Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentsM365 Hardening Coach: Check Results to Fix-First Plan
Turn Microsoft 365 hardening check results into a prioritised, licence-aware action plan. Read-only: never changes the tenant.
Free
M365 Hardening Coach: Check Results to Fix-First Plan
Example session with this skill installed
I've attached hardening-check-results.csv for a Business Premium tenant. We have two break-glass accounts. What should I fix first?
- Read your context and instructions
- Compiled the m365 hardening coach
Illustrative example (sample values, not a real tenant).
M365 hardening status — sample tenant, 27 Oct 2026
Readiness: 41% (weighted PASS 12 / applicable 29) · Unknown: 1 · Needs licence: 0
Assumed licence: Microsoft 365 Business Premium (includes Entra ID P1).
Conditional Access rule for every fix below: exclude both break-glass accounts, start in Report-only, review sign-in logs for 3–7 days, then turn On.
Fix this week (max 5)
| ID | Control | Why now | Effort | Owner |
|---|---|---|---|---|
| E03 | Block legacy authentication | Output: "No CA policy blocks exchangeActiveSync/other" | Low | IT admin |
| E02 | Require MFA for all users | Output: "Security defaults: False; no CA policy requires MFA for All users" | Medium | IT admin |
| E07 | Block automatic external forwarding | Output: "AutoForwardingMode: Automatic" | Low | Messaging |
E01 (break-glass) is PASS: you confirmed two accounts, so the CA fixes can start.
Next sprint
E05 user consent to apps · E09 DMARC still p=none
Unknown — rerun with
E06 audit logging: Exchange module not connected → Connect-ExchangeOnline, then rerun the script.
Management summary
The tenant has its emergency accounts in place but still allows sign-ins that skip MFA. Three low-to-medium changes this week close the most common account-takeover paths. No new licences are needed.
Connects securely to your tools. The creator never sees your data.
About this skill
Turn Microsoft 365 hardening check results into a prioritised, licence-aware action plan.
Paste the results CSV of a read-only check script (columns ID, Control, Status, Output) or your hardening tracker, and the skill:
- classifies every control as PASS / FAIL / UNKNOWN / N/A, and never marks PASS without evidence in the output
- stops on connection errors and tells you which Connect-* modules are missing, instead of guessing
- scores readiness by priority weight and orders fixes: break-glass accounts before any Conditional Access change, dated items first (SMTP AUTH Basic auth default-off in Exchange Online, end of December 2026)
- applies the safe rollout rule for Conditional Access once: exclude break-glass, Report-only, review sign-ins, then On
- lists licence gaps with the free alternative where one exists (e.g. Security defaults)
- ends with a 3-sentence management summary
It never runs commands that change the tenant. Markdown only: no scripts, no network access.
Works with the free M365 Hardening Kit: Emergency Top 10 (GitHub: runbooklabhq/m365-hardening-kit-free), which ships the read-only checks and the tracker this skill reads.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Free forever
No account required to browse
Trust & safety
Security scan
Security scan passed today
- Free with an Agensi account