Browse by category.
Every skill is a single Markdown file you can paste into Microsoft 365 Copilot, Copilot Studio or Claude. Read-only by default, Australian-compliant, CC BY 4.0.
Copilot Readiness Assessment
Scores a Microsoft 365 tenant for Copilot readiness across licensing, sensitivity labelling, oversharing, Conditional Access and audit retention, mapped to Essential Eight.
Entra Agent ID Audit
Inventories every Microsoft Entra Agent ID, flags orphaned and risk-elevated agents, and reports Conditional Access posture per agent, aligned to Essential Eight.
Conditional Access for Agents
Turns an AI agent's risk profile and data tier into a Microsoft Entra Conditional Access policy specification ready for admin review, aligned to Essential Eight.
Copilot Studio DLP Gap Check
Audits Copilot Studio agents against the tenant DLP policy to flag missing, weak or bypassed Data Loss Prevention, aligned to Essential Eight application control.
Copilot Studio Agent Inventory and Connector Audit
Inventory every Microsoft Copilot Studio agent with its connectors, knowledge sources, sharing scope and DLP coverage, then flag ungoverned agents.
Copilot Control System Governance Validator
Validates Microsoft 365 Copilot Control System: data security policies, agent publishing approvals, and sensitivity-label enforcement for Copilot.
Secure Meeting Minutes
Drafts formal meeting minutes from notes or a Teams transcript in Microsoft 365 Copilot, inheriting the meeting's sensitivity label and routing actions to named owners.
Stakeholder Update Email
Converts project notes into a concise 200-300 word stakeholder email with a consistent four-section RAG structure, drafted in Microsoft 365 Copilot.
Policy Document Template
Generates a compliant, consistently structured policy or procedure document with required governance sections, drafted in Microsoft 365 Copilot for review and approval.
Onboarding Checklist
Works a new-starter onboarding checklist in Microsoft 365 Copilot, drafting artefacts and raising access requests without auto-approving, for people-leader review.
Copilot Wave 3 Autonomous Agent Governance
Assesses the governance posture for Microsoft 365 Copilot Wave 3 autonomous agents, auditing approval-workflow coverage, data-scope boundaries, audit-log configuration, and human-override controls.
Entra Agent Identity Sponsorship Lifecycle
Audits the Microsoft Entra agent identity sponsorship model — verifying every agent has an active human sponsor, that sponsor-departure triggers ownership transfer, and that agents without valid sponsors are flagged for decommissioning.
Agent Audit Trail and Forensics Investigation
Extracts and analyses Microsoft 365 Copilot and Copilot Studio agent actions from the Purview unified audit log to reconstruct what an agent did, what data it accessed, and who authorised each action during a security investigation.
Agent 365 Tools and MCP Server Governance Baseline
Audits the Microsoft Agent 365 tools catalogue in the Microsoft 365 admin centre — activated and blocked MCP servers, pending BYO MCP approval requests, and Microsoft Defender asset-context mapping per agent — to establish a governed AI tooling baseline.
Work IQ API Access and Tool Call Governance Audit
Audits which agents have Work IQ API grants giving them access to Microsoft 365 organisational context — calendar, email, org chart, files — verifies that all tool calls stay within the tenant trust boundary, and checks Defender for tool-call audit trail completeness.
Computer-Using Agent Risk Assessment
Inventories Computer-Using Agents (CUAs) built in Copilot Studio, assesses which desktop and web applications each agent can drive via UI automation, checks whether human approval gates are configured, and evaluates audit log coverage for CUA actions.
Copilot Notebooks Data Governance Review
Reviews shared Copilot Notebooks across the tenant — grounding sources connected, sensitivity label inheritance on notebook outputs, guest and external access controls, and data residency compliance for Australian-regulated content.
SharePoint Oversharing Audit
Audit SharePoint Online sharing links and flag sites where external or broad access breaches policy, aligned to ASD Essential Eight Control 5.
Everyone Except External Users (EEEU) Sweep
Find SharePoint sites and files shared with Everyone Except External Users, the top Microsoft 365 Copilot oversharing vector, and risk-rank them.
