microsoft-365

Audit MFA enrollment across all M365 users, highlighting accounts with no MFA

Run the complete CIPP M365 offboarding workflow for a departing user - capture audit state, revoke access, handle mailbox, reclaim licenses

Generate a portfolio-wide M365 security posture report - Secure Score equivalents, MFA enrollment, conditional access coverage, and domain authentication across all managed tenants

Find tenants that have drifted from the MSP's configured CIPP standards baseline - missing standards, standards in Report-only mode, recent compliance failures

Quick health snapshot for a single tenant - BPA failures, conditional access enforcement, MFA gaps, domain authentication, standards compliance

Use this agent when an MSP technician, service-desk analyst, account manager, or vCISO needs to answer questions about a client's Microsoft Entra (Azure AD) identity and directory data - user and license counts, MFA registration gaps, guest inventory, inactive accounts, app inventory, directory roles, sign-in activity. Trigger for identity reporting, QBR prep, helpdesk lookups, onboarding directory snapshots, and identity hygiene audits. Examples - "How many users does Contoso have?", "Which admins haven't registered MFA?", "List the guest accounts in this tenant", "Are we paying for licenses nobody uses?", "Pull an Entra directory snapshot for the QBR", "Who has Global Administrator in this tenant?"

Use this agent when an MSP needs to perform a comprehensive Microsoft 365 tenant security audit. Trigger for: M365 security audit, MFA gaps, risky users, license waste, over-privileged accounts, suspicious sign-ins, guest user review, conditional access review, mailbox audit. Examples: "audit our client's M365 tenant for security issues", "find all users without MFA in M365", "show me over-privileged accounts and license waste for Contoso"

Use this agent when an MSP needs to audit Microsoft 365 license costs and find savings opportunities across a client tenant. Trigger for: M365 license cost, unused M365 licenses, license rightsizing, disabled account licenses, duplicate M365 licensing, E3 add-on overlap, M365 spend optimization, license waste M365. Examples: "find unused M365 licenses for Contoso", "which users have E3 plus standalone add-ons that are already included", "show me all licenses assigned to disabled accounts"

Use this agent when an MSP security lead, vCISO, or service manager needs to sweep the M365 portfolio for security posture issues - Secure Score regressions, MFA enrollment gaps, conditional access drift, BPA failures, and broken domain authentication. Trigger for portfolio security reviews, monthly client security reports, post-onboarding validation, and incident-driven posture audits. Examples - "Review the security posture across all tenants", "Which clients have MFA gaps?", "Are any tenants drifting from our baseline conditional access?", "Generate a Secure Score report for the QBR", "Did the standards rollout to Acme actually take?"

Use this agent when an MSP technician, dispatcher, or HR-facing operator needs to run a complete M365 user offboarding through CIPP. Coordinates the full sequence - disable, revoke sessions, reset MFA, capture group/device state for audit, set forwarding, set OOO, convert mailbox to shared, and reclaim licenses - with explicit safety checks and a documented audit trail at each step. Trigger for offboarding requests, departures, terminations, contractor end-of-engagement, and shared-mailbox conversions. Examples - "Offboard [email protected]", "Run the full leaver process for the Globex employee leaving Friday", "Convert the contractor's mailbox to shared and forward to her manager", "We had a termination this morning - disable and revoke immediately, full offboard tomorrow"

Reference for Microsoft Graph API fundamentals: authentication and token scopes, OData operators ($select/$filter/$search), pagination via @odata.nextLink, delta queries, throttling and Retry-After, and $batch requests. Use when constructing any M365/Graph API call, choosing filter syntax, handling 429 throttling, or debugging a Graph error code.

Use this skill when working with Microsoft 365 calendars - viewing events, finding free/busy times, creating meetings, managing room bookings, or checking a user's schedule. Covers Exchange calendar via Microsoft Graph for MSP support of customer scheduling needs.

Use this skill when working with CIPP alerts and audit logs - reviewing the queued alert backlog across tenants, investigating sign-in or admin activity in audit logs, correlating alerts with tenants. Read-only triage surface for the CIPP alerting subsystem.

Use this skill when listing or creating M365 groups in CIPP - security groups, distribution lists, M365 groups, mail-enabled security groups. Covers tenant-scoped group enumeration and creation as part of user onboarding or access-management workflows.

Use this skill when working with M365 license assignments and CSP license inventory through CIPP - listing license usage per tenant, identifying unused licenses, surfacing license SKUs available for assignment, and reviewing CSP-level license commitments. Drives license-rightsizing reports for MSP billing reviews.

1 hook across 1 event