP,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$DNS,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$DiagnosticsData,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$DiagnosticsDataUpload,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$NCSI,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$WindowsNotificationService,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$WindowsStore,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestMS365JSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$M365,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$CRLs,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$SelfDeploying,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$RemoteHelp,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$TPMAttestation,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$DeviceHealth,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$Apple,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$Android,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$EndpointAnalytics,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$AppInstaller,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$UniversalPrint,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$AppAndScript,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$NuGet,

    [Parameter(ParameterSetName = 'TrustMeBroOnly')]
    [switch]$TrustMeBro,

    #Products
    #Connected Cache
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$ConnectedCache,
    #Visual Studio
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$VisualStudioFull,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$VisualStudioInstallation,
    #Defender
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$DefenderFull,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$DefenderOptional,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$DefenderLiveResponse,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$DefenderVulnTool,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$DefenderSmartScreen,

    #Not Service area specific
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$AuthenticatedProxyOnly,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$TestSSLInspectionOnly,
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$Legacy,
    
    #Special Methods
    [Parameter(ParameterSetName = 'AllAreas', Mandatory)]
    [Parameter(ParameterSetName = 'TestMS365JSON', Mandatory)]
    [string]$TenantName,
    [Parameter(ParameterSetName = 'AllAreas')]
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestMS365JSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [Parameter(ParameterSetName = 'TrustMeBroOnly')]
    [int]$MaxDelayInMS = 300, # 300 is the minimum recommended due to some Microsoft services being heavy load (like MS Update)
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestMS365JSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [Parameter(ParameterSetName = 'TrustMeBroOnly')]
    [switch]$BurstMode, # Divide the delay by 50 and try different speeds. Give warning when more than 10 URLs are tested
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestMS365JSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [Parameter(ParameterSetName = 'TrustMeBroOnly')]
    [int]$BrienMode,

    [Parameter(ParameterSetName = 'AllAreas')]
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestMS365JSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [Parameter(ParameterSetName = 'TrustMeBroOnly')]
    [ValidateSet('Auto', 'Direct', 'CurrentUser', 'WinHTTP', 'Environment')]
    [string]$ProxyMode = 'Auto',

    #Merge options
    [Parameter(ParameterSetName = 'Merge', Position = 0)]
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestMS365JSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$MergeResults,
    [Parameter(ParameterSetName = 'Merge')]
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestMS365JSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [switch]$MergeShowAllResults,
    [Parameter(ParameterSetName = 'Merge')]
    [string[]]$MergeCSVs,

    #Output options
    [Parameter(ParameterSetName = 'AllAreas')]
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestMS365JSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [Parameter(ParameterSetName = 'Merge')]
    [Parameter(ParameterSetName = 'TrustMeBroOnly')]
    [switch]$OutputCSV,
    [Parameter(ParameterSetName = 'AllAreas')]
    [Parameter(ParameterSetName = 'TestMSJSON')]
    [Parameter(ParameterSetName = 'TestMS365JSON')]
    [Parameter(ParameterSetName = 'TestCustom')]
    [Parameter(ParameterSetName = 'Merge')]
    [Parameter(ParameterSetName = 'TrustMeBroOnly')]
    [switch]$ShowResults,
    #Common parameters
    [switch]$NoOutput,
    [switch]$ToConsole,
    [System.IO.DirectoryInfo]$WorkingDirectory,
    [System.IO.DirectoryInfo]$LogDirectory
)

#Preparation
if ($CheckCertRevocation -and -not($UseMSJSON -or $UseMS365JSON -or (Get-Content $CustomURLFile | Where-Object { $_ -match '9993' }))) {
    Write-Output "If you want to check certificate revocation, please specify at least one source of URLs (-UseMSJSON, -UseMS365JSON or -CustomURLFile). Exiting script." -ForegroundColor Red
    exit 1
}
function Get-ScriptPath {
    <#
    .SYNOPSIS
    Get the current script path.
    #>
    if ($PSScriptRoot) { 
        # Console or VS Code debug/run button/F5 temp console
        $ScriptRoot = $PSScriptRoot 
    } else {
        if ($psISE) { 
            Split-Path -Path $psISE.CurrentFile.FullPath
        } else {
            if ($profile -match 'VScode') { 
                # VS Code "Run Code Selection" button/F8 in integrated console
                $ScriptRoot = Split-Path $psEditor.GetEditorContext().CurrentFile.Path 
            } else { 
                Write-Output 'unknown directory to set path variable. exiting script.'
                exit
            } 
        } 
    }
    $Script:PathToScript = $ScriptRoot
}
function ConvertTo-ProxyUri {
    param(
        [string]$ProxyList,
        [ValidateSet('http', 'https')]
        [string]$Scheme = 'https'
    )
    if ([string]::IsNullOrWhiteSpace($ProxyList)) {
        return $null
    }
    $ProxyValue = $null
    foreach ($Entry in $ProxyList -split ';') {
        $Entry = $Entry.Trim()
        if ($Entry -match '^(?<Scheme>https?|socks|socks4|socks5)=(?<Proxy>.+)$') {
            if ($Matches.Scheme -eq $Scheme) {
                $ProxyValue = $Matches.Proxy
                break
            }
        } elseif (-not($ProxyValue)) {
            $ProxyValue = $Entry
        }
    }
    if ([string]::IsNullOrWhiteSpace($ProxyValue)) {
        return $null
    }
    if ($ProxyValue -notmatch '^[a-z][a-z0-9+.-]*://') {
        $ProxyValue = "http://$ProxyValue"
    }
    try {
        $ProxyUri = [uri]$ProxyValue
        if ($ProxyUri.Scheme -notin 'http', 'https') {
            Write-Log -Message "Ignoring unsupported $($ProxyUri.Scheme) proxy '$ProxyValue'" -Component 'ProxyDiscovery' -Type 2
            return $null
        }
        return $ProxyUri
    } catch {
        Write-Log -Message "Ignoring invalid proxy value '$ProxyValue'" -Component 'ProxyDiscovery' -Type 2
        return $null
    }
}
function Test-ProxyBypass {
    param(
        [uri]$TargetUri,
        [string]$BypassList
    )
    if ([string]::IsNullOrWhiteSpace($BypassList)) {
        return $false
    }
    foreach ($Entry in $BypassList -split '[;,]') {
        $Pattern = $Entry.Trim()
        if (-not($Pattern)) {
            continue
        }
        if ($Pattern -eq '<local>' -and $TargetUri.Host -notmatch '\.') {
            return $true
        }
        $Pattern = $Pattern -replace '^\.?\*', '*'
        if ($TargetUri.Host -like $Pattern -or $TargetUri.AbsoluteUri -like $Pattern) {
            return $true
        }
    }
    return $false
}
function Get-EnvironmentProxyConfiguration {
    param([ValidateSet('http', 'https')][string]$Scheme = 'https')
    $ProxyValue = $null
    $ProxyVariable = $null
    foreach ($Name in @("$($Scheme.ToUpperInvariant())_PROXY", 'ALL_PROXY')) {
        foreach ($Scope in @('Process', 'User', 'Machine')) {
            $Value = [Environment]::GetEnvironmentVariable($Name, $Scope)
            if ($Value) {
                $ProxyValue = $Value
                $ProxyVariable = "$Name ($Scope)"
                break
            }
        }
        if ($ProxyValue) {
            break
        }
    }
    if (-not($ProxyValue)) {
        return $null
    }
    $NoProxy = $null
    foreach ($Scope in @('Process', 'User', 'Machine')) {
        $NoProxy = [Environment]::GetEnvironmentVariable('NO_PROXY', $Scope)
        if ($NoProxy) {
            break
        }
    }
    [PSCustomObject]@{
        Source       = 'Environment'
        ProxyUri     = ConvertTo-ProxyUri -ProxyList $ProxyValue -Scheme $Scheme
        BypassList   = $NoProxy
        Configuration = $ProxyVariable
    }
}
function Get-WindowsProxyConfigurations {
    if (-not('INR.NativeProxy' -as [type])) {
        Add-Type -TypeDefinition @'
using System;
using System.Runtime.InteropServices;

namespace INR {
    public static class NativeProxy {
        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
        private struct IEProxyConfig {
            [MarshalAs(UnmanagedType.Bool)] public bool AutoDetect;
            public IntPtr AutoConfigUrl;
            public IntPtr Proxy;
            public IntPtr ProxyBypass;
        }

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
        private struct ProxyInfo {
            public int AccessType;
            public IntPtr Proxy;
            public IntPtr ProxyBypass;
        }

        [DllImport("winhttp.dll", SetLastError = true, CharSet = CharSet.Unicode)]
        private static extern bool WinHttpGetIEProxyConfigForCurrentUser(out IEProxyConfig config);

        [DllImport("winhttp.dll", SetLastError = true, CharSet = CharSet.Unicode)]
        private static extern bool WinHttpGetDefaultProxyConfiguration(out ProxyInfo config);

        [DllImport("kernel32.dll")]
        private static extern IntPtr GlobalFree(IntPtr memory);

        private static string ReadAndFree(IntPtr value) {
            if (value == IntPtr.Zero) return null;
            string result = Marshal.PtrToStringUni(value);
            GlobalFree(value);
            return result;
        }

        public static string[] GetCurrentUser() {
            IEProxyConfig config;
            if (!WinHttpGetIEProxyConfigForCurrentUser(out config)) return null;
            return new[] {
                ReadAndFree(config.Proxy),
                ReadAndFree(config.ProxyBypass),
                ReadAndFree(config.AutoConfigUrl),
                config.AutoDetect.ToString()
            };
        }

        public static string[] GetWinHttp() {
            ProxyInfo config;
            if (!WinHttpGetDefaultProxyConfiguration(out config)) return null;
            return new[] { ReadAndFree(config.Proxy), ReadAndFree(config.ProxyBypass) };
        }
    }
}
'@
    }
    $CurrentUser = [INR.NativeProxy]::GetCurrentUser()
    $WinHttp = [INR.NativeProxy]::GetWinHttp()
    [PSCustomObject]@{
        CurrentUser = if ($CurrentUser) {
            [PSCustomObject]@{
                Source        = 'CurrentUser'
                ProxyList     = $CurrentUser[0]
                BypassList    = $CurrentUser[1]
                AutoConfigUrl = $CurrentUser[2]
                AutoDetect    = $CurrentUser[3] -eq 'True'
            }
        } else { $null }
        WinHTTP = if ($WinHttp) {
            [PSCustomObject]@{
                Source     = 'WinHTTP'
                ProxyList  = $WinHttp[0]
                BypassList = $WinHttp[1]
            }
        } else { $null }
    }
}
function Get-ProxyRoutes {
    param(
        [uri]$TargetUri,
        [ValidateSet('Auto', 'Direct', 'CurrentUser', 'WinHTTP', 'Environment')]
        [string]$Mode = $ProxyMode
    )
    $Routes = [System.Collections.Generic.List[object]]::new()
    if ($Mode -in 'Auto', 'Direct') {
        $Routes.Add([PSCustomObject]@{
            ConnectionMethod = 'Direct'
            ProxyAddress     = $null
            ProxyBypassed    = $false
            Configuration    = 'Explicit direct connection'
        })
    }
    $Scheme = if ($TargetUri.Scheme -eq 'http') { 'http' } else { 'https' }
    $WindowsProxy = if ($Mode -in 'Auto', 'CurrentUser', 'WinHTTP') { Get-WindowsProxyConfigurations } else { $null }
    $Configurations = @()
    if ($Mode -in 'Auto', 'Environment') {
        $EnvironmentProxy = Get-EnvironmentProxyConfiguration -Scheme $Scheme
        if ($EnvironmentProxy) {
            $Configurations += $EnvironmentProxy
        }
    }
    if ($Mode -in 'Auto', 'CurrentUser' -and $WindowsProxy.CurrentUser) {
        $CurrentUserProxyUri = ConvertTo-ProxyUri -ProxyList $WindowsProxy.CurrentUser.ProxyList -Scheme $Scheme
        if (-not($CurrentUserProxyUri) -and ($WindowsProxy.CurrentUser.AutoConfigUrl -or $WindowsProxy.CurrentUser.AutoDetect)) {
            try {
                $ResolvedProxyUri = [System.Net.WebRequest]::GetSystemWebProxy().GetProxy($TargetUri)
                if ($ResolvedProxyUri -and $ResolvedProxyUri.AbsoluteUri -ne $TargetUri.AbsoluteUri) {
                    $CurrentUserProxyUri = $ResolvedProxyUri
                }
            } catch {
                Write-Log -Message "Current-user automatic proxy resolution failed for $TargetUri`: $($_.Exception.Message)" -Component 'ProxyDiscovery' -Type 2
            }
        }
        $Configurations += [PSCustomObject]@{
            Source        = 'CurrentUser'
            ProxyUri      = $CurrentUserProxyUri
            BypassList    = $WindowsProxy.CurrentUser.BypassList
            Configuration = if ($WindowsProxy.CurrentUser.AutoConfigUrl) { "PAC: $($WindowsProxy.CurrentUser.AutoConfigUrl)" } elseif ($WindowsProxy.CurrentUser.AutoDetect) { 'WPAD enabled' } else { 'Windows Settings' }
        }
    }
    if ($Mode -in 'Auto', 'WinHTTP' -and $WindowsProxy.WinHTTP) {
        $Configurations += [PSCustomObject]@{
            Source        = 'WinHTTP'
            ProxyUri      = ConvertTo-ProxyUri -ProxyList $WindowsProxy.WinHTTP.ProxyList -Scheme $Scheme
            BypassList    = $WindowsProxy.WinHTTP.BypassList
            Configuration = 'WinHTTP default proxy'
        }
    }
    $RouteKeys = [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
    foreach ($Configuration in $Configurations) {
        if (-not($Configuration.ProxyUri)) {
            continue
        }
        $ProxyBypassed = Test-ProxyBypass -TargetUri $TargetUri -BypassList $Configuration.BypassList
        $RouteKey = "$($Configuration.ProxyUri.AbsoluteUri.TrimEnd('/'))|$ProxyBypassed"
        if ($Mode -eq 'Auto' -and -not($RouteKeys.Add($RouteKey))) {
            Write-Log -Message "Skipping duplicate $($Configuration.Source) proxy route $($Configuration.ProxyUri)" -Component 'ProxyDiscovery'
            continue
        }
        $Routes.Add([PSCustomObject]@{
            ConnectionMethod = $Configuration.Source
            ProxyAddress     = $Configuration.ProxyUri.AbsoluteUri.TrimEnd('/')
            ProxyBypassed    = $ProxyBypassed
            Configuration    = $Configuration.Configuration
        })
    }
    if (-not($Routes.Count)) {
        throw "ProxyMode '$Mode' did not resolve to an available proxy configuration for $TargetUri."
    }
    return $Routes
}
function Invoke-RoutedWebRequest {
    param(
        [uri]$Uri,
        [ValidateSet('Get', 'Head')]
        [string]$Method = 'Get',
        [switch]$SkipHttpErrorCheck
    )
    $Errors = [System.Collections.Generic.List[string]]::new()
    foreach ($Route in Get-ProxyRoutes -TargetUri $Uri) {
        $Parameters = @{
            Uri                      = $Uri
            Method                   = $Method
            ConnectionTimeoutSeconds = [Math]::Max(1, [Math]::Ceiling($MaxDelayInMS / 100))
        }
        if ($SkipHttpErrorCheck) {
            $Parameters.SkipHttpErrorCheck = $true
        }
        if ($Route.ConnectionMethod -eq 'Direct' -or $Route.ProxyBypassed) {
            $Parameters.NoProxy = $true
        } else {
            $Parameters.Proxy = $Route.ProxyAddress
        }
        try {
            return [PSCustomObject]@{
                Response = Invoke-WebRequest @Parameters
                Route    = $Route
            }
        } catch {
            $Errors.Add("$($Route.ConnectionMethod): $($_.Exception.Message)")
            Write-Log -Message "Request to $Uri failed using $($Route.ConnectionMethod): $($_.Exception.Message)" -Component 'RoutedWebRequest' -Type 2
        }
    }
    throw "Request to $Uri failed using every selected route: $($Errors -join '; ')"
}
function Initialize-Script {
    <#
    .SYNOPSIS
    Will initialize most of the required variables throughout this script.
    #>
    #Prepare environment
    Get-ScriptPath
    $Script:DateTime = Get-Date -Format yyyyMMdd_HHmmss
    if (-not($Script:CurrentLocation)) {
        $Script:CurrentLocation = Get-Location
    }
    if (-not($WorkingDirectory)) {
        $WorkingDirectory = $Script:PathToScript
    } else {
        if (-not(Test-Path $WorkingDirectory )) { New-Item $WorkingDirectory -ItemType Directory -Force | Out-Null }
    }
    if ((Get-Location).path -ne $WorkingDirectory) {
        Set-Location $WorkingDirectory
    }
    if (-not($LogDirectory)) {
        $LogDirectory = Join-Path -Path $WorkingDirectory -ChildPath "Logs"
    }
    if (-not(Test-Path $LogDirectory )) { New-Item $LogDirectory -ItemType Directory -Force | Out-Null }
    if ($OutputCSV) {
        $Script:OutpathFilePath = $(Join-Path $WorkingDirectory -ChildPath "TestResults")
        if (-not(Test-Path $Script:OutpathFilePath)) { New-Item $Script:OutpathFilePath -ItemType Directory -Force | Out-Null }
    }
    if (-not($Script:LogFile)) {
        $LogPrefix = 'INR'
        $Script:LogFile = Join-Path -Path $LogDirectory -ChildPath ('{0}_{1}.log' -f $LogPrefix, $Script:DateTime)
        if (-not(Test-Path $LogDirectory)) { New-Item $LogDirectory -ItemType Directory -Force | Out-Null }
    }
    if ($PSVersionTable.psversion.major -lt 7) {
        Write-Log -Message 'Please follow the manual - PowerShell 7 is currently required to run this script.' -Component 'InitializeScript' -Type 3
        Exit 1
    }

