README.md — Users and Apps Audit

# Users and Apps Audit

Version 0.1.0. A read-only Agent Skill that reports Microsoft Graph users, licenses, app credential expiry, privileged directory role membership and guest creation dates. It uses Python 3.10+ standard library only and is free under the MIT license. Skills Outpost distributes the complete package.

See SETUP.md for credentials, permissions and examples. The report contains personal data, including names, user principal names, role memberships and account creation dates. Store and share it accordingly. The CLI never changes Microsoft Graph resources. A local `--out` file requires a matching dry-run approval digest, refuses an existing path or symlink, and uses mode 0600 on POSIX.

The optional AuditLog.Read.All permission enables the no-sign-in window. An HTTP 403 for that optional query is shown as `skipped (permission missing)`; errors in required queries make the report incomplete. `--allow-partial` changes only the exit status, not the status or skipped list in the report.

Microsoft 365, Microsoft Graph and Microsoft Entra ID (formerly Azure AD) are Microsoft trademarks. This product is independent of Microsoft.

Supported platforms: macOS and Linux with POSIX directory-descriptor and no-follow APIs; Windows is unsupported and fails before file or network I/O.

The approval digest binds the selected and fully resolved file path, exact report content, and device/inode identities of the existing destination directory and its parent. Live creation walks the resolved path with no-follow directory descriptors, verifies identities and the selected path resolution, and creates the file relative to the directory descriptor with exclusive/no-follow flags at mode 0600. A swapped parent is refused before writing. All output directories must already exist; no folders are created.

Section selection restricts Graph queries, but users, licenses or guests each fetch the full selected users field set for all paginated users; report filters run after those reads. The no-sign-in list uses lastSignInDateTime, which records a sign-in attempt and does not prove successful sign-in or actual inactivity. Named activated roles are a fixed English display-name set; this is an inventory, not a policy evaluation.

The token POST sends tenant identifier in the URL and client ID, client secret, scope and grant type to login.microsoftonline.com. Graph GETs send the bearer access token and query paths to graph.microsoft.com, including role identifiers and same-host pagination paths obtained from Graph responses. Fetched pagination path/query contents are sent as received; display-name and UPN fields are not explicitly resent. Report content is not uploaded. Hostnames are given to the configured system resolver or proxy; no application DNS lookup of fetched user names occurs. Proxy settings may introduce a configured proxy destination.

Each JSON fixture and HTTP response body is limited to 8 MiB before parsing; oversized or malformed input fails with a clear error. Pagination is limited to 1000 pages per query. No stdin is read. Invalid nested Graph fields or timestamps produce explicit incomplete-section errors; missing optional values are not evidence of inactivity.

Remote paths reject dot segments, controls and encoded slash or backslash within a segment before requests.

By Zero Width Lab (zerowidthlab.com)

License: MIT (read it).

Back to the listing