ast microsoft

Securing and managing Microsoft 365 or Azure environments often requires jumping between multiple portals and running disjointed PowerShell scripts. This skill provides a unified command-line and MCP interface to investigate and respond to threats across the entire Microsoft stack from your agent.

What it does

• Security Investigation queries Entra ID, Defender alerts, and Sentinel incidents using KQL to hunt for threats.
• Incident Response disables compromised accounts, revokes sessions, and contains hosts across on-prem AD and Entra.
• Email Defense searches mailboxes, analyzes headers, and purges phishing emails or releases items from quarantine.
• Device & App Management audits Intune device status, manages the Win32 app catalog, and tracks install status.
• Compliance & Governance manages Purview eDiscovery cases, litigation holds, and Teams federation blocks.
• Resource Optimization analyzes Azure cost data and identifies VM rightsizing opportunities.

How it works

1. Prerequisites requires the user to create read, write, and compliance app registrations in the Entra portal.
2. Installation involves running an install.sh script to set up a local Python virtual environment and offline AST packages.
3. Configuration uses a .env file or system keychain to store API credentials securely.
4. Execution leverages specialized CLIs like az-search, az-exch, and az-sentinel or their corresponding MCP tools.

Frameworks & tools

Built for Python 3.12+, utilizing Microsoft Graph API, Azure Management API, and Sentinel KQL. Certain Exchange and Purview features require PowerShell 7 and the ExchangeOnlineManagement module.

Why this beats prompting it yourself

Generic prompts often hallucinate PowerShell syntax or overlook the complex API permissions required for M365 security actions. This skill provides tested, specific tooling that handles the nuances of Microsoft's various API endpoints while enforcing a strict safety model for destructive actions.

Use cases

• Disable a compromised user account and revoke all active sessions across Entra and on-prem AD.
• Search all mailboxes for a specific phishing SHA256 hash and purge the messages.
• Query Sentinel for high-severity incidents and pull associated Defender hunting telemetry.
• Audit Azure tenant spend and identify underutilized VMs for cost reduction.

Known limitations

Does not support Okta, Google Workspace, or sovereign clouds like GCC High and DoD. Write operations require manual environment variable gates to be enabled for MCP access.