    #Create lists
    $Script:GUID = (New-Guid).Guid
    $Script:M365ServiceURLs = [System.Collections.ArrayList]::new()
    $Script:WildCardURLs = [System.Collections.ArrayList]::new()
    $Script:CRLURLsToCheck = [System.Collections.ArrayList]::new()
    $Script:URLsToVerify = [System.Collections.ArrayList]::new()
    $Script:DNSCache = [System.Collections.ArrayList]::new()
    $Script:TCPCache = [System.Collections.ArrayList]::new()
    if ($Script:FinalResultList) {
        Get-Variable FinalResultList | Clear-Variable 
    }
    $Script:FinalResultList = [System.Collections.ArrayList]::new()
    try {
        $ExternalIPRequest = Invoke-RoutedWebRequest -Uri 'https://geo-prod.do.dsp.mp.microsoft.com/geo'
        $Script:ExternalIP = (ConvertFrom-Json $ExternalIPRequest.Response.Content).ExternalIpAddress
        Write-Log -Message "External IP: $($Script:ExternalIP) (via $($ExternalIPRequest.Route.ConnectionMethod))" -Component 'InitializeScript'
    } catch {
        Write-Log -Message "External IP lookup failed: $($_.Exception.Message)" -Component 'InitializeScript' -Type 2
    }
    #Initialize custom Script variables
    Import-CustomURLFile
    if ($UseMSJSON) {
        Get-M365Service -MEM
    }
    if ($UseMS365JSON) {
        Get-M365Service -M365
    }
    if ($Script:ManualURLs -and -not($UseMSJSON -or $UseMS365JSON -or ($Script:ManualURLs | Where-Object { $_.ID -eq 9993 })) -and $CheckCertRevocation) {
        Write-Log 'CheckCertRevocation requires a list of known CRLs, either add your own in the custom CSV (with ID 9993) or specify -UseMSJSON or -UseMS365JSON' -Component 'InitializeScript' -Type 3
        Write-Log 'This will cause to show "SSLInseption = True" for _all_ results!' -Component 'InitializeScript' -Type 3
    }
    if (-not($Script:M365ServiceURLs) -and -not($Script:ManualURLs) -and -not($MergeResults)) {
        Write-Log 'No domains have been imported, please specify -UseMSJSON, -UseMS365JSON or -CustomURLFile' -Component 'InitializeScript' -Type 3
        exit 5
    }
}
function Write-Log {
    <#
    .DESCRIPTION
    This is a (heavily) modified version of the script by Ryan Ephgrave.
    .LINK
    https://www.ephingadmin.com/powershell-cmtrace-log-function/
    #>
    Param (
        [Parameter(Mandatory = $false)]
        $Message,
        $Component,
        # Type: 1 = Normal, 2 = Warning (yellow), 3 = Error (red)
        [ValidateSet('1', '2', '3')][int]$Type
    )
    if (-not($NoOutput)) {
        $Time = Get-Date -Format 'HH:mm:ss.ffffff'
        $Date = Get-Date -Format 'MM-dd-yyyy'
        if (-not($Component)) { $Component = 'Runner' }
        if (-not($ToConsole)) {
            $LogMessage = "<![LOG[$Message" + "]LOG]!><time=`"$Time`" date=`"$Date`" component=`"$Component`" context=`"`" type=`"$Type`" thread=`"`" file=`"`">"
            $LogMessage | Out-File -Append -Encoding UTF8 -FilePath $LogFile
        } elseif ($ToConsole) {
            switch ($type) {
                1 { Write-Host "T:$Type C:$Component M:$Message" }
                2 { Write-Host "T:$Type C:$Component M:$Message" -BackgroundColor Yellow -ForegroundColor Black }
                3 { Write-Host "T:$Type C:$Component M:$Message" -BackgroundColor Red -ForegroundColor White }
                default { Write-Host "T:$Type C:$Component M:$Message" }
            }
        }
    }
}
function Write-SettingsToLog {
    if (-not($MergeResults)) {
        Write-Log "Settings used to run the script:
        General settings
        TestAllServiceAreas: $TestAllServiceAreas
        UseMSJSON: $UseMSJSON
        UseMS365JSON: $UseMS365JSON
        CustomURLFile: $CustomURLFile
        AllowBestEffort: $AllowBestEffort
        CheckCertRevocation: $CheckCertRevocation
        GCC: $GCC
    
        ASAs
        Intune: $Intune
        Autopilot: $Autopilot
        WindowsActivation: $WindowsActivation
        EntraID: $EntraID
        WindowsUpdate: $WindowsUpdate
        DeliveryOptimization: $DeliveryOptimization
        NTP: $NTP
        DNS: $DNS
        DiagnosticsData: $DiagnosticsData
        DiagnosticsDataUpload: $DiagnosticsDataUpload
        NCSI: $NCSI
        WindowsNotificationService: $WindowsNotificationService
        WindowsStore: $WindowsStore
        M365: $M365
        CRLs: $CRLs
        SelfDeploying: $SelfDeploying
        RemoteHelp: $RemoteHelp
        TPMAttestation: $TPMAttestation
        DeviceHealth: $DeviceHealth
        Apple: $Apple
        Android: $Android
        EndpointAnalytics: $EndpointAnalytics
        AppInstaller: $AppInstaller
        UniversalPrint: $UniversalPrint
        AppAndScript: $AppAndScript

        TrustMeBro: $TrustMeBro

        Products
        VisualStudioFull: $VisualStudioFull
        VisualStudioInstallation: $VisualStudioInstallation
        DefenderFull: $DefenderFull
        DefenderOptional: $DefenderOptional
        DefenderSmartScreen: $DefenderSmartScreen
        DefenderLiveResponse: $DefenderLiveResponse
        DefenderVulnTool: $DefenderVulnTool

        Other tests
        AuthenticatedProxyOnly: $AuthenticatedProxyOnly
        TestSSLInspectionOnly: $TestSSLInspectionOnly
        Legacy: $Legacy
    
        Additional Settings
        TenantName: $TenantName
        MaxDelayInMS: $MaxDelayInMS
        BurstMode: $BurstMode" -Component 'InitialzeScript'
    } else {
        Write-Log "Settings used to run the script:
        Merge options
        MergeResults: $MergeResults
        MergeShowAllResults: $MergeShowAllResults
        MergeCSVs: $MergeCSVs" -Component 'InitialzeScript'
    }
    Write-Log "Output options
        OutputCSV: $OutputCSV
        ShowResults: $ShowResults
    
        Common parameters
        NoLog: $NoLog
        ToConsole: $ToConsole
        WorkingDirectory: $WorkingDirectory
        LogDirectory: $LogDirectory
        BrienMode: $BrienMode
        ProxyMode: $ProxyMode
        ScriptPath: $($Script:PathToScript)
        LogFile: $($Script:LogFile)" -Component 'InitialzeScript'
}
function Import-CustomURLFile {
    <#
    .SYNOPSIS
        Imports URLs from a custom CSV file. Automatically uses 'INRCustomList.csv' if no filename is specified.
    #>
    if (-not($CustomURLFile)) {
        Write-Log 'No CSV provided - trying autodetect for filename ' -Component 'ImportCustomURLFile'
        $DefaultCSVName = "INRCustomList.csv"
        $JoinedDefaultCSVPath = Join-Path $Script:PathToScript -ChildPath $DefaultCSVName
        if (Test-Path $JoinedDefaultCSVPath) {
            Write-Log "CSV found in $($Script:PathToScript)" -Component 'ImportCustomURLFile'
            $CustomURLFile = $DefaultCSVName
        } else {
            Write-Log 'Autodetection did not find a custom CSV file' -Component 'ImportCustomURLFile'
            return
        }
    }
    Write-Log 'Adding custom URLs to the pool' -Component 'ImportCustomURLFile'
    $Header = 'URL', 'Port', 'Protocol', 'ID'
    $Script:ManualURLs = [System.Collections.ArrayList]::new()
    $TempObjects = Import-Csv -Path (Join-Path -Path $Script:PathToScript -ChildPath $CustomURLFile) -Delimiter ',' -Header $Header
    foreach ($Object in $TempObjects) {
        $URLObject = [PSCustomObject]@{
            id       = $Object.ID
            #serviceArea            = $Object.serviceArea
            #serviceAreaDisplayName = $Object.serviceAreaDisplayName
            url      = $Object.url.replace('*.', '')
            Port     = $Object.port
            Protocol = $Object.protocol
            #expressRoute           = $Object.expressRoute
            #category               = $Object.category
            required = 'true'
            #notes                  = $Object.notes
        }
        $Script:ManualURLs.add($URLObject) | Out-Null
    }
}
function Get-URLsFromID {
    <#
    .SYNOPSIS
    Will put the URLs for different service areas into one big arraylist.
    #>
    param(  
        [int[]]$IDs,
        [int[]]$FilterPort
    )
    if ($Script:URLsToVerify) {
        Get-Variable URLsToVerify | Clear-Variable
        $Script:URLsToVerify = [System.Collections.ArrayList]::new()
    }
    foreach ($ID in $IDs) {
        if ($Script:ManualURLs) {
            $Script:ManualURLs | Where-Object { $_.id -eq $ID -and $_.port -notin $FilterPort } | ForEach-Object { $Script:URLsToVerify.Add($_) | Out-Null }
        }
        if ($Script:M365ServiceURLs) {
            $Script:M365ServiceURLs | Where-Object { $_.id -eq $ID -and $_.port -notin $FilterPort } | ForEach-Object { $Script:URLsToVerify.Add($_) | Out-Null }
        }
        if (-not($Script:URLsToVerify)) {
            return $false
        }
        $DuplicateURLsToVerify = [System.Collections.ArrayList]::new()
        foreach ($IDsFound in $Script:URLsToVerify) {
            $RemoveMe = $Script:URLsToVerify | Where-Object { $_.id -eq $IDsFound.id -and $_.url -eq $IDsFound.url -and $_.port -eq $IDsFound.port -and $_.protocol -eq $IDsFound.protocol }
            if ($RemoveMe.count -gt 1) {
                $counter = 0
                foreach ($RemoveObject in $RemoveMe) {
                    if ($counter -gt 0) {
                        $DuplicateURLsToVerify.add($RemoveObject) | Out-Null
                    }
                    $counter++
                }
            }
        }
        $DuplicateURLsToVerify | ForEach-Object { $Script:URLsToVerify.Remove($_) }    
    }
    return $true
}

