How to use the Azure Entra ID Configuration Audit agent skill

What is an agent skill and what does this one do?

An agent skill is a folder of instructions and supporting files that an AI agent loads when a task matches it. This skill, from the Anthropic-Cybersecurity-Skills collection (licensed Apache-2.0), gives the agent a structured workflow for auditing an Azure tenant's identity configuration.

Once installed, the agent knows how to check for: whether security defaults and legacy sign-in are blocked, who holds powerful admin roles, which accounts are stale or are outside guests, whether Conditional Access policies have gaps or exclusions, and what risky sign-ins appear in the logs. It then reports its findings.

• Baseline settings: security defaults, authentication methods policies and legacy authentication through Conditional Access
• Privileged roles: directory role assignments, permanent admin accounts and service principals with admin roles
• Conditional Access: report-only policies, MFA coverage and groups excluded from policies
• Stale accounts and guests: users with no recent sign-in, guest users and guests holding privileged roles
• Sign-in logs: risky sign-ins, unfamiliar-location sign-ins and legacy client app sign-ins
• Optional automated run with ScoutSuite's Azure provider

Install the Azure Entra ID audit skill

You can install the skill in either of two ways. Download the ZIP file from this page and then choose one of the methods below.

For a personal setup, unzip the download into your user skills folder, ~/.claude/skills/. To scope it to one project, unzip it into that project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings → Capabilities → Skills and upload the ZIP there.

• Personal: unzip into ~/.claude/skills/
• Single project: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Set up the prerequisites before you start

The skill depends on several tools and permissions. Check each one before asking for an audit, because the checks read sensitive identity data and will not work without the right access.

You need the Global Reader or Security Reader role in the target tenant. Sign-in and audit log checks need a Microsoft Entra ID P1 or P2 licence. The Microsoft Graph PowerShell SDK and the Azure CLI (az) are both used, and the bundled scripts/agent.py needs Python with the azure-identity and requests packages.

• Global Reader or Security Reader role in the target tenant
• Microsoft Graph PowerShell SDK: Install-Module Microsoft.Graph
• Azure CLI logged in to the tenant
• Python with azure-identity and requests packages for scripts/agent.py
• Microsoft Entra ID P1/P2 licence for sign-in and audit logs
• Optional: ScoutSuite with its Azure provider configured

Log in to the right tenant

Before the agent runs any checks, sign in the Azure CLI to the tenant you are authorised to review. Replace TENANT_ID with the target tenant's ID. Make sure you are working in the correct tenant, since the skill reads whatever tenant you are logged in to.

How do you trigger the skill with a natural request?

You do not need special syntax. Describe the task in plain language and mention Azure, Entra ID or the identity configuration, and the agent should match the request to this skill. Name the outcome you want, such as a list of risky roles or a review of Conditional Access gaps.

Be specific about scope and evidence. State which tenant you mean and whether you need a full review or one area. Compliance teams can ask for evidence on MFA enforcement and privileged role assignments.

• Review the identity configuration of our Azure tenant for security weak spots.
• Check whether security defaults and legacy authentication are blocked in this Entra ID tenant.
• Who holds Global Administrator or other privileged roles, and are any guests among them?
• Find Conditional Access policies that are report-only or exclude groups.
• List accounts that have not signed in recently and are still enabled.
• Pull risky sign-ins from the audit logs for the last week and summarise them.

What does a typical audit look like?

The skill's workflow follows six steps: enumerate the tenant baseline, audit privileged role assignments, review Conditional Access policies, identify stale accounts and guest users, analyse sign-in logs, and run an optional ScoutSuite assessment. The agent works through these areas and reports what it finds.

The source uses Microsoft Graph permissions such as Directory.Read.All, Policy.Read.All and AuditLog.Read.All for its checks. Expect the output to be a set of findings across these areas rather than a single score.

• Connects to Microsoft Graph with read scopes
• Checks security defaults, authentication methods and legacy authentication
• Lists privileged role assignments and users with multiple admin roles
• Reviews Conditional Access for report-only policies, MFA coverage and excluded groups
• Finds stale users, guest users and guests with privileged roles
• Reviews sign-in logs for risk, unfamiliar locations and legacy clients

Safety, permissions and what to check before running it

This skill runs scripts and uses the network, so treat it like any tool that touches your cloud account. It is meant for an authorised reviewer with read-only access to the tenant. Do not run it against a tenant you do not have written permission to review, because the checks read sensitive identity data.

Some example filters in the source contain fixed dates for the stale-account and risky sign-in checks. Edit those filters to your own time window before you rely on the results. The skill also suggests PingCastle or BloodHound for on-premises Active Directory, and Microsoft Defender for Identity for real-time threat detection, so use those tools for those jobs.

• Use only with written permission from the tenant owner
• Use a read-only role such as Global Reader or Security Reader
• Review the scripts before running them, since the skill runs scripts and uses the network
• Update fixed date filters in the example queries to your review period
• Do not use it for on-premises Active Directory or real-time threat detection

Tips for getting useful results

Start with a narrow question, such as Conditional Access gaps, before asking for a full tenant review. This keeps output manageable and makes it easier to check each finding.

If you need a broader automated sweep across the tenant, the source suggests running ScoutSuite's Azure provider, which generates an HTML report you can open in a browser. Keep the report with your audit evidence.

• Ask one area at a time, then combine findings
• Treat report-only Conditional Access policies as not yet enforced
• Verify excluded groups in Conditional Access before assuming a bypass
• Keep the ScoutSuite HTML report if you need audit evidence