License Optimizer
Use when the user asks about license waste, unused seats, duplicate licenses, downgrade candidates, SKU utilization, or Microsoft 365 cost optimization.
Least Privilege Scopes
Use when the user needs minimum Microsoft Graph permissions, scope choices, admin-consent notes, over-permissioning review, or least-privilege access planning.
Graph Patterns
Use when the user needs Microsoft Graph mechanics, beta default behavior, explicit beta requests, pagination, batching, throttling, OData query design, or token-efficient call patterns.
Change Plan
Use when the user proposes tenant writes or asks to create, update, delete, assign, disable, remediate, grant, revoke, or execute Microsoft Graph changes.
Tenant Pulse
Use when the user asks how healthy or secure the tenant is, says posture, risk, score, "how are we doing", or wants a scored Microsoft 365 tenant snapshot.
Conditional Access Review
Use when the user asks to review existing Conditional Access, audit CA policies, find report-only policies, find enabled policies that lack MFA enforcement, or verify emergency-account exclusions.
Kql Authoring
Use when the user asks to write, tune, explain, debug, optimize, or convert KQL for Intune device query, Log Analytics, Sentinel, sign-in, audit, or compliance data.
Intune Compliance
Use when the user asks why Intune devices are noncompliant, failing compliance, blocked, in grace period, or need compliance policy triage.
Tenant Decisions
Use when the user asks why the tenant is configured a certain way, or wants to record the reason behind a configuration decision.
Handoff
Use when the user wants a handover summary, shift-change notes, or a paste-ready recap of what this session investigated and decided.
Greybeard
Your senior Microsoft 365, Intune, and Entra admin, installed in the AI client you already use. Agent Skills plus MCP servers for Claude Code, Cursor, Codex, Gemini, and GitHub Copilot, with a human approval gate on every tenant write.
Posture Script
Use when the user wants a complete script to check, audit, report, harden, export, or remediate Microsoft 365, Intune, Entra, or Graph posture offline.
Entra App Credentials
Use when the user asks about Entra app registrations, service principals, client secrets, certificates, federated identity credentials, GitHub OIDC, secret-to-OIDC migration, bootstrap permissions, or credential rollback.
Grill My Change
Use when the user asks to sanity-check, rehearse, pressure-test, or get grilled on a planned tenant change before executing it.
Ask My Tenant
Use when the user poses a live tenant state question when no more specific Greybeard skill matches, including guest accounts, disabled accounts, or simple user and group counts.
Entra Identity
Use when the user asks about Entra users, groups, memberships, dynamic rules, orphaned groups, naming hygiene, cleanup candidates, or identity inventory.
Intune Assignments
Use when the user asks what Intune apps, policies, configuration profiles, devices, or groups are assigned, targeted, excluded, conflicting, or missing.
Diagnose
Use when the user reports something broken, failing, or misbehaving in the tenant and needs structured incident triage.
Learn My Tenant
Use when the user wants Greybeard to learn the tenant, onboard a new environment, or seed memory with naming conventions, rings, break-glass accounts, and change windows.