Skills
.Work. You
Rest

user-investigation

Community

Automate Entra ID user security investigations.

Data & Analytics#investigate#MFA#audit-logs#sign-in#Entra ID#Identity Protection#security-incidents
AuthorSCStelz
Version1.0.0
Installs0

System Documentation

What problem does it solve?

This Skill automates comprehensive Entra ID user investigations, reducing manual effort by collecting sign-in data, MFA status, device compliance, audit logs, security incidents, Identity Protection risk signals, and generating automated HTML reports.

Core Features & Use Cases

  • End-to-end Entra ID user security investigations, including sign-in anomalies, MFA status, device compliance, audit logs, incidents, and Identity Protection risks.
  • Parallel data collection from Microsoft Graph and Sentinel MCP servers to accelerate investigations.
  • Automatic JSON export and HTML report generation for auditability and sharing.
  • Supports standard, quick, and comprehensive investigation prompts with clear end-to-end workflows.

Quick Start

Use the skill to investigate a user like "investigate user@domain.com for the last 7 days" and generate an automated security report.

Dependency Matrix

Required Modules

None required

Components

Standard package

💻 Claude Code Installation

Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.

Please help me install this Skill:
Name: user-investigation
Download link: https://github.com/SCStelz/security-investigator/archive/main.zip#user-investigation

Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
View Source Repository

Agent Skills Search Helper

Install a tiny helper to your Agent, search and equip skill from 223,000+ vetted skills library on demand.