skills.rest
msandbu
msandbuCOMMUNITY
Explore all skills by this author →
GitHub

mcp-usage-monitoring

Monitor MCP server usage across Microsoft Sentinel and Defender XDR environments.

2|Updated Mar 4, 2026
Search Tags:#mcp#ai agent#auditing#microsoft graph#sentinel#entra id#usage monitoring
One-click install
npx skills add https://github.com/msandbu/sentinelday --skill mcp-usage-monitoring
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mcp-usage-monitoring
Source: https://github.com/msandbu/sentinelday/tree/main/.github/skills/mcp-usage-monitoring
Command: npx skills add https://github.com/msandbu/sentinelday --skill mcp-usage-monitoring

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides comprehensive monitoring and auditing of Model Context Protocol (MCP) server usage across your Microsoft security environment, helping to identify and manage AI agent access patterns and ensure governance.

Core Features & Use Cases

  • Comprehensive Telemetry Analysis: Tracks usage across Microsoft Graph MCP, Sentinel MCP, and Azure MCP servers.
  • Identity Attribution: Differentiates between human users, service principals, and AI agent identities (Entra Agent ID).
  • Security Risk Assessment: Detects sensitive API access, anomalous patterns, and provides a composite MCP Usage Score.
  • Use Case: Investigate unusual spikes in Graph API calls originating from AI agents, or audit which users and agents are accessing sensitive data through Sentinel's Data Lake MCP.

Quick Start

Use the mcp-usage-monitoring skill to analyze Microsoft Graph MCP server usage for the last 30 days.

Frequently Asked Questions about mcp-usage-monitoring

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit MCP server usage and AI agent activity in Microsoft Sentinel?▼

To audit MCP server usage in Microsoft Sentinel, you analyze telemetry by running KQL queries against MicrosoftGraphActivityLogs, CloudAppEvents, SigninLogs, AzureActivity, and LAQueryLogs to track Graph API call volumes and access patterns.

What is Model Context Protocol usage monitoring and how does it work?▼

Model Context Protocol usage monitoring tracks MCP server interactions across Microsoft Sentinel and Defender XDR by analyzing Graph API volume, sensitive endpoint access, and Entra Agent ID callers to ensure AI agent governance and assess security risk.

Can I differentiate between human users and AI agents accessing Microsoft Graph?▼

Yes, you can differentiate identity attribution by analyzing Entra Agent ID callers within SigninLogs and MicrosoftGraphActivityLogs to distinguish between human users, service principals, and AI agent identities accessing sensitive endpoints.

How do I detect anomalous spikes in Graph API calls from AI agents?▼

You detect anomalous Graph API call spikes from AI agents by analyzing Azure Activity and Sentinel Data Lake telemetry to calculate a composite MCP Usage Score and identify unusual sensitive endpoint access patterns.

Do I need KQL queries to monitor MCP servers across Defender XDR?▼

Yes, you need KQL queries to monitor MCP servers across Defender XDR, as the analysis requires querying MicrosoftGraphActivityLogs, CloudAppEvents, and AzureActivity logs for comprehensive telemetry analysis and risk assessment.

Related Skills

Explore More Data & Analytics Skills→
EmeaAppGbbEmeaAppGbb

Hosted Agents in Microsoft Foundry

Deploy and manage containerized AI agents on Microsoft Foundry with azd.

Official
Advanced
ellisapotheosisellisapotheosis

Verification & Quality Assurance

Automate verification and rollback for software projects across CI/CD pipelines.

Community
Advanced
audibleblinkaudibleblink
4

kql-mde-xdr

Write and optimize KQL queries for MDE, Sentinel, and Defender XDR.

Community
Advanced
GabeujinGabeujin

entra-agent-user

Create Microsoft Entra ID agent users from agent identities.

Community
Advanced