Install the plugin . Which skill do I use? . Prompts to try

Security work is not just a configuration problem. It is a decision problem: which control applies here, what needs to be validated before a policy goes live, which investigation path to follow, and what guardrails matter in this environment. The Microsoft Security Skills Plugin packages security expertise into curated skills so compatible coding agents can give accurate, opinionated Microsoft Security guidance instead of generic security advice.

• 56 curated Microsoft Security skills
• Coverage: Security, Identity and Management, Compliance and Privacy, Cloud platform security
• Compatible with GitHub Copilot, Claude Code, Cursor, Codex CLI, Gemini CLI, and other agentic hosts
• Public knowledge only, grounded in Microsoft Learn
• Behaviourally validated: a reproducible harness measures the lift each skill adds over an unaided model, verified across two independent frontier models (details)

This plugin ships 56 curated Microsoft Security skills that teach an agent how security work gets done across the Microsoft portfolio. Each skill provides workflows, decision trees, and guardrails grounded in public Microsoft Learn documentation - no proprietary content.

Skills are grouped by portfolio area:

• Threat protection and SecOps with defender-xdr, defender-for-endpoint, defender-for-identity, defender-for-cloud-hardening, sentinel, unified-secops-platform, and threat-modelling
• Identity, access, and governance with entra-id, entra-id-governance, entra-id-protection, entra-permissions-management, conditional-access-mfa, azure-pim, and windows-hello
• Compliance and data protection with purview-dlp-policy, purview-advanced-dlp, purview-ediscovery, purview-audit, purview-data-classification, purview-data-lifecycle, purview-communication-compliance, insider-risk-baseline, and microsoft-priva
• Endpoint and device management with intune-device-mgmt, intune-app-protection, bitlocker-design, and paw-design
• Cloud and platform security with azure-policy, azure-key-vault, azure-network-security-design, azure-firewall, azure-app-service-security, cloud-app-security-posture, and api-security-design
• Security operations acceleration with security-copilot, security-copilot-agents, compromise-recovery, and azure-site-recovery

This is not a prompt pack. It is a packaged Microsoft Security capability layer:

• Skills teach the agent when to use each security workflow and what to avoid.
• Guardrails are built into every skill to prevent common implementation mistakes.
• Public knowledge only - every skill cites Microsoft Learn; no proprietary methodology or customer data is included.
• Multi-host support lets you use the same security capability across GitHub Copilot in VS Code, Copilot CLI, Claude Code, Cursor, Codex CLI, Gemini CLI, and other compatible hosts.

Before you install, make sure you have:

• Git installed and accessible from the command line
• Node.js 18+ available on your PATH if you plan to use npx skills add to install

You can verify these with:

git --version
npx --version

The Microsoft Security Skills Plugin supports APM. One command installs it across GitHub Copilot, Claude Code, Cursor, OpenCode, Codex, and Gemini:

apm install vinayaklatthe/microsoft-security-skills

Clone the repository and point your agent at the skills/ directory:

git clone https://github.com/vinayaklatthe/microsoft-security-skills.git

Or use the skills CLI to install globally for a specific host:

# GitHub Copilot (VS Code, Copilot CLI)
npx skills add https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills -a github-copilot -g -y

# Claude Code
npx skills add https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills -a claude -g -y

# Cursor
npx skills add https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills -a cursor -g -y

# Codex CLI
npx skills add https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills -a codex -g -y

Install the extension:

gemini extensions install https://github.com/vinayaklatthe/microsoft-security-skills

After install, try three quick checks.

Ask:

What Microsoft Defender controls should I prioritise for a new Microsoft 365 tenant?

You should get structured, product-specific guidance with Microsoft Learn references - not generic security advice.

Ask:

How do I design a Conditional Access policy baseline for a mid-size organisation?

You should get a policy framework with named Conditional Access templates and guardrails.

Ask:

What Purview DLP policies should I configure to protect sensitive data in Microsoft 365?

You should get scoped DLP guidance with workload-specific recommendations.

