Skill UI

Guides security teams through detecting and responding to OAuth token theft, covering Microsoft Entra ID/Azure AD protections, conditional access policies, and sign-in log investigations to block token replay, PRT abuse, and session hijacking in cloud deployments.

Detects illicit OAuth consent grants in Azure AD / Microsoft Entra ID by enumerating OAuth2 permission grants, reviewing consent audit logs, analyzing permission scopes and publisher verification via Microsoft Graph, and generating risk reports for SOC analysts.

Configure Microsoft Entra Privileged Identity Management to enforce just-in-time role activation, approvals, MFA, and access reviews for Azure AD privileged roles, using portal and Graph API workflows to implement Zero Trust identity governance.

Configure Microsoft Entra ID conditional access policies to enforce zero-trust controls, covering signal-based policy design, device compliance, risk-based authentication, named locations, session controls, and alignment with NIST zero trust guidance.

Guide for building passwordless authentication via Microsoft Entra ID, covering FIDO2 keys, Windows Hello for Business, Microsoft Authenticator passkeys, and conditional access policies for phishing-resistant MFA deployments.

Guides cloud security teams through setting up Microsoft Defender for Cloud to protect Azure workloads, extend CNAPP coverage to AWS/GCP, manage Secure Score, and monitor threats centrally via the unified Defender portal.

This guide details the process of creating and managing 'Agent Users' within Microsoft Entra ID. Agent Users are specialized identities that allow AI agents to function as digital workers, giving them user-level capabilities (e.g., accessing Exchange mailboxes or Teams) while maintaining robust security boundaries. It covers using the Microsoft Graph API and PowerShell to provision and configure these agents.