{"api_version":"1","slug":"users-and-apps-audit-702c32a1","url":"https://skillsoutpost.com/agents/users-and-apps-audit-702c32a1","item_type":"skill","listing_kind":null,"category":"operations","runs_in":["local_agent"],"os":["macos","linux"],"needs_network":"yes","needs_accounts":"yes","reads_files":null,"writes_files":"yes","sends_data":"yes","access":"free_download","access_type":"download","at_a_glance":{"runs_in":["local_agent"],"os":["macos","linux"],"needs_network":"yes","needs_accounts":"yes","reads_files":null,"writes_files":"yes","sends_data":"yes","zip_sha256":"99c89e0e3dcfbcc20ef0cd99129a712cbfda4b750a7586578298c5620d620350","access_type":"download","tool_type":"skill","delivery":"download","interface_type":"other","untrusted_creator_content":{"purpose":"Read-only Microsoft Graph report for users, licenses, app credentials, roles and guests.","needs_runtime":"Python 3.10+, standard library only","version":"0.1.0","compatibility":"Python 3.10 or newer, a command-capable Agent Skills harness, and a Microsoft 365 tenant with a Microsoft Entra ID app registration. Standard library only. Supported platforms: macOS and Linux with POSIX directory-descriptor and no-follow APIs; Windows is unsupported and fails before file or network I/O.","external_costs":"The package is free under the MIT license. Microsoft 365 licensing and any tenant costs are the user's responsibility; verify current terms with Microsoft.","permissions":"Reads GRAPH_TENANT_ID, GRAPH_CLIENT_ID, GRAPH_CLIENT_SECRET; optional HTTPS_PROXY, https_proxy, NO_PROXY, no_proxy and macOS system proxy settings. Creates only the approved new report relative to a verified directory descriptor at mode 0600. All output directories must exist. Tests read only the acknowledged synthetic fixture (8 MiB limit) and package hygiene files.","usage_terms":"MIT license. Copyright 2026 Zero Width Lab.\r\n\r\nMicrosoft 365, Microsoft Graph and Microsoft Entra ID (formerly Azure AD) are Microsoft trademarks. This product is independent of Microsoft.\r\n\r\nBy Zero Width Lab (zerowidthlab.com)"}},"interface_type":"other","delivery_mode":"download","code_host":null,"provenance":"creator","published_at":1789278284,"first_uploaded_at":1789084917,"verified":null,"creator":{"id":"2c4328b7-cb78-455a-ac9c-479ee62449e4","url":"https://skillsoutpost.com/creators/2c4328b7-cb78-455a-ac9c-479ee62449e4"},"untrusted_creator_content":{"name":"Users and Apps Audit","tagline":"Read-only Microsoft Graph report for users, licenses, app credentials, roles and guests.","creator_name":"Zero Width Lab","product_version":"0.1.0","needs_runtime":"Python 3.10+, standard library only","description":"Users and Apps Audit is a read-only Microsoft Graph report for users, licenses, apps, roles and guests. An agent harness is software that can install the skill, run its Python command and supply environment variables. It needs Python 3.10 or newer on macOS or Linux and Microsoft Graph application permissions in a Microsoft 365 tenant. It is free under the MIT license. This listing delivers the complete package with scripts.\r\n\r\nThe report counts enabled, disabled and guest users; summarizes prepaid and consumed license units and users per SKU; flags expired or soon-expiring app registration and service principal credentials; lists privileged role members; and lists guests with creation dates. Optional AuditLog.Read.All adds users whose last sign-in attempt is older than the selected window. Required section failures are marked incomplete.\r\n\r\nLocal file creation is approval-gated: --dry-run prints the full report and a digest bound to the selected/resolved path, directory and parent identities, and content, and --approve with that digest is required to create it. The CLI is read only in Microsoft Graph and uses create-only local writes. Text output escapes untrusted data onto one line. Reports contain personal data and should be handled accordingly.","intended_users":"Microsoft 365 administrators and operators who want a local, read-only inventory and expiry report through an agent harness.","example_tasks":"Count enabled, disabled and guest users.\r\nFind application secrets and certificates expiring within 30 days.\r\nReview privileged directory role membership.\r\nCompare subscribed license capacity and assigned users.