user-investigation

Analyze Entra ID user accounts for security issues and generate HTML reports.

231|64|Updated Dec 16, 2025

Search Tags:#investigate #MFA #audit-logs #sign-in #Entra ID #Identity Protection #security-incidents

Ready to run

npx skills add https://github.com/SCStelz/security-investigator --skill user-investigation

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: user-investigation
Source: https://github.com/SCStelz/security-investigator/tree/main/.github/skills/user-investigation
Command: npx skills add https://github.com/SCStelz/security-investigator --skill user-investigation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates comprehensive Entra ID user investigations, reducing manual effort by collecting sign-in data, MFA status, device compliance, audit logs, security incidents, Identity Protection risk signals, and generating automated HTML reports.

Core Features & Use Cases

End-to-end Entra ID user security investigations, including sign-in anomalies, MFA status, device compliance, audit logs, incidents, and Identity Protection risks.
Parallel data collection from Microsoft Graph and Sentinel MCP servers to accelerate investigations.
Automatic JSON export and HTML report generation for auditability and sharing.
Supports standard, quick, and comprehensive investigation prompts with clear end-to-end workflows.

Quick Start

Use the skill to investigate a user like "investigate [email protected] for the last 7 days" and generate an automated security report.

Frequently Asked Questions about user-investigation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate Entra ID user security investigations?▼

You can automate Entra ID user security investigations by using this Skill to collect sign-in anomalies, MFA status, device compliance, audit logs, and Identity Protection risk signals, which automatically generates an HTML report.

What is the best way to generate an Entra ID audit report for sign-in anomalies?▼

The best way to generate an Entra ID audit report for sign-in anomalies is to run a comprehensive investigation prompt that collects data from Microsoft Graph and Sentinel, automatically exporting the results to JSON and HTML formats.

Can I investigate MFA status and device compliance for a specific Entra ID user?▼

Yes, you can investigate MFA status and device compliance for a specific Entra ID user by providing the user principal name, allowing the Skill to query Microsoft Graph for the relevant security signals.

Does this Entra ID investigation tool work with Microsoft Sentinel?▼

Yes, this Entra ID investigation tool works with Microsoft Sentinel by collecting data in parallel from Microsoft Graph and Sentinel MCP servers to accelerate security incident data collection.

How do I check Identity Protection risk signals for a compromised Entra ID account?▼

To check Identity Protection risk signals for a compromised Entra ID account, use the Skill to query Microsoft Graph for user risk and sign-in risk data, which is then compiled into an automated HTML security report.