Skill UI

Automate core SharePoint operations—site discovery, list and folder management, file searches, delta sync, and page retrieval—across SharePoint and OneDrive using REST/Graph APIs for Microsoft 365 org accounts.

This skill utilizes the Microsoft Graph API to parse Office 365 Unified Audit Logs for security incident investigation. It is designed to detect critical indicators of account compromise, including the creation of suspicious email forwarding rules, unauthorized mailbox delegation changes, suspicious OAuth application consent grants, and other signs related to Business Email Compromise (BEC).

This script provides a comprehensive security assessment of Microsoft Entra ID (Azure AD) identity configurations. It audits for risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using PowerShell and Graph API. Ideal for compliance audits, security posture review, and post-merger security assessments.

Focuses on advanced threat detection within Azure AD/Entra ID. This skill guides users on correlating Graph API audit logs, sign-in anomalies, and KQL queries in Microsoft Sentinel to identify sophisticated lateral movement techniques, such as privilege escalation, OAuth abuse, and cross-tenant pivoting. Essential for SOC threat hunting.

A comprehensive guide and analysis framework for detecting compromised Office 365 or Google Workspace email accounts. It focuses on analyzing unified audit logs and Azure AD sign-in logs to identify indicators of account takeover (ATO) or Business Email Compromise (BEC). Detection methods include monitoring impossible travel events, identifying malicious inbox rules (e.g., external forwarding or deletion rules), and analyzing suspicious Microsoft Graph API access patterns.

This guide details methods for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically targeting Microsoft Entra ID (Azure AD). It covers protection against access token theft, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Users can leverage Conditional Access and Token Protection features to cryptographically bind tokens to devices, significantly enhancing cloud identity security and preventing session hijacking.

This skill analyzes Azure AD/Microsoft Entra ID environments to detect illicit OAuth application consent grants. It leverages the Microsoft Graph API and directory audit logs to enumerate permissions, identify overly broad scopes, and flag high-risk applications based on publisher verification status. It is essential for SOC analysts and threat hunters investigating cloud identity security incidents.

Configure Azure AD Privileged Identity Management via Microsoft Graph API to enumerate eligible and active assignments, request just-in-time activations, audit logs, and enforce MFA or approval policies for zero-trust privileged access scenarios.

This guide details the process of creating and managing 'Agent Users' within Microsoft Entra ID. Agent Users are specialized identities that allow AI agents to function as digital workers, giving them user-level capabilities (e.g., accessing Exchange mailboxes or Teams) while maintaining robust security boundaries. It covers using the Microsoft Graph API and PowerShell to provision and configure these agents.

This skill provides comprehensive CRUD (Create, Read, Update, Delete) capabilities for OneNote's entire hierarchical structure, including Notebooks, Section Groups, Sections, and Pages, using the Microsoft Graph API. It is designed for complex workflow automation, addressing critical pain points like strict XHTML formatting, delegated credential handling, and managing the unique content retrieval process in a production-safe manner.

A comprehensive guide and implementation pattern for querying, searching, and paginating OneNote content using the Microsoft Graph API. This skill addresses the limitations of the standard OneNote search endpoint, providing robust methods for cross-notebook querying, advanced OData filtering on metadata, and client-side full-text indexing for body content. Ideal for building complex knowledge retrieval systems that handle large, distributed result sets.

This bundle generates comprehensive diagnostic logs for troubleshooting OneNote Graph API issues. It captures critical data points—such as the `request-id`, `x-ms-ags-diagnostic` headers, full error bodies, and decoded JWT token claims—for both successful and failed API calls. Use it for self-diagnosis, verifying permissions, or preparing detailed support tickets for Microsoft support.