External Sharing Deep Audit
Inventory every externally shared item across SharePoint, OneDrive, and Teams, ranked by recipient risk, aligned to ASD Essential Eight Control 5.
Sharing Links Activity Audit
Analyse Anyone, Organisation and Specific People sharing-link activity across SharePoint Online and OneDrive to surface high-risk trends and stale links.
Broken Permission Inheritance Audit
Find SharePoint Online items with broken permission inheritance and rank them by access scope and sensitivity, aligned to ASD Essential Eight Control 5.
Site Permissions Baseline
Produce a per-site SharePoint permissions snapshot of broad access, owners and broken-inheritance scopes as a baseline for least-privilege governance.
Data Access Governance Report Review
Interpret SharePoint Advanced Management Data Access Governance reports and turn oversharing and sharing-link findings into a prioritised remediation plan.
Restricted SharePoint Search Readiness
Rank the highest-risk SharePoint Online sites to set a Restricted SharePoint Search allowlist before broadening Microsoft 365 Copilot access.
Site Lifecycle Review
Identify inactive, ownerless, and stale SharePoint Online sites and recommend a keep, archive, or decommission action for each governance cycle.
Teams and Groups Sprawl Audit
Audit Microsoft 365 Groups and Teams for ownerless groups, public teams, guest access and inactivity that expand the Copilot and oversharing surface.
Teams Meeting Policy and Recording Governance Audit
Audits Microsoft Teams meeting policies for recording permissions, transcription settings, sensitivity label inheritance, and compliance-recording coverage to reduce data exposure from uncontrolled meeting recordings.
SharePoint Advanced Management Site Governance Audit
Audits the Microsoft SharePoint Advanced Management feature set — data access governance reports, restricted access control, site ownership policies, and AI readiness signals — to identify governance gaps in the SharePoint estate.
SharePoint AI Skills Governance Audit
Inventories AI Skill files across SharePoint sites, audits authoring permissions on the Agent Assets library, checks sensitivity label compliance on skill Markdown files, and maps governance controls across tenant, site, and user tiers.
SharePoint Agent Publishing and Data Source Audit
Discovers all Copilot Studio agents published to SharePoint sites as a channel, audits publisher identity, connected knowledge sources, licensing status, site owner approval, and whether agents inherit or override SharePoint sensitivity controls.
Teams External Access and Guest Audit
Audit Microsoft Teams external access, federation, and guest sharing settings that widen the collaboration and Copilot surface.
Purview Label Coverage
Scans SharePoint libraries for the proportion of documents carrying a Purview sensitivity label and flags libraries with unlabelled sensitive content.
DSPM for AI Remediation
Turns Microsoft Purview DSPM for AI oversharing findings into an owner-assigned remediation plan mapped to sensitivity labels, DLP, and ISM evidence.
Shadow AI App Discovery
Ranks unsanctioned generative AI apps from Defender for Cloud Apps and Purview DSPM for AI signals by users, data exposure, and risk score.
Teams Meeting Label Inheritance Check
Verifies Teams recordings, transcripts, and Loop notes inherited the meeting's Purview sensitivity label, flagging unlabelled artefacts and downgrades.
Tenant DLP Coverage and Effectiveness Audit
Audit Microsoft Purview DLP coverage across Exchange, SharePoint, OneDrive, Teams and endpoints to surface gaps, overlaps and simulation results.
Copilot DLP Impact and Simulation
Simulate Microsoft Purview DLP for Microsoft 365 Copilot: preview which prompts, files and labels would be blocked and measure coverage.
Data Classification and Sensitive Info Type Coverage
Assess Microsoft Purview sensitive information type and trainable-classifier match coverage across your data estate for DLP and compliance.
Retention and Records Management Audit
Audit Microsoft Purview retention labels, policies, records management coverage, disposition reviews, and Microsoft 365 Copilot content retention.
Communication Compliance Coverage
Assess Microsoft Purview Communication Compliance policy coverage, AI-interaction monitoring, match rates and escalation health in Microsoft 365.