Once the plugin is installed, try prompts like these:

• What are the first Defender XDR controls I should enable for a new tenant?
• Design a Conditional Access baseline for our Entra ID tenant.
• Help me build a Purview DLP policy to protect financial data.
• What Sentinel analytic rules should I enable for identity threat detection?
• How do I configure Entra ID Protection for risky sign-in response?
• Review my Intune device compliance policy for security gaps.
• What Defender for Cloud hardening recommendations apply to my Azure workloads?
• Help me design a PAW (Privileged Access Workstation) deployment.
• What Purview Insider Risk policies should I start with?
• How do I use Security Copilot to accelerate an incident investigation?

Use this table to pick the right skill before asking your question.

Overlapping scenarios: If your scenario spans multiple areas (e.g., a SOC involving both SIEM and XDR), start with the most specific skill and follow its cross-references.

1. Agents scan skill front matter (name, description, and WHEN: triggers) to identify likely matches.
2. Agents load the most relevant SKILL.md files for detailed guidance.
3. Agents follow the skill body to produce focused, actionable outputs tied to Microsoft Learn references.

The key pieces are:

• skills/ - the Microsoft Security skill definitions, one subfolder per skill
• plugin.json - plugin metadata for agent harnesses
• validation/ - zero-dependency validation harness (structure, links, evals)
• README.md - high-level overview and install guide

skills/
  sentinel/SKILL.md
  defender-xdr/SKILL.md
  purview-dlp-policy/SKILL.md
  ...

Each SKILL.md follows a consistent structure:

---
name: <skill-slug>
description: "<what it does>. WHEN: <trigger>, <trigger>, <trigger>."
license: MIT
metadata:
  author: Microsoft
  version: "0.1.0"
---

<concise, public-knowledge guidance, with Microsoft Learn links>

A zero-dependency validation harness (just Node 18+, no npm install) verifies the skills are well-formed, accurate, and actually drive the intended outcome.

npm run check:structure   # frontmatter, WHEN: triggers, required sections
npm run eval              # desired-outcome coverage (see validation/cases/)
npm run check:links       # every Microsoft Learn URL resolves (catches link rot)
npm run validate          # all three

Three layers of checks:

The behavioural eval reads assertion files in validation/cases/<skill>.json. Each case lists a prompt and the must-mention points a good answer should contain, grounded in the skill's Microsoft Learn references. The default coverage mode checks those points are present in the skill (runs anywhere, free). To score real model answers, generate one <skill>__<index>.txt per case with the skill loaded, then run:

npm run eval:answers          # score answers in validation/answers/with-skill
npm run eval:answers:report   # same, as a Hit/Miss + Score table

The 10 highest-risk skills ship with hand-authored assertions and a set of with-skill answers. To prove a skill changes behaviour, capture a baseline (answers from a clean session with no skill loaded) and compare the scores - see validation/answers/README.md.

npm run eval:compare          # baseline vs with-skill, lift summary
npm run eval:compare:report   # per-case comparison table

Measured on the 10 high-risk skills (20 prompts, 61 assertions), validated across two independent frontier models used as graders:

The skill never regressed either model, and the gains concentrate on the high-consequence operational details a generic answer tends to skip. See validation/answers/README.md.

All three checks run automatically on every pull request and weekly (link-rot sweep) via GitHub Actions - see .github/workflows/validate.yml.

• Make sure the plugin installed successfully in your host.
• Confirm the skills/ directory is present and contains SKILL.md files.
• Reload or restart your host so it re-indexes plugins and skill definitions.

• The agent may not have matched a skill trigger. Try phrasing the prompt using product names directly (for example, "Defender XDR", "Purview DLP", "Entra Conditional Access").
• Check that the skill's WHEN: triggers in the description front matter cover your scenario. If they do not, open an issue or a pull request.

• Check the skills/ directory first - coverage may already exist under a different name.
• If genuinely missing, contributions are welcome. See the contributing guide below.

• Microsoft Security documentation
• Microsoft Defender XDR documentation
• Microsoft Sentinel documentation
• Microsoft Entra documentation
• Microsoft Purview documentation
• microsoft/azure-skills - the Azure equivalent of this plugin

Contributions are welcome. Keep every skill:

• Public-knowledge only - cite Microsoft Learn; no proprietary methodology or customer data.
• Focused - one product or task per skill.
• Concise - guidance an agent can act on, not a full product manual.
• Guarded - include at least one guardrail section covering common mistakes.

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA). For details, visit https://cla.opensource.microsoft.com.

This project may contain trademarks or logos for projects, products, or services. Authorised use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines.

MIT