Azure Entra ID Configuration Audit
Audit Microsoft Entra ID settings for risky auth policies, admin roles, stale and guest accounts
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
Once installed, the agent knows how to review a Microsoft Azure (Entra ID) identity setup for common security weak spots. It walks through checks such as whether security defaults and legacy sign-in are blocked, who holds powerful admin roles, which accounts are stale or are outside guests, whether Conditional Access policies have gaps or exclusions, and what risky sign-ins appear in the logs. It then reports findings, and it is meant for an authorised reviewer with read-only access to the tenant.
Great for
- Security engineers performing an identity assessment of an Azure tenant
- Compliance teams preparing evidence on MFA enforcement and privileged role assignments
- IT admins taking over a tenant after a merger or acquisition
Skip it if
- On-premises Active Directory, since the skill itself says to use PingCastle or BloodHound for that
- Real-time threat detection, which the skill says belongs to Microsoft Defender for Identity
- Auditing a tenant you do not have written permission to review, because the checks read sensitive identity data
Try asking
- “Audit my Azure tenant's Entra ID configuration for risky authentication policies and overly permissive admin roles”
- “Check whether our Conditional Access policies leave gaps for MFA and legacy authentication”
- “Find stale user accounts and guest users who hold privileged roles in our Azure tenant”
- “Review risky sign-ins from the last 7 days in our Entra ID sign-in logs”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
auditing-azure-active-directory-configuration.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip auditing-azure-active-directory-configuration.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip auditing-azure-active-directory-configuration.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Use a read-only account with Global Reader or Security Reader rather than an admin account, and review every command before running it.
- Ask for one area at a time, such as role assignments first, so findings stay manageable.
- Check the hardcoded date filters in the sign-in and stale-account queries (for example 2025-11-25 and 2026-02-16) and update them to the window you need.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.