#Import M365 Service-URLs
function Find-WildcardURL {
    <#
    .SYNOPSIS
    Will resolve wildcards to actual URLs. If AllowBestEffort is set might also remove the wildcards from URLs if they can't be matched otherwise
    #>
    Write-Log -Message 'Now searching for nearest match for Wildcards' -Component 'FindWildcardURL'
    foreach ($Object in $Script:WildCardURLs) {
        Write-Log -Message "Searching for $($Object.url)" -Component 'FindWildcardURL'
        if ($($Script:M365ServiceURLs | Where-Object { $_.url -like "*$($Object.url.replace('*.',''))*" })) {
            continue
        }
        $ReplaceElement = $Object.url.split('.')[0] 
        if ($ReplaceElement -ne '*') {
            $WildcardReplacement = $ReplaceElement.replace('*', 'INR')
            $NewURL = $Object.url.replace($ReplaceElement, $WildcardReplacement)
        } else {
            $NewURL = $Object.url.replace('*.', '')
        }

        Write-Log -Message 'We did not find a matching URL using best effort (no wildcard)' -Component 'FindWildcardURL'
        $URLObject = [PSCustomObject]@{
            id       = $Object.ID
            #serviceArea            = $Object.serviceArea
            #serviceAreaDisplayName = $Object.serviceAreaDisplayName
            url      = $NewURL
            Port     = $Object.port
            Protocol = $Object.protocol
            #expressRoute           = $Object.expressRoute
            #category               = $Object.category
            required = $Object.required
            #notes                  = $Object.notes
        }
        
        $Script:M365ServiceURLs.Add($URLObject) | Out-Null
    }
}
function Get-M365Service {
    <#
    .SYNOPSIS
    Will grab M365 and MEM JSONs from Microsoft using a random GUID
    #>
    param(
        [switch]$M365,
        [switch]$MEM
    )
    $EndpointURL = "https://endpoints.office.com"
    #if (Test-HTTP -URL $EndpointURL) {
    if ($M365) {
        Write-Log 'Adding Microsoft URLs to the pool from service area M365' -Component 'GetM365URLs'
        if ($Tenantname) { $RequestUri = "$EndpointURL/endpoints/WorldWide?clientrequestid=$Script:GUID&TenantName=$Tenantname" }
        else { $RequestUri = "$EndpointURL/endpoints/WorldWide?clientrequestid=$Script:GUID" }
    }
    if ($MEM) {
        Write-Log 'Adding Microsoft URLs to the pool from service area MEM' -Component 'GetM365URLs'
        $RequestUri = "$EndpointURL/endpoints/WorldWide?ServiceAreas=MEM`&`clientrequestid=$($Script:GUID)"
    }
    $EndpointRequest = Invoke-RoutedWebRequest -Uri $RequestUri
    $URLs = $EndpointRequest.Response.Content | ConvertFrom-Json
    Write-Log -Message "Microsoft endpoint data downloaded via $($EndpointRequest.Route.ConnectionMethod)" -Component 'GetM365URLs'
    foreach ($Object in $URLs) {
        $Ports = [array](($(if ($Object.tcpPorts) { $Object.tcpPorts }elseif ($Object.udpPorts) { $Object.udpPorts }else { '443' })).split(",").trim())
        $Protocol = $(if ($Object.tcpPorts) { 'TCP' } elseif ($Object.udpPorts) { 'UDP' } else { 'TCP' })
        foreach ($URL in $Object.urls) {
            foreach ($Port in $Ports) {
                $URLObject = [PSCustomObject]@{
                    id       = $Object.id
                    #serviceArea            = $Object.serviceArea
                    #serviceAreaDisplayName = $Object.serviceAreaDisplayName
                    url      = $URL
                    Port     = $Port
                    Protocol = $Protocol
                    #expressRoute           = $Object.expressroute
                    #category               = $Object.category
                    required = $Object.required
                    #notes                  = $Object.notes
                }
                if ($URL -match '\*') {
                    Write-Log -Message "The URI $URL contains a wildcard - trying to find nearest match later" -Component 'GetM365Service'
                    if ($URL -in $Script:WildCardURLs.url) {
                        continue
                    }
                    $Script:WildCardURLs.add($URLObject) | Out-Null
                    continue
                }
                $Script:M365ServiceURLs.Add($URLObject) | Out-Null
            }
        }
    }
    if ($AllowBestEffort) {
        Write-Log -Message 'Best effort URLs are enabled - this will turn wildcards into regular URLs using a best effort method' -Component 'IntuneNetworkCheckMain'
        Find-WildcardURL
    }
}

#Test Functions
function Test-SSLInspectionByKnownCRLs {
    <#
    .SYNOPSIS
    Verify CRL against known good - this is an indicator for SSLInspection
    #>
    param(
        [string]$CRLURL,
        [string]$VerifyAgainstKnownGood
    )
    $Candidate = if ($CRLURL) { $CRLURL } else { $VerifyAgainstKnownGood }
    if ([string]::IsNullOrWhiteSpace($Candidate)) {
        return $false
    }
    try {
        $CandidateHost = if ($Candidate -match '^[a-z][a-z0-9+.-]*://') { ([uri]$Candidate).Host } else { ([uri]"http://$Candidate").Host }
    } catch {
        return $false
    }
    if (-not($Script:CRLURLsToCheck)) {
        if ($Script:ManualURLs) {
            $Script:ManualURLs | Where-Object { $_.id -in "125", "84", "9993" } | ForEach-Object { $Script:CRLURLsToCheck.add($_) | Out-Null }
        }
        if ($Script:M365ServiceURLs) {
            $Script:M365ServiceURLs | Where-Object { $_.id -in "125", "84", "9993" } | ForEach-Object { $Script:CRLURLsToCheck.add($_) | Out-Null }
        }
    }
    foreach ($URL in $Script:CRLURLsToCheck.url) {
        $KnownValue = "$URL".Trim()
        $IsWildcard = $KnownValue.StartsWith('*.')
        $KnownValue = $KnownValue -replace '^\*\.', ''
        try {
            $KnownHost = if ($KnownValue -match '^[a-z][a-z0-9+.-]*://') { ([uri]$KnownValue).Host } else { ([uri]"http://$KnownValue").Host }
        } catch {
            continue
        }
        if ($CandidateHost -ieq $KnownHost -or ($IsWildcard -and $CandidateHost.EndsWith(".$KnownHost", [StringComparison]::OrdinalIgnoreCase))) {
            return $true
        }
    }
    return $false
}
function Test-SSL {
    <#
    .SYNOPSIS
    Opens a TCP connection to a URL and attempts to secure it using the strongest encryption method available.
    .NOTES
    Initial idea: https://learn.microsoft.com/en-us/troubleshoot/azure/azure-monitor/log-analytics/windows-agents/ssl-connectivity-mma-windows-powershell
    #>
    param(
        $SSLTarget, 
        $SSLPort = 443,
        [string]$ProxyAddress
    )
    $SSLTest = $false
    $SSLProtocol = $null
    $Issuer = $null
    $AuthException = $null
    $KnownCRL = $null
    $SSLInspectionResult = $null
    $CertInfo = $null
    $ConnectTarget = $SSLTarget
    $ConnectPort = $SSLPort
    if ($ProxyAddress) {
        $ProxyUri = [uri]$ProxyAddress
        $ConnectTarget = $ProxyUri.Host
        $ConnectPort = $ProxyUri.Port
    }
    try {
        $TCPSocket = New-Object Net.Sockets.TcpClient($ConnectTarget, $ConnectPort)
        $NetworkStream = $TCPSocket.GetStream()
        if ($ProxyAddress) {
            $ConnectRequest = "CONNECT $($SSLTarget):$SSLPort HTTP/1.1`r`nHost: $($SSLTarget):$SSLPort`r`nProxy-Connection: Keep-Alive`r`n`r`n"
            $ConnectBytes = [Text.Encoding]::ASCII.GetBytes($ConnectRequest)
            $NetworkStream.Write($ConnectBytes, 0, $ConnectBytes.Length)
            $ResponseBytes = [System.Collections.Generic.List[byte]]::new()
            $Terminator = [Text.Encoding]::ASCII.GetBytes("`r`n`r`n")
            while ($ResponseBytes.Count -lt 16384) {
                $NextByte = $NetworkStream.ReadByte()
                if ($NextByte -lt 0) {
                    break
                }
                $ResponseBytes.Add([byte]$NextByte)
                if ($ResponseBytes.Count -ge 4) {
                    $Offset = $ResponseBytes.Count - 4
                    if ($ResponseBytes[$Offset] -eq $Terminator[0] -and $ResponseBytes[$Offset + 1] -eq $Terminator[1] -and $ResponseBytes[$Offset + 2] -eq $Terminator[2] -and $ResponseBytes[$Offset + 3] -eq $Terminator[3]) {
                        break
                    }
                }
            }
            $ConnectResponse = [Text.Encoding]::ASCII.GetString($ResponseBytes.ToArray())
            if ($ConnectResponse -notmatch '^HTTP/\d(?:\.\d)? 2\d\d') {
                $ProxyStatusCode = if ($ConnectResponse -match '^HTTP/\d(?:\.\d)? (?<Status>\d{3})') { [int]$Matches.Status } else { $null }
                throw "Proxy CONNECT failed$(if ($ProxyStatusCode) { " with HTTP $ProxyStatusCode" })"
            }
        }
        $CertificateCapture = [PSCustomObject]@{
            Certificate = $null
            ChainStatus = $null
        }
        $CertificateValidationCallback = [Net.Security.RemoteCertificateValidationCallback]{
            param($Sender, $Certificate, $Chain, $PolicyErrors)
            $CertificateCapture.Certificate = if ($Certificate) { [Security.Cryptography.X509Certificates.X509Certificate2]::new($Certificate) } else { $null }
            $CertificateCapture.ChainStatus = @($Chain.ChainStatus | ForEach-Object { $_.Status.ToString() }) -join ', '
            return $PolicyErrors -eq [Net.Security.SslPolicyErrors]::None
        }
        $SSLStream = [Net.Security.SslStream]::new($NetworkStream, $false, $CertificateValidationCallback)
    } catch {
        if ($TCPSocket) {
            $TCPSocket.Dispose()
        }
        return [PSCustomObject]@{
            SSLTest         = $false
            SSLProtocol     = $null
            Issuer          = $null
            Thumbprint      = $null
            AuthException   = $_.Exception.Message
            KnownCRL        = $null
            SSLInterception = $null
        }
    }
    try {
        $SSLStream.AuthenticateAsClient(
            $SSLTarget, #targetHost
            $null, #clientCertificates (Collection)
            $true #checkCertificateRevocation
        )
    } catch [System.Security.Authentication.AuthenticationException] {
        #THIS ONLY WORKS IN PS7!!
        if ($PSVersionTable.psversion.major -ge 7) {
            $AuthenticationMessage = if ($_.Exception.InnerException) { $_.Exception.InnerException.Message } else { $_.Exception.Message }
            switch -Wildcard ($AuthenticationMessage) {
                "Cannot determine the frame size or a corrupted frame was received." { $AuthException = "FrameSizeOrCorrupted" }
                "*TLS alert: 'HandshakeFailure'." { $AuthException = "HandshakeFailure" }
                "*validation procedure: RemoteCertificateNameMismatch" { $AuthException = "RemoteCertificateNameMismatch" }
                "*RevocationStatusUnknown*" { $AuthException = "RevocationStatusUnknown" }
                "*RemoteCertificateValidationCallback*" { $AuthException = if ($CertificateCapture.ChainStatus) { $CertificateCapture.ChainStatus } else { $AuthenticationMessage } }
                default { $AuthException = $AuthenticationMessage }
            } 
        } else {
            Write-Log -Message 'Cannot determine exact certificate failure, defaults to "failed"' -Component 'TestSSL' -Type 2
            $AuthException = "Failed"
        }
    } catch [System.Management.Automation.MethodInvocationException] {
        Write-Log -Message 'The TCP socket closed unexpectedly. This could be random, repeat this test.' -Type 2 -Component 'TestSSL'
    }
    if ($SSLStream.IsAuthenticated) {
        $SSLTest = $true
        $SSLProtocol = $SSLStream.SslProtocol
    }
    $CertInfo = $CertificateCapture.Certificate
    if ($CertInfo) {
        if ($CertInfo.Thumbprint -and $CheckCertRevocation) {
            Write-Log -Message "Grabbing CRL for $SSLTarget and verify against known-good" -Component 'TestSSL'
            $CRLText = $CertInfo.Extensions | Where-Object -FilterScript { $_.Oid.Value -eq '2.5.29.31' } | ForEach-Object -Process { $_.Format($true) }
            $AIAText = $CertInfo.Extensions | Where-Object -FilterScript { $_.Oid.Value -eq '1.3.6.1.5.5.7.1.1' } | ForEach-Object -Process { $_.Format($true) }
            $CRLURIs = @([regex]::Matches(($CRLText -join "`n"), 'https?://[^\s,\]\r\n]+', [Text.RegularExpressions.RegexOptions]::IgnoreCase) | ForEach-Object { $_.Value.TrimEnd('.') } | Sort-Object -Unique)
            $AIAURIs = @([regex]::Matches(($AIAText -join "`n"), 'https?://[^\s,\]\r\n]+', [Text.RegularExpressions.RegexOptions]::IgnoreCase) | ForEach-Object { $_.Value.TrimEnd('.') } | Sort-Object -Unique)
            $SSLInspectionResult = $false
            $KnownCRL = $false
            if (-not($CRLURIs) -and -not($AIAURIs)) {
                Write-Log "No CRL detected - SSL inspection is likely. Testing if tested URL $SSLTarget is a known address CRL itself" -Component 'TestSSL' -Type 2
                $VerifyAgainstKnownGoodResult = Test-SSLInspectionByKnownCRLs -VerifyAgainstKnownGood $SSLTarget
                if ($VerifyAgainstKnownGoodResult) {
                    Write-Log "$SSLTarget is a known good CRL address" -Component 'TestSSL' -Type 2
                    $KnownCRL = $true
                }
                if (-not($VerifyAgainstKnownGoodResult)) {
                    Write-Log "SSL Inspection very likely. $SSLTarget is not a known CRL address" -Component 'TestSSL' -Type 2
                    $SSLInspectionResult = $true
                }
            } elseif ($CRLURIs) {
                foreach ($CRLURI in $CRLURIs) {
                    Write-Log "Testing CRL URI: $(([uri]$CRLURI).Host)" -Component 'TestSSL'
                    if (Test-SSLInspectionByKnownCRLs -CRLURL $CRLURI) {
                        $KnownCRL = $true
                        break
                    }
                }
            } elseif ($AIAURIs) {
                Write-Log 'No CRL found in certificate - testing AIA URI' -Component 'TestSSL' -Type 2
                foreach ($AIAURI in $AIAURIs) {
                    Write-Log "Testing AIA URI: $(([uri]$AIAURI).Host)" -Component 'TestSSL'
                    if (Test-SSLInspectionByKnownCRLs -CRLURL $AIAURI) {
                        $KnownCRL = $true
                        break
                    }
                }
                if ( -not($KnownCRL)) {
                    Write-Log "Unknown CRL or AIA. $SSLTarget's certificate didn't provide any known CRL/AIA address" -Component 'TestSSL' -Type 2
                    $SSLInspectionResult = $true
                }
                