Insider Risk Management Coverage Review
Audit Microsoft Purview Insider Risk Management policy and indicator coverage to surface gaps and tuning opportunities, read-only.
eDiscovery and Legal Hold Readiness
Audit Microsoft Purview eDiscovery legal holds, collection integrity and search or export readiness for litigation and regulatory response.
Audit Log Retention and Coverage Validator
Verify the Microsoft Purview Unified Audit Log is enabled, retention meets Essential Eight and IRAP needs, and Copilot auditing is captured.
Copilot Interaction Compliance Audit
Analyse Microsoft 365 Copilot audit and DSPM for AI signals to surface sensitive-data exposure and compliance risk in user interactions.
Conditional Access Coverage Gap Analysis
Find users, apps, and sign-ins outside Conditional Access coverage, surfacing MFA, compliant-device, and legacy-auth gaps for Essential Eight assurance.
PIM Privileged Role and Activation Audit
Audit Entra Privileged Identity Management for standing versus eligible roles, activation anomalies and approval gaps against Essential Eight.
Access Reviews Health Audit
Audit Microsoft Entra access reviews for coverage, currency and completion, flagging stale reviews and unactioned recommendations for least-privilege governance.
Entitlement Management Access Package Audit
Audit Microsoft Entra entitlement management access packages: policies, separation of duties, approvals and expirations for identity governance.
Lifecycle Workflows Joiner Mover Leaver Coverage
Audit Microsoft Entra lifecycle workflows for joiner, mover and leaver automation coverage and manual identity gaps.
Stale and Guest Account Audit
Read-only audit that finds inactive, disabled, and orphaned Microsoft Entra guest accounts to reduce identity attack surface and support access reviews.
App Registration and Secret Hygiene
Audit Microsoft Entra app registrations for expiring secrets, certificates, missing owners and over-permissioned API access.
Enterprise App and OAuth Consent Risk Audit
Audit admin-consented enterprise apps and risky OAuth grants in Microsoft Entra to surface illicit consent and over-privileged service principals.
Workload Identity Risk Audit
Audit service principals and managed identities for risk, credentials and anomalous sign-ins using Microsoft Entra ID Protection.
Risky Users and Sign-Ins Summary
Summarise Microsoft Entra ID Protection risk detections: leaked credentials, impossible travel and password spray, with remediation paths.
MFA and Strong Authentication Coverage Audit
Audit Microsoft Entra to find users without MFA, weak SMS or voice methods, and FIDO2 or passkey adoption to lift authentication assurance.
Starter Leaver Access Review
Maps a user's SharePoint, Teams, group, mailbox, and app access and recommends an onboarding baseline or an audit-safe revocation order.
Inactive Licence Recovery
Reports Microsoft 365 users dormant past a sign-in threshold, separates disabled from dormant accounts, and quantifies recoverable AUD spend.
E8 Evidence Packager
Compiles SharePoint permission reports, access logs, and governance records into a versioned, indexed evidence folder for an Essential Eight ML2 assessment.
Zero Trust Maturity Baseline
Scores a Microsoft 365 tenant against the AT.8xxx Zero Trust control family across five pillars, with control-level evidence pointers and uplift steps.
Microsoft Secure Score Improvement Plan
Benchmark Microsoft Secure Score across identity, device, app and data and produce a prioritised improvement plan mapped to the Essential Eight.
Compliance Manager Control Mapper
Map Microsoft Purview Compliance Manager controls to ISM, Essential Eight, SOCI and the Privacy Act to produce a prioritised gap list.
Intune Device Compliance and Baseline Gap
Audit Intune devices for missing compliance policies, security baselines and encryption against Essential Eight patching and hardening.
Admin Action and Audit Trail Review
Review privileged admin actions in the Microsoft Purview audit log to detect unauthorised role changes, policy edits, and agent activity.
IRAP Evidence Trail
Reorganises governance documents into ISM-mapped evidence folders for a 2026 IRAP QA Framework assessment, indexed by control and gap-flagged.
SOCI Incident Responder
Drafts the SOCI Act incident notification brief for the 12-72 hour window: affected assets, classification, containment, impact, and recipients.
Privacy Act ADM Logger
Produces a Privacy Act-compliant automated decision-making log for an in-scope agent, capturing inputs, rationale, model version, and manual review path.
