How does this skill help with M365 account compromises?

It identifies suspicious inbox rules, checks for unfamiliar sign-in locations, and provides a structured checklist for revoking sessions and resetting credentials.

How does it help improve my Microsoft Secure Score?

The skill retrieves your current Secure Score and pulls specific control profiles to show exactly which security configurations are missing or need implementation.

Does it require specific Microsoft licenses?

Basic checks work for all tenants, but advanced identity protection features like 'Risky Users' and 'Risky Sign-ins' require Entra ID P2 (formerly Azure AD P2) licensing.

Can I use this to generate a full MFA report?

Yes, it uses the Microsoft Graph Reports endpoint to pull tenant-wide MFA registration details, categorizing users by their authentication methods and capability.

M365 Security Auditor

Name: M365 Security Auditor
Author: wyre-technology

bywyre-technology

•

Security & Testing

Audits Microsoft 365 security posture by checking MFA status, conditional access policies, and account compromise indicators.

This skill enables MSPs and security professionals to perform comprehensive security reviews within Microsoft 365 environments using Claude Code. It provides specialized capabilities for auditing MFA enrollment across all users, analyzing Conditional Access policies, identifying risky sign-ins, and detecting suspicious mailbox rules often used by attackers. By streamlining the investigation of account compromises and evaluating the overall Microsoft Secure Score, this skill helps ensure tenants are protected against common vulnerabilities like legacy authentication and phishing attacks.

Key Features

01Microsoft Secure Score retrieval with actionable remediation recommendations

02Conditional Access policy verification and legacy authentication identification

03Tenant-wide MFA enrollment auditing and authentication method risk assessment

047 GitHub stars

05Real-time identification of risky users and sign-in logs via Entra ID

06Automated detection of suspicious inbox rules and external mail forwarding

Use Cases

01Investigating a suspected account compromise by analyzing sign-in logs, IP addresses, and mailbox changes

02Performing a routine security audit for an MSP client to identify MFA gaps and improve Secure Score

03Identifying and blocking legacy authentication protocols like IMAP and POP3 across a tenant

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add wyre-technology/msp-claude-plugins security

For use in Claude.ai and ChatGPT

Key Features

01Microsoft Secure Score retrieval with actionable remediation recommendations

02Conditional Access policy verification and legacy authentication identification

03Tenant-wide MFA enrollment auditing and authentication method risk assessment

047 GitHub stars

05Real-time identification of risky users and sign-in logs via Entra ID

06Automated detection of suspicious inbox rules and external mail forwarding

Use Cases

01Investigating a suspected account compromise by analyzing sign-in logs, IP addresses, and mailbox changes

02Performing a routine security audit for an MSP client to identify MFA gaps and improve Secure Score

03Identifying and blocking legacy authentication protocols like IMAP and POP3 across a tenant