            }
        }
    }
    if ($null -eq $SSLTest) {
        $SSLTest = $false
    }
    $Result = [PSCustomObject]@{
        SSLTest         = $SSLTest
        SSLProtocol     = $SSLProtocol
        Issuer          = $CertInfo.Issuer
        Thumbprint      = $CertInfo.Thumbprint
        AuthException   = $AuthException
        KnownCRL        = $KnownCRL
        SSLInterception = $SSLInspectionResult
    }
    $SSLStream.Dispose()
    $TCPSocket.Dispose()
    return $Result
}


function Test-HTTP {
    <#
    .SYNOPSIS
    Checks for HTTP(s) return codes. 403 and 401 can be indicators of (authenticated) proxy interruption.
    #>
    param(
        [string]$HTTPURL,
        [int]$HTTPPort,
        [PSCustomObject]$Route
    )
    switch ($HTTPPort) {
        "80" { $URIStart = "http://" }
        "443" { $URIStart = "https://" }
        default { $URIStart = "https://" }
    }
    $RequestParameters = @{
        Uri                      = $URIStart + $HTTPURL
        ConnectionTimeoutSeconds = [Math]::Max(1, [Math]::Ceiling($MaxDelayInMS / 100))
        Method                   = 'Get'
        SkipHttpErrorCheck       = $true
    }
    if ($Route.ConnectionMethod -eq 'Direct' -or $Route.ProxyBypassed) {
        $RequestParameters.NoProxy = $true
    } else {
        $RequestParameters.Proxy = $Route.ProxyAddress
    }
    try {
        $HTTPiwr = Invoke-WebRequest @RequestParameters
        return [PSCustomObject]@{
            StatusCode = $HTTPiwr.StatusCode
            Error      = $null
        }
    } catch {
        return [PSCustomObject]@{
            StatusCode = if ($_.Exception.Response.StatusCode) { [int]$_.Exception.Response.StatusCode } else { $false }
            Error      = $_.Exception.Message
        }
    }
}
function Test-DNS {
    <#
    .SYNOPSIS
    Verifies that DNS is working for a given URL and that the IP does not resolve a sinkhole (0.0.0.0 or 127.0.0.1 or ::).
    #>
    param(
        [string]$DNSTarget
    )
    $DNSresult = $true
    if ($DNSTarget -in $Script:DNSCache.CachedURL) {
        $CachedResult = $Script:DNSCache | Where-Object { $_.CachedURL -eq $DNSTarget } | Select-Object -Property result
        return $CachedResult.result
    }
    $ResolvedDNSRecords = Resolve-DnsName -Name $DNSTarget -ErrorAction SilentlyContinue
    if ($ResolvedDNSRecords.count) {
        foreach ($DNSARecord in $ResolvedDNSRecords.IP4Address) {
            if ($DNSARecord.IP4Address) {
                if ($DNSARecord -eq '0.0.0.0' -or $DNSARecord -eq '127.0.0.1') {
                    Write-Log -Message "DNS sinkhole detected: Address $DNSTarget resolved to an invalid address" -Component 'TestDNS' -Type 2
                    $DNSresult = $false
                    break
                }
            }
        }
        foreach ($DNSAAAARecord in $ResolvedDNSRecords.IP6Address) {
            if ($DNSAAAARecord -eq '::') {
                Write-Log -Message "DNS sinkhole detected: Address $DNSTarget resolved to an invalid address" -Component 'TestDNS' -Type 2
                $DNSresult = $false
                break
            }
        }
    } else {
        Write-Log -Message "No DNS record found for $DNSTarget" -Component 'TestDNS' -Type 3
        $DNSresult = $false
    }
    $DNSObject = [PSCustomObject]@{
        CachedURL = $DNSTarget
        Result    = $DNSresult
    }
    $Script:DNSCache.add($DNSObject) | Out-Null
    return $DNSresult
}
function Test-TCPPort {
    <#
    .SYNOPSIS
    Opens a TCP connection to a given URL.
    #>
    param(
        [string]$TCPTarget,
        [int]$TCPPort,
        [int]$MaxWaitTime
    )
    if (-not($MaxWaitTime)) {
        $MaxWaitTime = $MaxDelayInMS
    }
    if ($TCPTarget -in $Script:DNSCache.CachedURL) {
        $DNSCachedResult = $Script:DNSCache | Where-Object { $_.CachedURL -eq $TCPTarget } | Select-Object -Property result -First 1
        if (-not($DNSCachedResult.result)) {
            return $false
        }
    }
    if (-not($BurstMode)) {
        $TCPCachedResult = $Script:TCPCache | Where-Object { $_.CachedURL -eq $TCPTarget -and $_.Port -eq $TCPPort } | Select-Object -First 1
        if ($TCPCachedResult) {
            return $TCPCachedResult.Result
        }
    }
    $TCPClient = New-Object -TypeName System.Net.Sockets.TCPClient
    $RunningClient = $TCPClient.ConnectAsync($TCPTarget, $TCPPort)
    Start-Sleep -Milliseconds $MaxWaitTime
    $success = $false 
    if ($RunningClient.IsCompleted) {
        if ($RunningClient.Status -ne 'RanToCompletion') {
            Write-Log "TCP Port test failed with $($RunningClient.Status)" -Component 'TestTCPPort' -Type 2
            if ($RunningClient.Exception.InnerException) {
                Write-Log "$($RunningClient.Exception.InnerException.Message)" -Component 'TestTCPPort'
            }
        } else {
            $success = $true
        }
    } else {
        Write-Log 'TCP Port did not respond in a timely fashion' -Component 'TestTCPPort' -Type 2
    }
    $TCPClient.Close()
    $TCPClient.Dispose()
    if (-not($BurstMode)) {
        $TCPObject = [PSCustomObject]@{
            CachedURL = $TCPTarget
            Port      = $TCPPort
            Result    = $success
        }
        $Script:TCPCache.add($TCPObject) | Out-Null
    }
    return $success
}
function Test-NTPviaUDP {
    <#
    .SYNOPSIS
    Will test an NTP server using UDP. This is the only UDP test available currently. If more endpoints are found (like DO) those might get added too
    .DESCRIPTION
    The only service that will ever answer to a UDP request, because it has to, is a NTP server. There are other ways to test that though see the Test-NTP function
    HUGE thanks to https://github.com/proxb/PowerShell_Scripts/blob/master/Test-Port.ps1 and
    Jannik Reinhard for the idea to use NTP to test UDP https://github.com/JayRHa/Intune-Scripts/blob/main/Check-AutopilotPrerequisites/Check-AutopilotPrerequisites.ps1#L145
    #>
    param(
        [string]$Target,
        [int]$Port
    )
    Write-Log "Test $Target via direct UDP request" -Component 'TestNTPviaUDP'
    $NTPData = New-Object byte[] 48
    $NTPData[0] = 27
    $udpobject = New-Object Net.Sockets.Udpclient([System.Net.Sockets.AddressFamily]::InterNetwork) 
    $udpobject.Client.Blocking = $False
    $udpobject.AllowNatTraversal($true)
    $Error.Clear()
    $udpobject.Connect($Target, $Port) | Out-Null
    
    if ($udpobject.client.Connected) {
        Write-Log -Message 'Sending UDP test message' -Component 'TestUDPPort'
        [void]$udpobject.Send($NTPData, $NTPData.Length)
        $remoteendpoint = New-Object system.net.ipendpoint([system.net.ipaddress]::Any, 0)
        Start-Sleep -Milliseconds 100 #We have to wait slightly to send the data back
        $TestData = $udpobject.Receive([ref]$remoteendpoint)
    } else {
        Write-Log -Message 'No UDP "connection" established' -Component 'TestUDPPort'
        Write-Log -Message "$($Error[0].Exception.InnerException.Message)" -Component 'TestUDPPort' -Type 2
        return $false
    }
    $udpobject.Close()
    $udpobject.Dispose()
    if ($TestData) {
        $Seconds = [BitConverter]::ToUInt32( $TestData[43..40], 0 )
        ( [datetime]'1/1/1900' ).AddSeconds( $Seconds ).ToLocalTime()
    } else {
        Write-Log -Message 'Did not receive a response' -Component 'TestUDPPort' -Type 2
        return $false
    }
    return $true
}
function Test-TCPBurstMode {
    <#
    .SYNOPSIS
    Will test a given URL in 50ms chunks (50,100,150...) until $MaxDelayInMS is reached.
    #>
    param(
        [string]$TCPTarget,
        [int]$TCPPort,
        [PSCustomObject]$ResultObject
    )
    $MinimumWaitTime = 50
    $AmountofTimes = [math]::floor([decimal]($MaxDelayInMS / $MinimumWaitTime))
    for ($i = 1; $i -lt $AmountofTimes + 1; $i++) {
        $MaxWaitTime = $($MinimumWaitTime * $i)
        $TCPResult = Test-TCPPort -TCPTarget $TCPTarget -TCPPort $TCPPort -MaxWaitTime $MaxWaitTime
        $ResultObject | Add-Member -MemberType NoteProperty -Name "TCP$MaxWaitTime" -Value $TCPResult
    }
}
function Test-Network {
    <#
    .SYNOPSIS
    This is the core function of this script. It combines every possible test (DNS, CRL, TCP, TLS...) into one function.
    .NOTES
    ToDo: Make each check based upon a switch that is default = on
    #>
    