Purview AI Activity Explorer
Audits AI interaction data in the Microsoft Purview AI Hub activity explorer, surfacing prompt and response events, sensitive data access, and policy violations across Copilot and third-party AI apps.
Defender for Cloud Apps Policy Coverage Audit
Audits the Microsoft Defender for Cloud Apps policy catalogue for gaps in discovery, access, session, and anomaly-detection coverage across sanctioned and unsanctioned cloud applications.
Defender for Cloud Apps OAuth App Governance
Audits OAuth applications connected to the Microsoft 365 tenant through Defender for Cloud Apps app governance, flags high-risk consents and over-privileged apps, and recommends remediation actions.
Defender for Cloud Apps Session Controls Review
Reviews Microsoft Defender for Cloud Apps Conditional Access App Control session policies, identifies SaaS applications lacking real-time session protection, and recommends session policy coverage for regulated and high-risk apps.
Microsoft Security Exposure Management Baseline
Runs a Microsoft Security Exposure Management baseline assessment to identify critical attack paths, score initiative coverage, and prioritise the highest-impact security improvements across the Microsoft 365 and Azure estate.
APRA CPS 234 Readiness
Read-only audit that assesses your Microsoft 365 information-security controls against APRA CPS 234 obligations for regulated financial entities.
Cloud App Risk Catalogue Review
Review Microsoft Defender for Cloud Apps catalogue risk scores and sanctioned or unsanctioned tagging for the apps in use.
Defender Advanced Hunting Pack
Run curated read-only Microsoft Defender XDR advanced hunting KQL queries to surface anomalous sign-ins, suspicious inbox rules and risky OAuth grants.
Defender ASR and Endpoint Config Assessment
Read-only audit of Microsoft Defender for Endpoint ASR rules and endpoint hardening against Essential Eight application controls.
Defender Incident Hygiene Review
Read-only review of Microsoft Defender XDR incidents for unassigned, ageing or improperly suppressed items to summarise response hygiene.
Essential Eight Maturity Self-Assessment
Self-assess your Microsoft 365 tenant against all eight ASD Essential Eight strategies and produce a maturity scorecard with evidence pointers.
Essential Eight ML3 Uplift Planner
Assess current Essential Eight maturity across all eight controls and produce a prioritised, read-only plan to uplift from Maturity Level 2 to Level 3.
Exchange Anti-Phishing Coverage
Audit Microsoft Defender for Office 365 anti-phishing, spoof and impersonation protection policy coverage across all mailboxes.
IRAP Control Evidence
Produce control-by-control IRAP assessment evidence for in-scope Microsoft 365 security controls, read-only, mapped to the ISM.
ISM Control Pack
Read-only audit that maps your Microsoft 365 tenant to ASD ISM controls and builds a control-by-control evidence pack.
Mailbox Delegation and Forwarding Audit
Audit Exchange Online mailbox delegations, full-access permissions, and auto-forwarding to external recipients to close a data-exfiltration vector.
MITRE ATT&CK Coverage Gap
Map active Microsoft Sentinel and Defender XDR detections to MITRE ATT&CK tactics and techniques, then report where coverage is missing.
PSPF Control Mapping
Maps your Microsoft 365 security controls to the Australian PSPF and Essential Eight, then reports a prioritised gap list.
Safe Links and Safe Attachments Coverage
Read-only audit of Microsoft Defender for Office 365 Safe Links and Safe Attachments policy coverage across users and domains.
Sentinel Analytics Rule Coverage
Audit Microsoft Sentinel analytics rules for enabled status, MITRE ATT&CK coverage, and noisy or stale detections.
Sentinel Data Connector Coverage
Audit which Microsoft Sentinel data connectors are ingesting and report logging coverage gaps for detection and IRAP.
Threat Hunting Readiness Baseline
Assess whether the tenant is ready for threat hunting: log retention, advanced hunting access, Sentinel workspace coverage and KQL availability.
Transport Rule Risk Review
Review Exchange Online mail flow (transport) rules for risky patterns that bypass security controls or exfiltrate mail.