skills.rest
SCStelz
SCStelzCOMMUNITY
Explore all skills by this author →
Website𝕏@SCStelzGitHub

user-investigation

Analyze Entra ID user accounts for security issues and generate HTML reports.

231|64|Updated Dec 16, 2025
Search Tags:#investigate#MFA#audit-logs#sign-in#Entra ID#Identity Protection#security-incidents
One-click install
npx skills add https://github.com/SCStelz/security-investigator --skill user-investigation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: user-investigation
Source: https://github.com/SCStelz/security-investigator/tree/main/.github/skills/user-investigation
Command: npx skills add https://github.com/SCStelz/security-investigator --skill user-investigation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates comprehensive Entra ID user investigations, reducing manual effort by collecting sign-in data, MFA status, device compliance, audit logs, security incidents, Identity Protection risk signals, and generating automated HTML reports.

Core Features & Use Cases

  • End-to-end Entra ID user security investigations, including sign-in anomalies, MFA status, device compliance, audit logs, incidents, and Identity Protection risks.
  • Parallel data collection from Microsoft Graph and Sentinel MCP servers to accelerate investigations.
  • Automatic JSON export and HTML report generation for auditability and sharing.
  • Supports standard, quick, and comprehensive investigation prompts with clear end-to-end workflows.

Quick Start

Use the skill to investigate a user like "investigate [email protected] for the last 7 days" and generate an automated security report.

Frequently Asked Questions about user-investigation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate Entra ID user security investigations?▼

You can automate Entra ID user security investigations by using this Skill to collect sign-in anomalies, MFA status, device compliance, audit logs, and Identity Protection risk signals, which automatically generates an HTML report.

What is the best way to generate an Entra ID audit report for sign-in anomalies?▼

The best way to generate an Entra ID audit report for sign-in anomalies is to run a comprehensive investigation prompt that collects data from Microsoft Graph and Sentinel, automatically exporting the results to JSON and HTML formats.

Can I investigate MFA status and device compliance for a specific Entra ID user?▼

Yes, you can investigate MFA status and device compliance for a specific Entra ID user by providing the user principal name, allowing the Skill to query Microsoft Graph for the relevant security signals.

Does this Entra ID investigation tool work with Microsoft Sentinel?▼

Yes, this Entra ID investigation tool works with Microsoft Sentinel by collecting data in parallel from Microsoft Graph and Sentinel MCP servers to accelerate security incident data collection.

How do I check Identity Protection risk signals for a compromised Entra ID account?▼

To check Identity Protection risk signals for a compromised Entra ID account, use the Skill to query Microsoft Graph for user risk and sign-in risk data, which is then compiled into an automated HTML security report.

Related Skills

Explore More Data & Analytics Skills→
msandbumsandbu
2

mcp-usage-monitoring

Monitor MCP server usage across Microsoft Sentinel and Defender XDR environments.

Community
Advanced
backbay-labsbackbay-labs
285

Threat Hunt

Automate security event investigation and threat hunting workflows.

Official
Advanced
EmeaAppGbbEmeaAppGbb

Hosted Agents in Microsoft Foundry

Deploy and manage containerized AI agents on Microsoft Foundry with azd.

Official
Advanced
AcczdyAcczdy
2

implementing-passwordless-auth-with-microsoft-entra

Configure passwordless authentication policies for Microsoft Entra ID using Microsoft Graph and PowerShell.

Community
Advanced