    param(
        [PSCustomObject]$TestObject
    )
    Write-Log "Testing $($TestObject.url) on port $($TestObject.port)" -Component 'TestNetwork'
    $TargetScheme = if ([int]$TestObject.port -eq 80) { 'http' } else { 'https' }
    $Routes = Get-ProxyRoutes -TargetUri ([uri]"$TargetScheme`://$($TestObject.url):$($TestObject.port)")
    $DirectCertificateThumbprint = $null
    foreach ($Route in $Routes) {
        $TCP = $false
        if ($TestObject.protocol -ne 'TCP' -and $Route.ConnectionMethod -ne 'Direct') {
            Write-Log "Skipping $($Route.ConnectionMethod) for $($TestObject.url): HTTP proxies cannot test $($TestObject.protocol) traffic" -Component 'TestNetwork' -Type 2
            continue
        }
        if ($Script:FinalResultList | Where-Object { $_.url -eq $TestObject.url -and $_.port -eq $TestObject.port -and $_.ConnectionMethod -eq $Route.ConnectionMethod }) {
            Write-Log "This URL/Port was already tested using $($Route.ConnectionMethod)" -Component 'TestNetwork'
            continue
        }
        $ResultObject = [PSCustomObject]@{}
        foreach ($Property in $TestObject.PSObject.Properties) {
            if ($Property.Name -notin 'DNSResult', 'TCPResult', 'HTTPStatusCode', 'SSLTest', 'SSLProtocol', 'Issuer', 'AuthException', 'KnownCRL', 'SSLInterception', 'ConnectionMethod', 'ProxyAddress', 'ProxyBypassed', 'ProxyError') {
                $ResultObject | Add-Member -Name $Property.Name -MemberType NoteProperty -Value $Property.Value
            }
        }
        $ResultObject | Add-Member -Name 'ConnectionMethod' -MemberType NoteProperty -Value $Route.ConnectionMethod
        $ResultObject | Add-Member -Name 'ProxyAddress' -MemberType NoteProperty -Value $Route.ProxyAddress
        $ResultObject | Add-Member -Name 'ProxyBypassed' -MemberType NoteProperty -Value $Route.ProxyBypassed
        $ResultObject | Add-Member -Name 'ProxyError' -MemberType NoteProperty -Value ''
        $ResultObject | Add-Member -Name 'DNSResult' -MemberType NoteProperty -Value ''
        $ResultObject | Add-Member -Name 'TCPResult' -MemberType NoteProperty -Value ''
        $ResultObject | Add-Member -Name 'HTTPStatusCode' -MemberType NoteProperty -Value ''
        $ResultObject | Add-Member -Name 'SSLTest' -MemberType NoteProperty -Value ''
        $ResultObject | Add-Member -Name 'SSLProtocol' -MemberType NoteProperty -Value ''
        $ResultObject | Add-Member -Name 'Issuer' -MemberType NoteProperty -Value ''
        $ResultObject | Add-Member -Name 'AuthException' -MemberType NoteProperty -Value ''
        $ResultObject | Add-Member -Name 'KnownCRL' -MemberType NoteProperty -Value ''
        $ResultObject | Add-Member -Name 'SSLInterception' -MemberType NoteProperty -Value ''
        $ConnectionTarget = if ($Route.ConnectionMethod -eq 'Direct' -or $Route.ProxyBypassed) { $TestObject.url } else { ([uri]$Route.ProxyAddress).Host }
        $ConnectionPort = if ($Route.ConnectionMethod -eq 'Direct' -or $Route.ProxyBypassed) { [int]$TestObject.port } else { ([uri]$Route.ProxyAddress).Port }
        $ProxyHostIsIPAddress = $null
        if ($Route.ConnectionMethod -ne 'Direct' -and -not($Route.ProxyBypassed)) {
            $ProxyHostIsIPAddress = [Net.IPAddress]::TryParse($ConnectionTarget, [ref]$null)
        }
        $DNS = if ($ProxyHostIsIPAddress) { $true } else { Test-DNS -DNSTarget $ConnectionTarget }
        $ResultObject.DNSResult = $DNS
        if (-not($DNS) -and $Route.ConnectionMethod -ne 'Direct' -and -not($Route.ProxyBypassed)) {
            $ResultObject.ProxyError = "Proxy host $ConnectionTarget could not be resolved"
        }
        if ($DNS) {
            if ($BurstMode) {
                Test-TCPBurstMode -TCPTarget $ConnectionTarget -TCPPort $ConnectionPort -ResultObject $ResultObject
            } else {
                if ($TestObject.protocol -ne 'TCP') {
                    Write-Log 'This script can not test UDP ports - only NTP (see log for those results)' -Component 'TestNetwork' -Type 2
                } else {
                    $TCP = Test-TCPPort -TCPTarget $ConnectionTarget -TCPPort $ConnectionPort
                    $ResultObject.TCPResult = $TCP
                }
                if (-not($TCP) -and $Route.ConnectionMethod -ne 'Direct' -and -not($Route.ProxyBypassed)) {
                    $ResultObject.ProxyError = "Proxy $ConnectionTarget`:$ConnectionPort did not accept a TCP connection"
                }
                if ($TCP) {
                    #Test HTTP(s) Connections
                    $HTTPResult = Test-HTTP -HTTPURL $TestObject.url -HTTPPort $TestObject.port -Route $Route
                    if ($null -ne $HTTPResult.StatusCode) {
                        $ResultObject.HTTPStatusCode = $HTTPResult.StatusCode
                    } else {
                        $ResultObject.HTTPStatusCode = $false
                    }
                    if ($HTTPResult.Error -and $Route.ConnectionMethod -ne 'Direct') {
                        $ResultObject.ProxyError = $HTTPResult.Error
                    }
                    #Test TLS and verify everything around the cert including traffic interception
                    $SSLParameters = @{
                        SSLTarget = $TestObject.url
                        SSLPort   = $TestObject.port
                    }
                    if ($Route.ConnectionMethod -ne 'Direct' -and -not($Route.ProxyBypassed)) {
                        $SSLParameters.ProxyAddress = $Route.ProxyAddress
                    }
                    $SSLTest = Test-SSL @SSLParameters
                    if ($SSLTest.Thumbprint -and $Route.ConnectionMethod -eq 'Direct') {
                        $DirectCertificateThumbprint = $SSLTest.Thumbprint
                    } elseif ($SSLTest.Thumbprint -and $DirectCertificateThumbprint -and $SSLTest.Thumbprint -ne $DirectCertificateThumbprint) {
                        Write-Log "Certificate presented through $($Route.ConnectionMethod) differs from the direct route; TLS interception detected" -Component 'TestSSL' -Type 2
                        $SSLTest.KnownCRL = $false
                        $SSLTest.SSLInterception = $true
                    }
                    $ResultObject.SSLTest = $SSLTest.SSLTest
                    if ($SSLTest.SSLProtocol) {
                        $ResultObject.SSLProtocol = $SSLTest.SSLProtocol
                    }
                    if ($SSLTest.Issuer) {
                        $ResultObject.Issuer = $SSLTest.Issuer
                    }
                    if ($SSLTest.AuthException) {
                        $ResultObject.AuthException = $SSLTest.AuthException
                    }
                    if ($null -ne $SSLTest.KnownCRL) {
                        $ResultObject.KnownCRL = $SSLTest.KnownCRL
                    }      
                    if ($null -ne $SSLTest.SSLInterception) {
                        $ResultObject.SSLInterception = $SSLTest.SSLInterception
                    }
            }
        }
    }
        $Script:FinalResultList.add($ResultObject) | Out-Null
    }
}

#Artificial Service Areas
function Test-DNSServers {
    <#
    .SYNOPSIS
    This will test a mixture of public DNS servers.
    .NOTES
    #>
    $ServiceIDs = 999
    $ServiceArea = "DNSServer"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    Write-Log 'Testing DNSservers will ignore the local "HOSTS" file.' -Component "Test$ServiceArea"
    $DNSServer = Get-URLsFromID -IDs $ServiceIDs
    if (-not($DNSServer)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        Write-Log -Message 'Please use the CSV provided with this script and specify -CustomURLFile' -Component "Test$ServiceArea"
        return $false
    }
    foreach ($DNSTarget in $Script:URLsToVerify) {
        $UDPDNSTest = Resolve-DnsName "microsoft.com" -DnsOnly -Type A -Server $DNSTarget.url -NoHostsFile -QuickTimeout -ErrorAction SilentlyContinue
        if (-not($UDPDNSTest)) {
            Write-Log "UDP DNS test failed for DNS server $($DNSTarget.url) - trying TCP fallback" -Component $ServiceArea -Type 2
            $TCPDNSTest = Resolve-DnsName "microsoft.com" -DnsOnly -Type A -Server $DNSTarget.url -NoHostsFile -TcpOnly -QuickTimeout -ErrorAction SilentlyContinue
            if (-not($TCPDNSTest)) {
                Write-Log "TCP DNS test failed for DNS server $($DNSTarget.url) - trying TCP fallback" -Component $ServiceArea -Type 2
            }
            Write-Log "TCP DNS test successful for DNS server $($DNSTarget.url)" -Component $ServiceArea
        }
        Write-Log "UDP DNS test successful for DNS server $($DNSTarget.url)" -Component $ServiceArea
    }
    return $true
}
function Test-RemoteHelp {
    <#
    .SYNOPSIS
    This will test all URLs required for RemoteHelp.
    .NOTES
    ServiceIDs 181,187,189
    ServiceIDs GCC 188
    Remote Help - Default + Required https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints?tabs=europe#remote-help
    #>
    $ServiceIDs = 181, 187, 189
    if ($GCC) {
        $ServiceIDs = 181, 187, 188, 189
    }
    $ServiceArea = "RemoteHelp"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $RH = Get-URLsFromID -IDs $ServiceIDs
    if (-not($RH)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($RHTarget in $Script:URLsToVerify) {
        Test-Network $RHTarget
    }
    return $true
}
function Test-TPMAttestation {
    <#
    .SYNOPSIS
    This will test all URLs required for TPM attestation.
    .NOTES
    ServiceIDs 173,9998
    https://learn.microsoft.com/en-us/autopilot/requirements?tabs=networking#autopilot-self-deploying-mode-and-autopilot-pre-provisioning
    #>

    $ServiceIDs = 173, 9998
    $ServiceArea = "TPMAtt"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $TPMAtt = Get-URLsFromID -IDs $ServiceIDs
    if (-not($TPMAtt)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($TPMTarget in $Script:URLsToVerify) {
        Test-Network $TPMTarget
    }
    return $true
}
function Test-WNS {
    <#
    .SYNOPSIS
    This will test all URLs required for the windows push notification service (WNS).
    .NOTES
    ServiceIDs 169,171
    https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints?tabs=europe#windows-push-notification-serviceswns-dependencies
    https://www.microsoft.com/en-us/download/details.aspx?id=44238
    ToDo UPDATE to include login.live.com - see XML file.
    #>
    $ServiceIDs = 169, 171
    $ServiceArea = "WNS"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $WNS = Get-URLsFromID -IDs $ServiceIDs
    if (-not($WNS)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($WNSTarget in $Script:URLsToVerify) {
        Test-Network $WNSTarget
    }
    return $true
}
function Test-DeviceHealth {
    <#
    .SYNOPSIS
    This will test all URLs required for Microsoft Azure Attestation (formerly Device Health).
    .NOTES
    ServiceIDs 186
    GCC 9995
    https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints?tabs=north-america#migrating-device-health-attestation-compliance-policies-to-microsoft-azure-attestation
    https://learn.microsoft.com/en-us/windows/client-management/mdm/healthattestation-csp
    #>
    $ServiceIDs = 186
    if ($GCC) {
        $ServiceIDs = 186, 9995
    }
    $ServiceArea = "DeviceHealth"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $DH = Get-URLsFromID -IDs $ServiceIDs
    if (-not($DH)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($DHTarget in $Script:URLsToVerify) {
        Test-Network $DHTarget
    }
    return $true
}
function Test-DeliveryOptimization {
    <#
    .SYNOPSIS
    This will test all URLs required for delivery optimization.
    .NOTES
    ServiceIDs 172,164,9994
    Service ID 172 was removed from MEM endpoints JSON but is still recommended as a test for DO to have some FQDNs to test against.
    Service ID 164 is expanded in the INRCustomList.csv to include more DO specific URLs.
    Service ID 9994 is used for Teredo group peers across multiple NATs.
    https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints?#delivery-optimization-dependencies
    https://learn.microsoft.com/en-us/windows/deployment/do/waas-delivery-optimization-faq#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization
    https://learn.microsoft.com/en-us/windows/deployment/do/delivery-optimization-workflow#delivery-optimization-service-endpoint-and-data-information
    #>
    $ServiceIDs = 172, 164, 9994
    $ServiceArea = "DO"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    Write-Log 'Filtered Port TCP 7680: Documentation will specify port 7680 TCP. This is used to listen to other clients requests (from the host). Not an outbound connection. Availability will be tested' -Component 'TestDO'
    Write-Log 'Filtered Port UDP 3544: Documentation might specify port 3544 UDP (aka Teredo) in/outbound as required - this is required for P2P connections _across NAT_ only' -Component 'TestDO'
    Write-Log 'Verify TCP Port 7680 is being listened on' -Component 'TestDO'
    $Listening = Get-NetTCPConnection -LocalPort 7680 -ErrorAction SilentlyContinue
    if (-not($Listening)) {
        Write-Log 'TCP Port 7680 not being listed as listening checking service' -Component 'TestDO'
        Write-Log 'Please consult https://learn.microsoft.com/en-us/windows/deployment/do/waas-delivery-optimization-faq#why-is-the-delivery-optimization-service-not-listening-on-port-7680?WT.mc_id=MVP_444422' -Component 'TestDO'
        if (-not(Get-Service -Name DoSvc)) {
            Write-Log 'DoSvc is not running! Delivery optimization not possible' -Component 'TestDO' -Type 3
            return $false
        }
    }
    $DeliveryOptimization = Get-URLsFromID -IDs $ServiceIDs -FilterPort 7680, 3544
    if (-not($DeliveryOptimization)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($DOTarget in $Script:URLsToVerify) {
        Test-Network $DOTarget
    }
    return $true
}
function Test-Apple {
    <#
    .SYNOPSIS
    This will test all URLs required for managing Apple devices.
    .NOTES
    ServiceIDs 178
    https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints?#apple-dependencies
    #>
    Write-Log -Message 'Port 5223 is only used as a fallback for push notifications and only valid for push.apple.com addresses' -Component 'TestApple'
    Write-Log -Message 'Warning: Other URLs might be required, please also consult https://support.apple.com/de-de/101555' -Component 'TestApple' -Type 2
    $ServiceIDs = 178
    $ServiceArea = "Apple"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $AAPL = Get-URLsFromID -IDs $ServiceIDs
    if (-not($AAPL)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($AAPLTarget in $Script:URLsToVerify) {
        Test-Network $AAPLTarget
    }
    return $true
}
function Test-Android {
    <#
    .SYNOPSIS
    This will test all URLs required for managing Android devices
    .NOTES
    ServiceIDs 179,9992
    https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints?tabs=europe#android-aosp-dependencies
    #>
    Write-Log -Message 'Warning: Other URLs might be required, please also consult https://static.googleusercontent.com/media/www.android.com/en//static/2016/pdfs/enterprise/Android-Enterprise-Migration-Bluebook_2019.pdf' -Component 'TestAndroid' -Type 2
    $ServiceIDs = 179, 9992
    $ServiceArea = "Android"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"