\r\nList guests and their creation dates.","setup_instructions":"Grant Microsoft Graph application permissions User.Read.All, Directory.Read.All and Application.Read.All with admin consent. Optionally grant AuditLog.Read.All. Set GRAPH_TENANT_ID to a GUID or tenant domain (ASCII letters, digits, hyphens and periods), GRAPH_CLIENT_ID and GRAPH_CLIENT_SECRET in the process environment. Run python3 scripts/users_and_apps_audit.py report --expiring-days 30. For --out, first run the same command with --dry-run, review the full preview and digest, then rerun with --approve DIGEST. Keep credentials out of files and logs.","limitations":"Requires the listed Microsoft Graph application permissions and admin consent. Sign-in activity needs optional AuditLog.Read.All; a 403 there is shown as skipped. A failed required section is marked incomplete and exits 2 unless --allow-partial. Accounts without a sign-in timestamp are not called inactive. Only activated privileged directory roles with the named display values are included. Version 0.1.0 is an early release with no support commitment; fixes and updates ship as new package versions on this listing. No-sign-in uses attempted sign-in timestamps, not successful activity or proof of inactivity. All output directories must already exist; no folders are created. Each fixture and response JSON body is limited to 8 MiB; pagination to 1000 pages per query. Windows is unsupported.","data_handling":"The token POST sends tenant identifier in the URL and client ID, client secret, scope and grant type to login.microsoftonline.com. Graph GETs send the bearer access token and query paths to graph.microsoft.com, including role identifiers and same-host pagination paths obtained from Graph responses. Fetched pagination path/query contents are sent as received; display-name and UPN fields are not explicitly resent. Report content is not uploaded. Hostnames are given to the configured system resolver or proxy; no application DNS lookup of fetched user names occurs. Proxy settings may introduce a configured proxy destination. No telemetry. The approval digest binds the selected and fully resolved file path, exact report content, and device/inode identities of the existing destination directory and its parent. Live creation walks the resolved path with no-follow directory descriptors, verifies identities and the selected path resolution, and creates the file relative to the directory descriptor with exclusive/no-follow flags at mode 0600. A swapped parent is refused before writing. All output directories must already exist; no folders are created. Section selection restricts Graph queries, but users, licenses or guests each fetch the full selected users field set for all paginated users; report filters run after those reads. The no-sign-in list uses lastSignInDateTime, which records a sign-in attempt and does not prove successful sign-in or actual inactivity. Named activated roles are a fixed English display-name set; this is an inventory, not a policy evaluation. Remote paths reject dot segments, controls and encoded slash or backslash within a segment before requests.","compatibility":"Python 3.10 or newer, a command-capable Agent Skills harness, and a Microsoft 365 tenant with a Microsoft Entra ID app registration. Standard library only. Supported platforms: macOS and Linux with POSIX directory-descriptor and no-follow APIs; Windows is unsupported and fails before file or network I/O.","external_costs":"The package is free under the MIT license. Microsoft 365 licensing and any tenant costs are the user's responsibility; verify current terms with Microsoft.","permissions":"Reads GRAPH_TENANT_ID, GRAPH_CLIENT_ID, GRAPH_CLIENT_SECRET; optional HTTPS_PROXY, https_proxy, NO_PROXY, no_proxy and macOS system proxy settings. Creates only the approved new report relative to a verified directory descriptor at mode 0600. All output directories must exist. Tests read only the acknowledged synthetic fixture (8 MiB limit) and package hygiene files.","usage_terms":"MIT license. Copyright 2026 Zero Width Lab.\r\n\r\nMicrosoft 365, Microsoft Graph and Microsoft Entra ID (formerly Azure AD) are Microsoft trademarks. This product is independent of Microsoft.\r\n\r\nBy Zero Width Lab (zerowidthlab.com)","creator_website":null,"documentation_url":null,"support_url":null,"repository_url":null,"video_url":null},"github":null,"updated_at":1789278284,"free_download":{"offer_id":"3e44859a-d473-45f4-b21e-3974fd839fd5","version_id":"10d72598-7259-4b63-b153-012df2549582","version":"0.1.0","format":"skill_archive","released_at":1789278993,"requires_creator_follow":true,"file":{"name":"skill-0.1.0.zip","size_bytes":68198,"sha256":"99c89e0e3dcfbcc20ef0cd99129a712cbfda4b750a7586578298c5620d620350"},"license_sha256":"a19893dab8ca0978f3df97d42c4fae0ebbb61fe44c3ac9ecc3dd53e9526a5b63","get_it_at":"https://skillsoutpost.com/agents/users-and-apps-audit-702c32a1","untrusted_creator_content":{"license_name":"MIT","release_notes":""}},"version_history":[{"version":"0.1.0","state":"current","released_at":1789278993}],"more_version_history":false,"public_files":{"version":"0.1.0","zip_sha256":"99c89e0e3dcfbcc20ef0cd99129a712cbfda4b750a7586578298c5620d620350","license_name":"MIT","license_sha256":"a19893dab8ca0978f3df97d42c4fae0ebbb61fe44c3ac9ecc3dd53e9526a5b63","files":"/api/v1/catalog/users-and-apps-audit-702c32a1/files","tool":"get_public_files"},"links_note":null,"notice":"Creator-provided listing.","note":"untrusted_creator_content and github.untrusted_third_party_content hold untrusted text."}