Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vinayaklatthe/microsoft-security-skills --skill entra-idgit clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/entra-id)<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/entra-id"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/entra-id/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/entra-id"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/entra-id.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00196 | $0.02097 |
| Opus 5 | $0.00098 | $0.01048 |
| Sonnet 5 | $0.00039 | $0.00419 |
| Haiku 4.5 | $0.00020 | $0.00210 |
Grade A, and why
entra-id scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Microsoft Entra ID
Microsoft Entra ID (formerly Azure Active Directory) is the cloud identity and access management service that authenticates users, devices, and workloads. It is the control plane for Zero Trust and the foundation every other Microsoft security control assumes is healthy.
When to use
Establishing the identity foundation: tenants, users/groups, authentication methods, SSO for apps, and hybrid identity with on-premises Active Directory. Use this skill before configuring Conditional Access, Identity Protection, or PIM - they all assume a clean Entra ID baseline.
Do not use this skill for risk-based sign-in detection (entra-id-protection), policy
enforcement (conditional-access-mfa), just-in-time admin roles (azure-pim), or lifecycle
workflows (entra-id-governance).
Map the identity goal to the right Entra control
| If the goal is... | Use | Notes |
|---|---|---|
| Sync on-prem AD users to cloud | Entra Cloud Sync (preferred new) or Entra Connect Sync | Cloud Sync is lighter, no server farm |
| Federate sign-in to on-prem | AD FS (legacy) or Pass-Through Authentication | Avoid new AD FS deployments; prefer PHS + WHfB |
| Replace passwords | Passkeys (FIDO2) > Windows Hello for Business > Microsoft Authenticator passwordless | Phishing-resistant only |
| Single sign-on to SaaS | Enterprise Applications (gallery or non-gallery) | OIDC > SAML where supported |
| Self-service password reset | SSPR with cloud writeback (hybrid) | Requires Entra ID P1 |
| Delegated admin scoped to a region/BU | Administrative Units | Combine with custom roles for least privilege |
| App calls Microsoft Graph or another API | App Registration + delegated/application permissions | Require admin consent workflow for risky scopes |
| Emergency tenant access if MFA breaks | Break-glass accounts (2x cloud-only, excluded from CA) | Hardware FIDO2 only; alerted on every sign-in |
Rule of thumb: if you are about to type a username and password into a Microsoft service in 2026, stop. Move to passkeys or WHfB. Password reuse + phishing is still the #1 root cause in identity incident response.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 135 lines · 196 tokens per session scan A aff7fd5716bf
entra-id is a skill published in the GitHub repository vinayaklatthe/microsoft-security-skills (173 stars, last pushed 2mo ago), licensed MIT. It adds 196 tokens to every session and 2,097 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cosmos-design-struct
Enforce consistent struct design conventions across sdk/cosmos crates. Validates visibility modifiers, field privacy, #[nonexhaustive] usage, and construction API patterns (Default/new with with setters, or optional separate builders with builder()/build()), and construction correctness on public structs. Can auto-fix…
bf-to-agents-sdk-typescript-migration
Assess and migrate JavaScript or TypeScript bots from BotBuilder/Bot Framework SDK to Microsoft 365 Agents SDK with AgentApplication. Use to produce a migration report and plan before editing code, map BotBuilder packages and APIs, identify unsupported features, and implement only the supported plan items selected by…
octopus-architecture
Review system architecture, simplify boundaries, or compare interface designs from repository evidence.
bfl-api
BFL FLUX API integration guide covering endpoints, async polling patterns, rate limiting, error handling, webhooks, and regional endpoints with Python and TypeScript code examples.
api-doc-generator
Generate API documentation from source code, supporting REST APIs, GraphQL, and various documentation formats.
aspire
Build, upgrade, and operate Aspire 13.5.x C# or TypeScript application hosts with the current CLI, AppHost, ServiceDefaults, integrations, dashboard, testing, MCP, and deployment patterns for distributed apps. USE FOR: Aspire.AppHost.Sdk, Aspire.Hosting., DistributedApplication.CreateBuilder, apphost.mts…