    Write-Log 'Testing Android connectivity check' -Component "Test$ServiceArea"
    try {
        $AndroidConnectivity = Invoke-RoutedWebRequest -Uri 'https://www.google.com/generate_204' -SkipHttpErrorCheck
    } catch {
        Write-Log "Android connectivity check failed: $($_.Exception.Message)" -Component "Test$ServiceArea" -Type 2
        return $false
    }
    if ($AndroidConnectivity.Response.StatusCode -ne 204) {
        Write-Log 'Android connectivity check failed - not testing any other addresses' -Component "Test$ServiceArea"
        return $false
    }
    $Googl = Get-URLsFromID -IDs $ServiceIDs
    if (-not($Googl)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($GoogleTarget in $Script:URLsToVerify) {
        Test-Network $GoogleTarget
    }
    return $true
}
function Test-CRL {
    <#
    .SYNOPSIS
    This will test all well-known CRLs by checking the availability of their respective URLs - _not_ the actual CRL.
    .NOTES
    ServiceIDs 84,125,9993
    Source: Martin Himken - this isn't well documented. From the MSJSON we can assume these are correct
    #>
    $ServiceIDs = 84, 125, 9993
    $ServiceArea = "CRL"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    Write-Log "CRLs should only ever be available through Port 80, however the MS-JSOn specifies 443 as well. Expect errors going forward" -Component "Test$ServiceArea"
    $CertRevocation = Get-URLsFromID -IDs $ServiceIDs
    if (-not($CertRevocation)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($CRLTarget in $Script:URLsToVerify) {
        Test-Network $CRLTarget
    }
    return $true
}
function Test-WindowsActivation {
    <#
    .SYNOPSIS
    This will test all URLs required for windows activation.
    .NOTES
    ServiceIDs 9991
    https://support.microsoft.com/en-us/topic/windows-activation-or-validation-fails-with-error-code-0x8004fe33-a9afe65e-230b-c1ed-3414-39acd7fddf52
    #>
    $ServiceIDs = 9991
    $ServiceArea = "WinAct"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    Write-Log 'These following URLs are best effort - there is very little documentation about this' -Component "Test$ServiceArea"
    $WinAct = Get-URLsFromID -IDs $ServiceIDs
    if (-not($WinAct)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($WinActTarget in $Script:URLsToVerify) {
        Test-Network $WinActTarget
    }
    return $true
}
function Test-EntraID {
    <#
    .SYNOPSIS
    This will test all URLs required for Entra ID.
    .NOTES
    ServiceIDs 9990 (125,84)
    https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-connectivity#connectivity-issues-in-the-installation-wizard
    "Of these URLs, the URLs listed in the following table are the absolute bare minimum to be able to connect to Microsoft Entra ID at all"
    As this list contains a lot of CRLs IDs 125 and 84 (Test-CRL) also apply here - this is more than the bare minimum but CRLs should always be reachable.
    #>
    $ServiceIDs = 9990
    $ServiceArea = "EID"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    Write-Log 'The following URLs are the bare minimum for EntraID to work - depending on the situation there might be more' -Component "Test$ServiceArea"
    $EID = Get-URLsFromID -IDs $ServiceIDs
    if (-not($EID)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($EIDTarget in $Script:URLsToVerify) {
        Test-Network $EIDTarget
    }
    if (-not($TestAllServiceAreas) -and -not($Autopilot)) {
        $TestCRLs = Test-CRL
        if (-not($TestCRLs)) {
            Write-Log "Testing CRLs for $ServiceArea failed" -Component "Test$ServiceArea" -Type 2
        }
    } else {
        Write-Log 'TestAllServiceAreas detected - not re-running sub-tests for this service area' -Component "Test$ServiceArea"
    }
    return $true
}
function Test-WindowsUpdate {
    <#
    .SYNOPSIS
    This will test all URLs required for Windows Update, this does not include delivery optimization.
    .NOTES
    ServiceIDs 164,172,9984
    https://learn.microsoft.com/en-us/troubleshoot/windows-client/installing-updates-features-roles/windows-update-issues-troubleshooting#device-cant-access-update-files
    #>
    $ServiceIDs = 164, 172, 9984
    $ServiceArea = "WU"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $WindowsUpdate = Get-URLsFromID -IDs $ServiceIDs
    if (-not($WindowsUpdate)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($WUTarget in $Script:URLsToVerify) {
        Test-Network $WUTarget
    }
    return $true
}
function Test-NTP {
    <#
    .SYNOPSIS
    This will test NTP through multiple methods, including sending an actual NTP request to Microsoft.
    .NOTES
    ServiceIDs 165
    https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints?#autopilot-dependencies
    Would throw 0x800705B4 if the URL exists but isn't an NTP or 0x80072AF9 for not resolved
    #>

    $ServiceIDs = 165
    $ServiceArea = "NTPServers"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    Write-Log 'Microsofts JSON claims more URLs for Port 123, where in reality its only time.windows.com' -Component "Test$ServiceArea"
    Write-Log 'There are more URLs related to NCSI in the Service ID 165, which will also be tested.' -Component "Test$ServiceArea" 
    $NTPServerNotDefault = $true
    $CurrentTimeServer = (Get-ItemPropertyValue -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Config\Status' -Name LastGoodSampleInfo -ErrorAction SilentlyContinue).split(';')[1]
    if ($CurrentTimeServer -like '*time.windows.com*') {
        $NTPServerNotDefault = $false
        Write-Log 'time.windows.com is the default timeserver - skipping custom server test' -Component "Test$ServiceArea"
    }
    if ($NTPServerNotDefault) {
        if ($Autopilot) {
            Write-Log 'time.windows.com is currently not the timeserver - this is a requirement for Autopilot' -Component "Test$ServiceArea" -Type 2
        }
        $CustomTimeServerTestResult = Test-NTPviaUDP $CurrentTimeServer -Port 123
    }
    Write-Log 'Testing default NTP server' -Component "Test$ServiceArea" 
    $DefaultTimeServerTestResult = w32tm /stripchart /computer:time.windows.com /dataonly /samples:3
    if ($DefaultTimeServerTestResult -like "*80072AF9*" -or $DefaultTimeServerTestResult[3 - ($DefaultTimeServerTestResult.count)] -like "*800705B4*") {
        Write-Log 'Testing with w32tm failed - switching to UDP test for NTP' -Component "Test$ServiceArea" -Type 2
        $DefaultTimeServerTestResult = Test-NTPviaUDP 'time.windows.com' -Port 123
    }
    if ($CustomTimeServerTestResult -or $DefaultTimeServerTestResult) {
        Write-Log "Custom NTP Server Test: $CustomTimeServerTestResult" -Component "Test$ServiceArea"
        Write-Log "Default NTP Server Test: $($null -ne $DefaultTimeServerTestResult)" -Component "Test$ServiceArea"
        $NTPServers = Get-URLsFromID -IDs $ServiceIDs -FilterPort 80, 443
        if (-not($NTPServers)) {
            Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
            return $false
        }
        foreach ($NTPServersTarget in $Script:URLsToVerify) {
            Test-Network $NTPServersTarget
        }
        return $true
    }
    Write-Log 'Both, custom and default, NTP servers tested did not answer as expected' -Component "Test$ServiceArea" -Type 3
    return $false
}
function Test-DiagnosticsData {
    <#
    .SYNOPSIS
    This tests all URLs required to send diagnostic data to Microsoft endpoints.
    .NOTES
    ServiceIDs 69,9983
    https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints
    #>
    $ServiceIDs = 69, 9983
    $ServiceArea = "Diagnostics"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $Diagnostics = Get-URLsFromID -IDs $ServiceIDs
    if (-not($Diagnostics)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($DiagnosticsTarget in $Script:URLsToVerify) {
        Test-Network $DiagnosticsTarget
    }
    return $true
}
function Test-DiagnosticsDataUpload {
    <#
    .SYNOPSIS
    This tests all URLs required to send collected diagnostics data to Intune (yes, the .zip file).
    .NOTES
    ServiceIDs 182,9989
    https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints?#autopilot-dependencies
    https://learn.microsoft.com/en-us/mem/intune/remote-actions/collect-diagnostics#requirements-for-windows-devices
    Also called "Autopilot automatic device diagnostics collection"
    #>
    $ServiceIDs = 182, 9989
    $ServiceArea = "DiagnosticsUpload"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $DiagUpload = Get-URLsFromID -IDs $ServiceIDs
    if (-not($DiagUpload)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($DiagUploadTarget in $Script:URLsToVerify) {
        Test-Network $DiagUploadTarget
    }
    return $true
}
function Test-EndpointAnalytics {
    <#
    .SYNOPSIS
    This will test all URLs required for endpoint analytics to receive data.
    .NOTES
    ServiceIDs 69,163,9988
    https://learn.microsoft.com/en-us/mem/analytics/troubleshoot#bkmk_endpoints
    #>
    $ServiceIDs = 69, 163, 9988
    $ServiceArea = "EndpAnalytics"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $EndpAnalytics = Get-URLsFromID -IDs $ServiceIDs
    if (-not($EndpAnalytics)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($EndpAnalyticsTarget in $Script:URLsToVerify) {
        Test-Network $EndpAnalyticsTarget
    }
    return $true
}
function Test-NCSI {
    <#
    .SYNOPSIS
    This tests all the URLs required for the network connection status indicator to work.
    .NOTES
    ServiceIDs 165,9987
    https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints
    https://learn.microsoft.com/en-us/windows/privacy/manage-windows-21h2-endpoints
    #>
    $ServiceIDs = 165, 9987
    $ServiceArea = "NetworkIndicator"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    Write-Log "Service ID 165 is mixed up with NTP, hence Service ID 9987 is required to only test the correct URLs and ports" -Component "Test$ServiceArea" -Type 2
    try {
        $NCSIActive = (Get-ItemPropertyValue -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator -Name NoActiveProbe -ErrorAction Stop | Out-Null) -eq 0
    } catch {
        $NCSIActive = $true
    }
    if (-not($NCSIActive)) {
        Write-Log 'The NCSI has been detected as disabled - continuing with network tests regardless' -Component "Test$ServiceArea" -Type 2
    }
    $NetworkIndicator = Get-URLsFromID -IDs $ServiceIDs -FilterPort 123
    if (-not($NetworkIndicator)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($NetworkIndicatorTarget in $Script:URLsToVerify) {
        Test-Network $NetworkIndicatorTarget
    }
    return $true
}
function Test-MicrosoftStore {
    <#
    .SYNOPSIS
    This tests all the URLs that are required for the Microsoft Store to work. This includes Store updates.
    .NOTES
    ServiceIDs 9996
    https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints 
    https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints?#microsoft-store
    #>
    $ServiceIDs = 9996
    $ServiceArea = "MS"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $MicrosoftStore = Get-URLsFromID -IDs $ServiceIDs
    if (-not($MicrosoftStore)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($MSTarget in $Script:URLsToVerify) {
        Test-Network $MSTarget
    }
    if (-not($TestAllServiceAreas)) {
        $WNSTest = Test-WNS
        $DOTest = Test-DeliveryOptimization
        if (-not($WNSTest -and $DOTest)) {
            return $false
        }
    } else {
        Write-Log 'TestAllServiceAreas detected - not re-running sub-tests for this service area' -Component "Test$ServiceArea"
    }
    return $true
}
function Test-AppInstaller {
    <#
    .SYNOPSIS
    This tests all the URLs that are required for the AppInstaller to work. This includes winget.
    .NOTES
    ServiceIDs 9996
    https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints?#microsoft-store
    #>
    $ServiceArea = "AppInstall"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    Write-Log "Testing $ServiceArea is the same requirement as for the Microsoft store, this doesn't include downloads from vendor setup files (which depend on each package)" -Component "Test$ServiceArea" -Type 2
    if ($TestAllServiceAreas) {
        Write-Log 'TestAllServiceAreas detected - not re-running sub-tests for this service area' -Component "Test$ServiceArea"
        return $true
    }
    $TestMSStore = Test-MicrosoftStore
    if (-not($TestMSStore)) {
        Write-Log 'Testing the Microsoft store failed' -Component "Test$ServiceArea"
    }
    return $true
}
function Test-SelfDeploying {
    <#
    .SYNOPSIS
    This will test all the URLs that are required for the Autopilot self-deployment mode to work.
    .NOTES
    ServiceID 173, 9998
    https://learn.microsoft.com/en-us/autopilot/requirements?tabs=networking#autopilot-self-deploying-mode-and-autopilot-pre-provisioning
    #>
    $ServiceIDs = 173, 9998
    $ServiceArea = "SelfDepl"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $SelfDepl = Get-URLsFromID -IDs $ServiceIDs
    if (-not($SelfDepl)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($SelfDeplTarget in $Script:URLsToVerify) {
        Test-Network $SelfDeplTarget
    }
    return $true
}
function Test-Legacy {
    <#
    .NOTES
    Test-Hybrid Join? This might prove hard, as this is hardly documented (sure, it needs Entra-ID, but AD connectivity?)
    ToDo
    #>
}
function Test-UniversalPrint {
    <#
    .SYNOPSIS
    This will test all the URLs that are required for Universal Print
    .NOTES
    ServiceID 9982,9981,9980
    https://learn.microsoft.com/en-us/universal-print/fundamentals/universal-print-faqs
    As this is a script that tests client connections, the connector URLs are _not tested_. 
    Applicationinsight addresses are not documented. You can look at these by running "az account list-locations -o table"
    #>
    $ServiceIDs = 9982, 9980
    if ($GCC) {
        $ServiceIDs = 9981, 9980
    }
    $ServiceArea = "UniP"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $UniP = Get-URLsFromID -IDs $ServiceIDs
    if (-not($UniP)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($UniPTarget in $Script:URLsToVerify) {
        Test-Network $UniPTarget
    }
    return $true
}

function Test-TrustMeBro {
    <#
    .SYNOPSIS
    Tests custom URLs that are not assigned to another Artificial Service Area or Product.
    .NOTES
    ServiceID 10000
    #>
    $ServiceIDs = 10000
    $ServiceArea = "TrustMeBro"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $TrustMeBroURLs = Get-URLsFromID -IDs $ServiceIDs
    if (-not($TrustMeBroURLs)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($TrustMeBroTarget in $Script:URLsToVerify) {
        Test-Network $TrustMeBroTarget
    }
    return $true
}

#Products
function Test-ConnectedCache {
    <#
    .SYNOPSIS
    This will test all URLs required for connected cache.
    .NOTES
    ServiceIDs 5000..5010
    (URL is misleadingly named as "Delivery-Optimization-Endpoints" but is actually about MCC)
    https://learn.microsoft.com/en-us/windows/deployment/do/delivery-optimization-endpoints 
    #>
    $ServiceIDs = 5000..5010
    $ServiceArea = "MCC"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    Write-Log 'This service area will also test for MCC domains being available' -Component "Test$ServiceArea"
    $ConnectedCache = Get-URLsFromID -IDs $ServiceIDs -FilterPort 7680, 3544
    if (-not($ConnectedCache)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($MCCTarget in $Script:URLsToVerify) {
        Test-Network $MCCTarget
    }
    return $true
}
function Test-VisualStudio {
    <#
    .SYNOPSIS
    This will test all the URLs that are required to "Use Visual Studio"
    .NOTES
    ServiceID 9978,9977,9976,56,89,97
    https://learn.microsoft.com/en-us/visualstudio/install/install-and-use-visual-studio-behind-a-firewall-or-proxy-server
    As this is a script that tests client connections, the connector URLs are _not tested_. 
    Not enough data, hence not included (some areas might still be covered by other entries): 
        * Cloud Explorer (missing)
        * Cloud Services (partially covered)
        * Service Fabric (partially covered)
    The list also has many entries using wildcards, that are environment specific, hence not included.
    #>
    [string[]]$ServiceIDs = @()
    if ($VisualStudioInstallation) {
        $ServiceIDs = 9978, 9977, 56, 89, 97
    }
    if ($VisualStudioFull) {
        $ServiceIDs += 9976
    }
    $ServiceArea = "VSt"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $VSt = Get-URLsFromID -IDs $ServiceIDs
    if (-not($VSt)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($VStTarget in $Script:URLsToVerify) {
        Test-Network $VStTarget
    }
    return $true
}
function Test-MDE {
    <#
    .SYNOPSIS
    Test all URLs required to use Microsoft Defender for Endpoint.
    .NOTES
    ServiceIDs 6000, 6001, 6002, 6003
    6000 = Core, 6001 = SmartScreen, 6002 = LiveResponse, 6003 = VulnerabilityManagement
    Now, this is exctracted from an .xlsx file, so it may not include all URLs. 
    **This method requires the custom CSV from this repo.**
    https://aka.ms/MDE-streamlined-urls
    Use this tool to do further testing https://aka.ms/mdeanalyzer
    #>
    [string[]]$ServiceIDs = @()
    if ($DefenderFull) {
        $ServiceIDs += 6000
    }
    if ($DefenderSmartScreen -or $DefenderFull -or $DefenderOptional) {
        $ServiceIDs += 6001
    }
    if ($DefenderLiveResponse -or $DefenderFull -or $DefenderOptional) {
        [int[]]$ServiceIDs += 6002
    }
    if ($DefenderVulnTool -or $DefenderFull -or $DefenderOptional) {
        $ServiceIDs += 6003
    }
    $ServiceIDs = 6000, 6001, 6002, 6003
    $ServiceArea = "Defender"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $Defender = Get-URLsFromID -IDs $ServiceIDs
    if (-not($Defender)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($DefenderTarget in $Script:URLsToVerify) {
        Test-Network $DefenderTarget
    }
    return $true  
}
#Special tests, not service area specific
function Test-AuthenticatedProxy {
    <#
    .SYNOPSIS
    This will attempt to test if an authenticated proxy is being used for URLs marked as incompatible with such a system.
    .NOTES
    ServiceIDs 9986
    These URLs don't allow authenticated proxies according to https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints?tabs=europe#access-for-managed-devices 
    This will use something.azureedge.com as an example for *.azureedge.com - yes, that is not a documented address.
    #>
    $ServiceIDs = 9986
    $ServiceArea = "AuthenProxy"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $AuthenProxy = Get-URLsFromID -IDs $ServiceIDs
    if (-not($AuthenProxy)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($AuthenProxyTarget in $Script:URLsToVerify) {
        Test-Network $AuthenProxyTarget
        if ($($Script:FinalResultList | Where-Object { ($_.url -eq $AuthenProxyTarget.url -and $_.port -eq $AuthenProxyTarget.port) -and ($_.HTTPStatusCode -in 407, 403, 401 ) })) {
            Write-Log -Message "The URL $($AuthenProxyTarget.url) requested authentication - this is not supported!" -Component "Test$ServiceArea" -Type 3
        }
    }
    return $true
}
function Test-SSLInspection {
    <#
    .SYNOPSIS
    This will attempt to test if an TLS/SSL inspection is being used for URLs marked as incompatible with such a system.
    .NOTES
    ServiceIDs 9985
    https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints?tabs=north-america#access-for-managed-devices
    This uses checkin.dm.microsoft.com as a standin for *.dm.microsoft.com - could use discovery.dm.microsoft.com as fallback
    #>
    $ServiceIDs = 9985
    $ServiceArea = "TLSInspec"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $TLSInspec = Get-URLsFromID -IDs $ServiceIDs
    if (-not($TLSInspec)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($TLSInspecTarget in $Script:URLsToVerify) {
        Test-Network $TLSInspecTarget
    }
    if (-not($TestAllServiceAreas)) {
        $DeviceHealthTest = Test-DeviceHealth
        if (-not($DeviceHealthTest)) {
            return $false
        }
    } else {
        Write-Log 'TestAllServiceAreas detected - not re-running sub-tests for this service area' -Component "Test$ServiceArea"
    }
    foreach ($TLSInspectObject in $Script:FinalResultList) {
        if ($($Script:FinalResultList | Where-Object { $_.url -eq $TLSInspectObject.url -and $_.port -eq $TLSInspectObject.port -and $_.SSLInspection -eq 'True' })) {
            Write-Log -Message "The traffic to $($TLSInspectObject.url) is probably inspected - this is not supported!" -Component "Test$ServiceArea" -Type 3
        }
    }
    return $true
}
function Test-M365 {
    <#
    .SYNOPSIS
    Yes, this will test _every_ M365 Common URL regardless if it's required or not. Prepare for 15 minutes of runtime minimum.
    .NOTES
    ServiceIDs yes
    https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?
    #>
    $ServiceIDs = 41, 43, 44, 45, 46, 47, 49, 50, 51, 53, 56, 59, 64, 66, 67, 68, 69, 70, 71, 73, 75, 78, 79, 83, 84, 86, 89, 91, 92, 93, 95, 96, 97, 105, 114, 116, 117, 118, 121, 122, 124, 125, 126, 147, 152, 153, 156, 158, 159, 160, 184
    $ServiceArea = "MS365"
    if (-not($UseMS365JSON)) {
        Write-Log 'UseMS365JSON was not specified. This test can not be performed, because most IDs are not available' -Component "Test$ServiceArea" -Type 3
        return $false
    }
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $M365FullTest = Get-URLsFromID -IDs $ServiceIDs
    if (-not($M365FullTest)) {
        Write-Log -Message 'No matching ID found for service area: Windows Update' -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($M365Target in $Script:URLsToVerify) {
        Test-Network $M365Target
    }
    return $true
}
function Test-AppAndScripts {
    <#
    .SYNOPSIS
    This will test all the URLs that are required for Win32 App deployment and PowerShell Script Deployment for Windows and Mac
    .NOTES
    ServiceID 170
    https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints?#network-requirements-for-powershell-scripts-and-win32-apps
    #>
    $ServiceIDs = 170, 9979
    $ServiceArea = "W32Script"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $W32Script = Get-URLsFromID -IDs $ServiceIDs
    if (-not($W32Script)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($W32ScriptTarget in $Script:URLsToVerify) {
        Test-Network $W32ScriptTarget
    }
    return $true
}
function Test-NuGet {
    <#
    .SYNOPSIS
    Test all URLs required to use NuGet aka PowerShell Gallery
    .NOTES
    ServiceIDs 9975
    https://learn.microsoft.com/en-us/powershell/gallery/how-to/getting-support/troubleshooting-cmdlets?view=powershellget-3.x#required-network-endpoints
    #>
    $ServiceIDs = 9975
    $ServiceArea = "NuGet"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $NuGet = Get-URLsFromID -IDs $ServiceIDs
    if (-not($NuGet)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($NuGetTarget in $Script:URLsToVerify) {
        Test-Network $NuGetTarget
    }
    return $true
}
function Get-FailedTestSummary {
    param([hashtable]$Results)
    $FailedTests = @($Results.GetEnumerator() | Where-Object { $_.Value -eq $false } | Sort-Object -Property Key | ForEach-Object { $_.Key })
    if ($FailedTests.Count) {
        return "Failed child tests: $($FailedTests -join ', ')"
    }
    return 'No failed child tests'
}
function Test-Autopilot {
    <#
    .SYNOPSIS
    Test all URLs required to use Autopilot. This also includes a lot of other service areas.
    .NOTES
    ServiceIDs 164,165,169,173,182,9999
    9999 = Autopilot
    https://learn.microsoft.com/en-us/autopilot/requirements?tabs=networking#windows-autopilot-deployment-service
    Autopilot dependencies according to https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints?#autopilot-dependencies
    #>
    $ServiceIDs = '9999'
    $ServiceArea = 'AP'
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $AP = Get-URLsFromID -IDs $ServiceIDs
    if (-not($AP)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($APTarget in $Script:URLsToVerify) {
        Test-Network $APTarget
    }
    <#
    Test-NTP #165
    Test-WNS #169
    Test-TPMAttestation #173
    Test-DeliveryOptimization #164
    Test-DiagnosticsDataUpload #182
    #>
    $resultlist = @{
        TestWindowsActivation = Test-WindowsActivation
        EntraIDTest           = Test-EntraID
        DiagnosticsDataUTest  = Test-DiagnosticsDataUpload 
        WUTest                = Test-WindowsUpdate
        DOTest                = Test-DeliveryOptimization
        NTPTest               = Test-NTP
        DNSTest               = Test-DNSServers #Log only output!
        DiagnosticsDataTest   = Test-DiagnosticsData
        NCSITest              = Test-NCSI
        WNSTest               = Test-WNS
        StoreTest             = Test-MicrosoftStore
        CRLTest               = Test-CRL
        LegacyTest            = Test-Legacy
        SelfDeployingTest     = Test-SelfDeploying
        TPMAttTest            = Test-TPMAttestation
    }
    if ($resultlist.values -contains $false) {
        Write-Log -Message (Get-FailedTestSummary -Results $resultlist) -Component "Test$ServiceArea" -Type 3
        return $false
    }
    return $true
}
function Test-Intune {
    <#
    .SYNOPSIS
    Test all URLs required to use Intune. This also includes a lot of other service areas.
    .NOTES
    ServiceIDs 163,172,170,97,190,189 + Authentiation 56,150,59
    https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints
    #>
    $ServiceIDs = 56, 150, 59, 163, 172, 170, 97, 190, 189, 9998, 9985, 9997
    $ServiceArea = "Int"
    Write-Log "Testing Service Area $ServiceArea" -Component "Test$ServiceArea"
    $Int = Get-URLsFromID -IDs $ServiceIDs
    if (-not($Int)) {
        Write-Log -Message "No matching ID found for service area: $ServiceArea" -Component "Test$ServiceArea" -Type 3
        return $false
    }
    foreach ($IntTarget in $Script:URLsToVerify) {
        Test-Network $IntTarget
    }
    $resultlist = @{
        TestAutoPilot       = Test-Autopilot
        RemoteHelpTest      = Test-RemoteHelp
        WNSTest             = Test-WNS
        DOTest              = Test-DeliveryOptimization
        AppleTest           = Test-Apple
        AndroidTest         = Test-Android
        StoreTest           = Test-MicrosoftStore
        DeviceHealth        = Test-DeviceHealth
        WUTest              = Test-WindowsUpdate
        EndpAnalytics       = Test-EndpointAnalytics
        DiagnosticsDataTest = Test-DiagnosticsData
        NTPTest             = Test-NTP
        AppAndScript        = Test-AppAndScripts
    }
    if ($resultlist.values -contains $false) {
        Write-Log -Message (Get-FailedTestSummary -Results $resultlist) -Component "Test$ServiceArea" -Type 3
        return $false
    }
    return $true
}

#Data Functions
function Build-OutputCSV {
    <#
    .SYNOPSIS
    Creates either a URL result list or a merged CSV file.
    #>
    param(
        [string[]]$InputCSVs
    )
    if (-not($InputCSVs)) {
        $OutpathFilePath = $(Join-Path $Script:OutpathFilePath -ChildPath "\ResultList$("_"+$Script:DateTime + "_"+ $Env:COMPUTERNAME).csv")
        $Script:FinalResultList | Export-Csv -Path $OutpathFilePath -Encoding utf8
    } elseif ($InputCSVs.Count -eq 2) {
        $MergedCSVTargetFolder = $(Join-Path $Script:WorkingDirectory -ChildPath '/MergedResults')
        if (-not(Test-Path $MergedCSVTargetFolder)) { New-Item -Path $MergedCSVTargetFolder -ItemType Directory | Out-Null }
        $OutpathFilePath = $(Join-Path $MergedCSVTargetFolder -ChildPath "/MergedResults$("_"+$Script:DateTime + "_"+ $Script:MergeCSVComputername1 + "_" + $Script:MergeCSVComputername2).csv")
        $Script:ComparedResults | Export-Csv -Path $OutpathFilePath -Encoding utf8 -Force
    }
}
function Merge-ResultFiles {
    <#
    .SYNOPSIS
    Merges two given CSV files.
    #>
    param(
        [PSCustomObject[]]$CSVInput
    )
    if ($CSVInput) {
        if ($CSVInput.count -ne 2) {
            Write-Log 'Currently, this script can only handle two file comparisons. Please provide only 2 CSVs' -Component 'MergeResultFiles' -Type 3
        }
    } elseif(Start-CSVAutodetection) {
        $CSVInput = $Script:AutodetectedCSVs
    }
    else{
        Write-Log 'No input CSVs given and auto detection failed - please provide two CSV files to compare' -Component 'MergeResultFiles' -Type 3
        return $false
    }

    $Script:ComparedResults = [System.Collections.ArrayList]::new()
    for ($i = 0; $i -lt $CSVInput.Count; $i++) {
        if (Test-Path $CSVInput[$i]) {
            [System.IO.DirectoryInfo]$CSVPath = $CSVInput[$i]
        } else {
            [System.IO.DirectoryInfo]$CSVPath = Join-Path -Path $Script:OutpathFilePath -ChildPath $CSVInput[$i]
        }
        if (-not(Test-Path $CSVPath)) {
            Write-Log "File $($CSVPath) not found" -Component 'MergeResultFiles' -Type 3
            return $false
        }
        $culture = [Globalization.CultureInfo]::CreateSpecificCulture('de-DE')
        $TimeStamp = Get-Date([DateTime]::ParseExact("$($CSVPath.name.Replace('ResultList_','').substring(0,15))", 'yyyyMMdd_HHmmss', $culture)) -Format "dd.MM.yyyy HH:mm:ss"
        $CSVComputername = $($CSVPath.name.Split('_')[3].split('.')[0])
        if ($i -ge 1) {
            if ($CSVComputername -eq $Script:MergeCSVComputername1) {
                $CSVComputername = $CSVComputername + "_SameComputer"
            }
        }
        New-Variable "MergeCSVComputername$($i+1)" -Value $CSVComputername -Scope Script
        New-Variable "MergeCSVTimestamp$($i+1)" -Value $TimeStamp -Scope Script
        New-Variable "ImportedCSV$($i+1)" -Value $(Import-Csv -Path $CSVPath)
    }
    Write-Log 'CSV imported - checking and merging' -Component 'MergeResultFiles'
    if ($MergeShowAllResults) { Write-Log 'MergeShowAllResults is selected. All results will be merge into one result output instead of showing only differences' -Component 'MergeResultFiles' }
    $ResultProperties = 'ID', 'URL', 'Port', 'Protocol', 'ConnectionMethod', 'ProxyAddress', 'ProxyBypassed', 'ProxyError', 'DNSResult', 'TCPResult', 'HTTPStatusCode', 'SSLTest', 'SSLProtocol', 'Issuer', 'AuthException', 'SSLInterception'
    $GetResultKey = {
        param($Object)
        $Method = if ($Object.ConnectionMethod) { $Object.ConnectionMethod } else { 'Direct' }
        "$($Object.ID)|$($Object.URL)|$($Object.Port)|$($Object.Protocol)|$Method"
    }
    $LeftResults = @{}
    $RightResults = @{}
    foreach ($Object in $ImportedCSV1) { $LeftResults[(& $GetResultKey $Object)] = $Object }
    foreach ($Object in $ImportedCSV2) { $RightResults[(& $GetResultKey $Object)] = $Object }
    $AllKeys = @($LeftResults.Keys + $RightResults.Keys | Sort-Object -Unique)
    foreach ($Key in $AllKeys) {
        $CSVLeftObject = $LeftResults[$Key]
        $CSVRightObject = $RightResults[$Key]
        $ComparisonStatus = if (-not($CSVLeftObject)) { 'OnlyInSecond' } elseif (-not($CSVRightObject)) { 'OnlyInFirst' } elseif (Compare-Object -ReferenceObject $CSVLeftObject -DifferenceObject $CSVRightObject -Property $ResultProperties) { 'Changed' } else { 'Unchanged' }
        if ($ComparisonStatus -ne 'Unchanged') {
            Write-Log "Result $ComparisonStatus for $Key" -Component 'MergeResultFiles'
        }
        if ($ComparisonStatus -ne 'Unchanged' -or $MergeShowAllResults) {
            if ($CSVLeftObject) {
                $CSVLeftObject | Add-Member -Name 'ComputerName' -MemberType NoteProperty -Value "$($Script:MergeCSVComputername1)" -Force
                $CSVLeftObject | Add-Member -Name 'TimeStamp' -MemberType NoteProperty -Value "$($Script:MergeCSVTimestamp1)" -Force
                $CSVLeftObject | Add-Member -Name 'ComparisonStatus' -MemberType NoteProperty -Value $ComparisonStatus -Force
                $Script:ComparedResults.add($CSVLeftObject) | Out-Null
            }
            if ($CSVRightObject -and $ComparisonStatus -ne 'Unchanged') {
                $CSVRightObject | Add-Member -Name 'ComputerName' -MemberType NoteProperty -Value "$($Script:MergeCSVComputername2)" -Force
                $CSVRightObject | Add-Member -Name 'TimeStamp' -MemberType NoteProperty -Value "$($Script:MergeCSVTimestamp2)" -Force
                $CSVRightObject | Add-Member -Name 'ComparisonStatus' -MemberType NoteProperty -Value $ComparisonStatus -Force
                $Script:ComparedResults.add($CSVRightObject) | Out-Null
            }
        }
    }
    $Script:ComparedResults = $Script:ComparedResults | Sort-Object -Property url, port, ConnectionMethod, ComputerName
    return $true
}
function Start-Tests {
    <#
    .SYNOPSIS
    Starts either all, specific, or individual tests based on user input.
    #>
    if ($Intune -or $TestAllServiceAreas) {
        Write-Log -Message "Intune result: $(Test-Intune)" -Component 'StartTests'
    }
    if ($Autopilot -or $TestAllServiceAreas) {
        Write-Log -Message "Autopilot result: $(Test-Autopilot)" -Component 'StartTests'
    }
    if ($WindowsActivation -or $TestAllServiceAreas) {
        Write-Log -Message "Windows activation result: $(Test-WindowsActivation)" -Component 'StartTests'
    }
    if ($EntraID -or $TestAllServiceAreas) {
        Write-Log -Message "Entra ID result: $(Test-EntraID)" -Component 'StartTests'
    }
    if ($WindowsUpdate -or $TestAllServiceAreas) {
        Write-Log -Message "Windows Update result: $(Test-WindowsUpdate)" -Component 'StartTests'
    }
    if ($DeliveryOptimization -or $TestAllServiceAreas) {
        Write-Log -Message "Delivery Optimization result: $(Test-DeliveryOptimization)" -Component 'StartTests'
    }
    if ($NTP -or $TestAllServiceAreas) {
        Write-Log -Message "NTP result: $(Test-NTP)" -Component 'StartTests'
    }
    if ($DNS -or $TestAllServiceAreas) {
        Write-Log -Message "DNS result: $(Test-DNSServers)" -Component 'StartTests'
    }
    if ($DiagnosticsData -or $TestAllServiceAreas) {
        Write-Log -Message "Diagnostics Data result: $(Test-DiagnosticsData)" -Component 'StartTests'
    }
    if ($DiagnosticsDataUpload -or $TestAllServiceAreas) {
        Write-Log -Message "Diagnostics Data Upload result: $(Test-DiagnosticsDataUpload)" -Component 'StartTests'
    }
    if ($NCSI -or $TestAllServiceAreas) {
        Write-Log -Message "NCSI result: $(Test-NCSI)" -Component 'StartTests'
    }
    if ($WindowsNotificationService -or $TestAllServiceAreas) {
        Write-Log -Message "WNS result: $(Test-WNS)" -Component 'StartTests'
    }
    if ($WindowsStore -or $TestAllServiceAreas) {
        Write-Log -Message "Windows Store result: $(Test-MicrosoftStore)" -Component 'StartTests'
    }
    if ($M365 -or $TestAllServiceAreas) {
        Write-Log -Message "M365 result: $(Test-M365)" -Component 'StartTests'
    }
    if ($CRLs -or $TestAllServiceAreas) {
        Write-Log -Message "CRLs result: $(Test-CRL)" -Component 'StartTests'
    }
    if ($SelfDeploying -or $TestAllServiceAreas) {
        Write-Log -Message "Self-Deploying result: $(Test-SelfDeploying)" -Component 'StartTests'
    }
    if ($RemoteHelp -or $TestAllServiceAreas) {
        Write-Log -Message "Remote Help result: $(Test-RemoteHelp)" -Component 'StartTests'
    }
    if ($TPMAttestation -or $TestAllServiceAreas) {
        Write-Log -Message "TPM Attestation result: $(Test-TPMAttestation)" -Component 'StartTests'
    }
    if ($DeviceHealth -or $TestAllServiceAreas) {
        Write-Log -Message "Device Health result: $(Test-DeviceHealth)" -Component 'StartTests'
    }
    if ($Apple -or $TestAllServiceAreas) {
        Write-Log -Message "Apple result: $(Test-Apple)" -Component 'StartTests'
    }
    if ($Android -or $TestAllServiceAreas) {
        Write-Log -Message "Android result: $(Test-Android)" -Component 'StartTests'
    }
    if ($EndpointAnalytics -or $TestAllServiceAreas) {
        Write-Log -Message "Endpoint Analytics result: $(Test-EndpointAnalytics)" -Component 'StartTests'
    }
    if ($AppInstaller -or $TestAllServiceAreas) {
        Write-Log -Message "App Installer result: $(Test-AppInstaller)" -Component 'StartTests'
    }
    if ($AuthenticatedProxyOnly -or $TestAllServiceAreas) {
        Write-Log -Message "Authenticated Proxy result: $(Test-AuthenticatedProxy)" -Component 'StartTests'
    }
    if ($TestSSLInspectionOnly -or $TestAllServiceAreas) {
        Write-Log -Message "SSL Inspection result: $(Test-SSLInspection)" -Component 'StartTests'
    }
    if ($Legacy -or $TestAllServiceAreas) {
        Write-Log -Message "Legacy result: $(Test-Legacy)" -Component 'StartTests'
    }
    if ($UniversalPrint -or $TestAllServiceAreas) {
        Write-Log -Message "Universal Print result: $(Test-UniversalPrint)" -Component 'StartTests'
    }
    if ($AppAndScript -or $TestAllServiceAreas) {
        Write-Log -Message "Win32 and Script deployment result: $(Test-AppAndScripts)" -Component 'StartTests'
    }
    if ($NuGet -or $TestAllServiceAreas) {
        Write-Log -Message "NuGet deployment result: $(Test-NuGet)" -Component 'StartTests'
    }
    if ($TrustMeBro) {
        Write-Log -Message "TrustMeBro result: $(Test-TrustMeBro)" -Component 'StartTests'
    }
    if ( $ConnectedCache ) {
        Write-Log -Message "Connected Cache result: $(Test-ConnectedCache)" -Component 'StartTests'
    }
    if ($VisualStudioFull -or $VisualStudioInstallation) {
        Write-Log -Message "Visual Studio Full result: $(Test-VisualStudio)" -Component 'StartTests'
    }
    if ($DefenderFull -or $DefenderSmartScreen -or $DefenderLiveResponse -or $DefenderVulnTool -or $DefenderOptional) {
        Write-Log -Message "Microsoft Defender for Endpoint result: $(Test-MDE)" -Component 'StartTests'
    }
}
function Start-Brienmode {
    $Null = Read-Host -Prompt "Please press any key to continue"
    Initialize-Script
    Start-Tests
}
function Start-CSVAutodetection {
    param(
        [switch]$NoPrompt
    )
    <#
    .NOTES
    This function will automatically detect the two latest CSV files in the output folder and set them as input for merging.
    #>
    $Candidates = @()
    if ($Script:OutpathFilePath -and (Test-Path $Script:OutpathFilePath)) {
        Write-Log "Looking for CSV files in $($Script:OutpathFilePath)" -Component 'StartCSVAutodetection'
        $Candidates = (Get-ChildItem -Path $Script:OutpathFilePath -Filter "ResultList*.csv" | Sort-Object -Property LastWriteTime -Top 2 -Descending).FullName
    }
    if ($Candidates.Count -ne 2) {
        Write-Log "Looking for CSV files in $WorkingDirectory" -Component 'StartCSVAutodetection'
        $Candidates = (Get-ChildItem -Path $WorkingDirectory -Filter "ResultList*.csv" -Recurse | Sort-Object -Property LastWriteTime -Top 2 -Descending).FullName
    }
    if ($Candidates.Count -ne 2) {
        Write-Log -Message 'Auto-detection did not find exactly two CSV files for merging' -Component 'StartCSVAutodetection' -Type 3
        return $false
    }
    Write-Log -Message "Auto-detected CSVs: $($Candidates -join ', ')" -Component 'StartCSVAutodetection'
    if ($NoPrompt) {
        #Automatically confirm
        $Confirmation = 'Y'
    } else {
        #Prompt user for confirmation
        $Confirmation = Read-Host -Prompt "Files:$($Candidates -join ', ') `nDo you want to use these files for merging? (Y/N)"
    }
    if ($Confirmation -ne 'Y') {
        Write-Log -Message 'User opted out of using auto-detected CSVs' -Component 'StartCSVAutodetection' -Type 3
        return $false
    }
    $Script:AutodetectedCSVs = $Candidates
    return $true
}
function Start-ProcessingResults {
    if ($BrienMode) {
        Write-Output "BrienMode is activated: This is an interactive mode that will let you test multiple times on the same box"
        Write-Output "Remember this will only compare the LATEST TWO results"
        for ($i = 1; $i -le $BrienMode; $i++) {
            if ($i -ge 2) {
                Write-Log -Message 'RERUNNING TESTS WITH NEW NETWORK PARAMETERS' -Component 'BrienMode' -Type 2
                Write-Warning "Please change your network now to run the test again - this will always create output CSVs"
            }
            Start-Brienmode
            Build-OutputCSV
            if ($ShowResults) {
                $Script:FinalResultList | Out-GridView -Title "Intune Network test (Brien Mode) $($Script:MergeCSVComputername1) pass $i"
            }
        }
        Start-CSVAutodetection -NoPrompt
        #$MergeCSVs = (Get-ChildItem -Path $Script:OutpathFilePath -Filter *.csv | Sort-Object -Property LastWriteTime -Top 2 -Descending).FullName
        if (-not(Merge-ResultFiles -CSVInput $MergeCSVs)) {
            Write-Log 'BRIENMODE: Something went wrong while comparing the files, please check the logs' -Component 'ProcessingResults' -Type 2
            return $false
        }
        if (-not($Script:ComparedResults)) {
            Write-Log 'BRIENMODE: The comparison found no differences between the two provided CSVs' -Component 'ProcessingResults' -Type 2
        } else {
            if ($ShowResults) {
                $Script:ComparedResults | Sort-Object -Property url | Out-GridView -Title "BRIENMODE: Merge result between: $($Script:MergeCSVComputername1) and $($Script:MergeCSVComputername2)" -Wait
            }
            Build-OutputCSV -InputCSVs $MergeCSVs
        }
    } else {
        if ($OutputCSV -and -not($MergeResults)) {
            Build-OutputCSV
        }
        if ($MergeResults) {
            Write-Log 'Merging two provided CSV files' -Component 'ProcessingResults'
            if (-not($MergeCSVs) -or $MergeCSVs.count -ne 2) {
                if (-not(Start-CSVAutodetection)) {
                    Write-Log 'Merging results aborted' -Component 'ProcessingResults' -Type 2
                    return
                }
                $MergeCSVs = $Script:AutodetectedCSVs
            }
            if (-not(Merge-ResultFiles -CSVInput $MergeCSVs)) {
                Write-Log 'The comparison found no differences between the two provided CSVs' -Component 'ProcessingResults' -Type 2
            } else {
                if ($ShowResults) {
                    $Script:ComparedResults | Sort-Object -Property url | Out-GridView -Title "Merge result between: $($Script:MergeCSVComputername1) and $($Script:MergeCSVComputername2)" -Wait
                }
                if ($OutputCSV) {
                    Build-OutputCSV -InputCSVs $MergeCSVs
                }
            }
        }
        if ($ShowResults) {
            $Script:FinalResultList | Out-GridView -Title 'Intune Network test results' -Wait
        }
    }   
}

#Start coding!
Initialize-Script
if (-not($BrienMode)) {
    Start-Tests
}
Start-ProcessingResults
Write-SettingsToLog
Write-Log 'Thanks for using INR' -Component 'INRMain'
Set-Location $CurrentLocation
Exit 0